From f75ae5c9832832827d5b053185297a809bacabd0 Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Mon, 14 Apr 2025 22:58:03 -0500
Subject: [PATCH] Remove Git from Isaiah

Remove the Gitlab container from Isaiah
Remove references to the builder in a container on Isaiah
Combine configuration into a single file
---
 hosts/isaiah/container-git.nix    | 240 ------------------------------
 hosts/isaiah/container-runner.nix | 109 --------------
 hosts/isaiah/default.nix          | 101 +++++++++++--
 hosts/isaiah/git.nix              | 106 -------------
 4 files changed, 88 insertions(+), 468 deletions(-)
 delete mode 100644 hosts/isaiah/container-git.nix
 delete mode 100644 hosts/isaiah/container-runner.nix
 delete mode 100644 hosts/isaiah/git.nix

diff --git a/hosts/isaiah/container-git.nix b/hosts/isaiah/container-git.nix
deleted file mode 100644
index f1300d2..0000000
--- a/hosts/isaiah/container-git.nix
+++ /dev/null
@@ -1,240 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  registryPort = 5000;
-  vpnIp = "100.78.226.76";
-  containerIp = "192.168.200.2";
-in
-{
-  age.secretsMountPoint = "/run/derp";
-  age.secrets =
-    let
-      cfg = n: {
-        file = ../../secrets/gitlab/${n}.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-    in
-    {
-      gitlab-secret = cfg "secret";
-      gitlab-otp = cfg "otp";
-      gitlab-db = cfg "db";
-      gitlab-jws = cfg "jws";
-      gitlab-key = cfg "key";
-      gitlab-cert = cfg "cert";
-
-      minio_access_key_id = {
-        file = ../../secrets/minio_access_key_id.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-      minio_secret_access_key = {
-        file = ../../secrets/minio_secret_access_key.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-    };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    registryPort
-  ];
-
-  greg.proxies =
-    let
-      t = {
-        target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
-        extraConfig = ''
-          proxy_set_header X-Forwarded-Proto https;
-          proxy_set_header X-Forwarded-Ssl on;
-          client_max_body_size 10000m;
-        '';
-      };
-    in
-    {
-      "${containerIp}" = t;
-      "${vpnIp}" = t;
-      "git.thehellings.lan" = t;
-    };
-
-  virtualisation.docker.enable = true;
-
-  greg.backup.jobs.nas-backup = {
-    src = "/var/gitlab/state/backup/";
-    dest = "gitlab";
-    id = "container-gitlab";
-  };
-
-  services = {
-    # Fetch the SSL certificates for nginx to use
-    cron = {
-      enable = true;
-      systemCronJobs = [
-        "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx"
-      ];
-    };
-
-    gitlab = {
-      enable = true;
-      backup = {
-        keepTime = 288;
-        startAt = [ "03:00" ];
-      };
-      host = "src.thehellings.com";
-      https = true;
-      port = 443;
-      extraConfig = {
-        gitlab = {
-          trustedProxies = [
-            "100.78.226.76/32" # The container itself
-            "100.115.57.8/32" # Public server's IP
-          ];
-        };
-      };
-      initialRootEmail = "greg@thehellings.com";
-      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
-      pages = {
-        enable = true;
-        settings.pages-domain = "pages.thehellings.com";
-      };
-      puma = {
-        threadsMax = 6;
-        threadsMin = 2;
-        workers = 6;
-      };
-      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
-      registry = {
-        enable = true;
-        certFile = config.age.secrets.gitlab-cert.path;
-        keyFile = config.age.secrets.gitlab-key.path;
-        externalAddress = "registry.thehellings.com";
-        externalPort = 443;
-      };
-      secrets = {
-        secretFile = config.age.secrets.gitlab-secret.path;
-        otpFile = config.age.secrets.gitlab-otp.path;
-        dbFile = config.age.secrets.gitlab-db.path;
-        jwsFile = config.age.secrets.gitlab-jws.path;
-      };
-
-      extraConfig = {
-        object_store = {
-          enabled = true;
-          proxy_download = true; # Tell them to reach out to object storage themselves!
-          connection = {
-            provider = "AWS";
-            endpoint = "http://s3.thehellings.lan:9000";
-            region = "us-east-1";
-            aws_access_key_id = {
-              _secret = config.age.secrets.minio_access_key_id.path;
-            };
-            aws_secret_access_key = {
-              _secret = config.age.secrets.minio_secret_access_key.path;
-            };
-            path_style = true; # True for MinIO
-            aws_signature_version = 2;
-          };
-          #storage_options = ...;
-          objects = builtins.listToAttrs (
-            builtins.map
-              (
-                x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
-              )
-              [
-                "artifacts"
-                "ci_secure_files"
-                "dependency_proxy"
-                "external_diffs"
-                "lfs"
-                "packages"
-                "pages"
-                "terraform_state"
-                "uploads"
-              ]
-          );
-        };
-      };
-    };
-
-    nginx = {
-      clientMaxBodySize = "25000m";
-      virtualHosts."gitlab.shire-zebra.ts.net" = {
-        listen = [
-          {
-            addr = vpnIp;
-            port = registryPort;
-            ssl = true;
-          }
-        ];
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:4567/";
-          recommendedProxySettings = true;
-        };
-        extraConfig = ''
-          ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;
-          ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;
-          client_max_body_size 10000m ;
-        '';
-      };
-    };
-
-    openssh.enable = true;
-
-    logrotate = {
-      enable = true;
-      settings = {
-        "/var/lib/postgresql/*/log/*.log" = {
-          enable = true;
-          compress = true;
-          compresscmd = "${pkgs.xz}/bin/xz";
-        };
-      };
-    };
-
-    postgresql = {
-      enable = true;
-      checkConfig = true;
-      ensureDatabases = [ "gitlab" ];
-      ensureUsers = [
-        {
-          name = "gitlab";
-          ensureDBOwnership = true;
-        }
-      ];
-      settings = {
-        log_connections = true;
-        log_statement = "all";
-        logging_collector = true;
-        log_filename = "postgresql.log";
-      };
-    };
-
-    redis.servers.gitlab = {
-      enable = true;
-    };
-    resolved.enable = true;
-  };
-
-  # Do not start nginx until we have tailscaled up and running, so it can bind
-  # to the 100.* addresses
-  systemd.services = {
-    nginx = rec {
-      after = [ "network-online.target" ];
-      requires = [ "network-online.target" ];
-      wants = after;
-      serviceConfig = {
-        RestartMaxDelaySec = "30s";
-        RestartSteps = "5";
-      };
-    };
-    tailscaled.partOf = [ "network-online.target" ];
-  };
-  system.stateVersion = lib.mkForce "24.05";
-}
diff --git a/hosts/isaiah/container-runner.nix b/hosts/isaiah/container-runner.nix
deleted file mode 100644
index 29780ae..0000000
--- a/hosts/isaiah/container-runner.nix
+++ /dev/null
@@ -1,109 +0,0 @@
-{
-  top,
-  name,
-  extra ? { },
-  packages ? [ ],
-  overlays,
-}:
-
-(
-  {
-    config,
-    pkgs,
-    lib,
-    ...
-  }:
-  (lib.attrsets.recursiveUpdate
-    {
-
-      imports = [
-        top.agenix.nixosModules.default
-        top.self.modules.nixosModule
-      ];
-
-      nixpkgs.overlays = overlays;
-
-      greg.tailscale.enable = true;
-
-      age = {
-        identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-        secrets.runner-reg = {
-          file = ../../secrets/gitlab/isaiah-${name}-runner-reg.age;
-          owner = "gitlab-runner";
-        };
-      };
-
-      environment.systemPackages =
-        with pkgs;
-        [
-          curl
-          gawk
-          git
-          unzip
-          xorriso
-          wget
-        ]
-        ++ packages;
-
-      networking = {
-        useHostResolvConf = pkgs.lib.mkForce false;
-        nameservers = [ "100.100.100.100" ];
-      };
-
-      nixpkgs.config.allowUnfree = true;
-
-      users.users.gitlab-runner = {
-        isSystemUser = true;
-        group = "kvm";
-        extraGroups = [ "kvm" ];
-      };
-
-      services = {
-        gitlab-runner = {
-          enable = true;
-          settings.concurrent = 5;
-          services = {
-            shell = {
-              executor = "shell";
-              limit = 5;
-              authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
-              environmentVariables = {
-                EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-                STORAGE_URL = "s3.thehellings.lan:9000";
-              };
-            };
-          };
-        };
-        resolved.enable = true;
-      };
-
-      systemd.services.gitlab-runner = {
-        wants = [
-          "network-online.target"
-          "systemd-resolved.service"
-        ];
-        after = [
-          "network.target"
-          "network-online.target"
-          "systemd-resolved.service"
-        ];
-        serviceConfig = {
-          DevicePolicy = lib.mkForce "auto";
-          PrivateDevices = false;
-          ProtectKernelModules = false;
-          DevicesAllow = [
-            "/dev/kvm"
-            "/dev/mem"
-          ];
-          DynamicUser = lib.mkForce false;
-          User = "root";
-          Group = "kvm";
-        };
-      };
-
-      system.stateVersion = lib.mkForce "24.05";
-    }
-
-    extra
-  ) # End of attrsets.recursiveUpdate
-) # End of outter function wrapper
diff --git a/hosts/isaiah/default.nix b/hosts/isaiah/default.nix
index 4673b53..7ed661e 100644
--- a/hosts/isaiah/default.nix
+++ b/hosts/isaiah/default.nix
@@ -1,4 +1,5 @@
 {
+  config,
   lib,
   pkgs,
   top,
@@ -7,10 +8,15 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ./git.nix
     top.proxmox.nixosModules.proxmox-ve
   ];
 
+  age.secrets = {
+    runner-reg.file = ../../secrets/gitlab/isaiah-podman-runner-reg.age;
+    docker-auth.file = ../../secrets/gitlab/docker-auth.age;
+    runner-qemu.file = ../../secrets/gitlab/isaiah-qemu-runner-reg.age;
+  };
+
   boot = {
     binfmt.emulatedSystems = [ "aarch64-linux" ];
     extraModprobeConfig = "options kvm_amd nested=1";
@@ -33,6 +39,11 @@
   };
 
   environment.systemPackages = with pkgs; [
+    curl
+    gawk
+    git
+    unzip
+    wget
     zstd
   ];
 
@@ -50,8 +61,6 @@
   };
 
   networking = {
-    hostName = "isaiah";
-    useDHCP = false;
     bridges.br0 = {
       interfaces = [ "enp38s0" ];
     };
@@ -59,6 +68,12 @@
       address = " 10.42.1.1";
       interface = "br0";
     };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 ];
+      checkReversePath = lib.mkForce false;
+    };
+    hostName = "isaiah";
     interfaces = {
       br0 = {
         ipv4.addresses = [
@@ -70,7 +85,12 @@
       };
     };
     nameservers = [ "10.42.1.5" ];
-    firewall.checkReversePath = lib.mkForce false;
+    nat = {
+      enable = true;
+      internalInterfaces = [ "ve-+" ];
+      externalInterface = "br0";
+    };
+    useDHCP = false;
   };
 
   nixpkgs = {
@@ -81,15 +101,66 @@
   };
 
   services = {
+    gitlab-runner = {
+      enable = true;
+      settings = {
+        concurrent = 5;
+      };
+      services = {
+        default = {
+          executor = "docker";
+          authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
+          dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
+          dockerAllowedImages = [
+            "alpine:*"
+            "debian:*"
+            "docker:*"
+            "fedora:*"
+            "python:*"
+            "ubuntu:*"
+            "registry.gitlab.com/gitlab-org/*"
+            "registry.thehellings.com/*/*/*:*"
+            "gitlab.shire-zebra.ts.net:5000/*/*/*:*"
+          ];
+          dockerAllowedServices = [
+            "docker:*"
+            "registry.thehellings.com/*/*/*:*"
+            "gitlab.shire-zebra.ts.net:5000/*/*/*:*"
+          ];
+          dockerPrivileged = true;
+          dockerVolumes = [
+            "/certs/client"
+            "/cache"
+          ];
+        };
+        # qemu = {
+        #   executor = "shell";
+        #   limit = 5;
+        #   authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
+        #   environmentVariables = {
+        #     EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+        #     STORAGE_URL = "s3.thehellings.lan:9000";
+        #   };
+        # };
+      };
+    };
     openssh = {
       enable = true;
       settings.PermitRootLogin = "yes";
     };
-    proxmox-ve.enable = true;
+    proxmox-ve = {
+      enable = true;
+      ipAddress = (builtins.elemAt config.networking.interfaces.br0.ipv4.addresses 0).address;
+    };
   };
 
   system.stateVersion = lib.mkForce "24.05";
 
+  systemd.services.gitlab-runner = {
+    after = [ "network-online.target" ];
+    requires = [ "network-online.target" ];
+  };
+
   users = {
     users = {
       greg = {
@@ -104,13 +175,17 @@
     };
   };
 
-  virtualisation.libvirtd = {
-    enable = true;
-    allowedBridges = [
-      "br0"
-      "virbr0"
-    ];
-    onBoot = "ignore"; # only restart VMs labeled 'autostart'
-    qemu.ovmf.enable = true;
+  virtualisation = {
+    podman.enable = true;
+    libvirtd = {
+      enable = true;
+      allowedBridges = [
+        "br0"
+        "virbr0"
+      ];
+      onBoot = "ignore"; # only restart VMs labeled 'autostart'
+      qemu.ovmf.enable = true;
+    };
+    oci-containers.backend = "podman";
   };
 }
diff --git a/hosts/isaiah/git.nix b/hosts/isaiah/git.nix
deleted file mode 100644
index 4f0771b..0000000
--- a/hosts/isaiah/git.nix
+++ /dev/null
@@ -1,106 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-let
-  gitlabStateDir = "/var/lib/gitlab";
-in
-{
-  networking = {
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [ 80 ];
-    };
-    nat = {
-      enable = true;
-      internalInterfaces = [ "ve-+" ];
-      externalInterface = "br0";
-    };
-  };
-
-  greg.proxies."git.thehellings.lan" = {
-    target = "http://192.168.200.2";
-    extraConfig = ''
-      proxy_set_header X-Forwarded-Proto https;
-      proxy_set_header X-Forwarded-Ssl on;
-    '';
-  };
-
-  system.activationScripts.makeGitlabDir = lib.stringAfter [
-    "var"
-  ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
-
-  greg.containers.gitlab = {
-    tailscale = true;
-    subnet = "200";
-    builder = (import ./container-git.nix);
-  };
-
-  #####################################################################################
-  #################### Local Podman/Docker Runner #####################################
-  #####################################################################################
-  age.secrets.runner-reg.file = ../../secrets/gitlab/isaiah-podman-runner-reg.age;
-  age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
-  age.secrets.runner-qemu.file = ../../secrets/gitlab/isaiah-qemu-runner-reg.age;
-  systemd.services.gitlab-runner = {
-    after = [ "network-online.target" ];
-    requires = [ "network-online.target" ];
-  };
-  services.gitlab-runner = {
-    enable = true;
-    settings = {
-      concurrent = 5;
-    };
-    services = {
-      default = {
-        executor = "docker";
-        authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
-        dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
-        dockerAllowedImages = [
-          "alpine:*"
-          "debian:*"
-          "docker:*"
-          "fedora:*"
-          "python:*"
-          "ubuntu:*"
-          "registry.gitlab.com/gitlab-org/*"
-          "registry.thehellings.com/*/*/*:*"
-          "gitlab.shire-zebra.ts.net:5000/*/*/*:*"
-        ];
-        dockerAllowedServices = [
-          "docker:*"
-          "registry.thehellings.com/*/*/*:*"
-          "gitlab.shire-zebra.ts.net:5000/*/*/*:*"
-        ];
-        dockerPrivileged = true;
-        dockerVolumes = [
-          "/certs/client"
-          "/cache"
-        ];
-      };
-      qemu = {
-        executor = "shell";
-        limit = 5;
-        authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
-        environmentVariables = {
-          EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-          STORAGE_URL = "s3.thehellings.lan:9000";
-        };
-      };
-    };
-  };
-  virtualisation = {
-    podman.enable = true;
-    oci-containers.backend = "podman";
-  };
-  environment.systemPackages = with pkgs; [
-    curl
-    gawk
-    git
-    unzip
-    wget
-  ];
-}