Remove Git from Isaiah

Remove the Gitlab container from Isaiah
Remove references to the builder in a container on Isaiah
Combine configuration into a single file

hosts/isaiah/default.nix

@@ -1,4 +1,5 @@
 {
+  config,
   lib,
   pkgs,
   top,
@@ -7,10 +8,15 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ./git.nix
     top.proxmox.nixosModules.proxmox-ve
   ];
 
+  age.secrets = {
+    runner-reg.file = ../../secrets/gitlab/isaiah-podman-runner-reg.age;
+    docker-auth.file = ../../secrets/gitlab/docker-auth.age;
+    runner-qemu.file = ../../secrets/gitlab/isaiah-qemu-runner-reg.age;
+  };
+
   boot = {
     binfmt.emulatedSystems = [ "aarch64-linux" ];
     extraModprobeConfig = "options kvm_amd nested=1";
@@ -33,6 +39,11 @@
   };
 
   environment.systemPackages = with pkgs; [
+    curl
+    gawk
+    git
+    unzip
+    wget
     zstd
   ];
 
@@ -50,8 +61,6 @@
   };
 
   networking = {
-    hostName = "isaiah";
-    useDHCP = false;
     bridges.br0 = {
       interfaces = [ "enp38s0" ];
     };
@@ -59,6 +68,12 @@
       address = " 10.42.1.1";
       interface = "br0";
     };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 ];
+      checkReversePath = lib.mkForce false;
+    };
+    hostName = "isaiah";
     interfaces = {
       br0 = {
         ipv4.addresses = [
@@ -70,7 +85,12 @@
       };
     };
     nameservers = [ "10.42.1.5" ];
-    firewall.checkReversePath = lib.mkForce false;
+    nat = {
+      enable = true;
+      internalInterfaces = [ "ve-+" ];
+      externalInterface = "br0";
+    };
+    useDHCP = false;
   };
 
   nixpkgs = {
@@ -81,15 +101,66 @@
   };
 
   services = {
+    gitlab-runner = {
+      enable = true;
+      settings = {
+        concurrent = 5;
+      };
+      services = {
+        default = {
+          executor = "docker";
+          authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
+          dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
+          dockerAllowedImages = [
+            "alpine:*"
+            "debian:*"
+            "docker:*"
+            "fedora:*"
+            "python:*"
+            "ubuntu:*"
+            "registry.gitlab.com/gitlab-org/*"
+            "registry.thehellings.com/*/*/*:*"
+            "gitlab.shire-zebra.ts.net:5000/*/*/*:*"
+          ];
+          dockerAllowedServices = [
+            "docker:*"
+            "registry.thehellings.com/*/*/*:*"
+            "gitlab.shire-zebra.ts.net:5000/*/*/*:*"
+          ];
+          dockerPrivileged = true;
+          dockerVolumes = [
+            "/certs/client"
+            "/cache"
+          ];
+        };
+        # qemu = {
+        #   executor = "shell";
+        #   limit = 5;
+        #   authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
+        #   environmentVariables = {
+        #     EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+        #     STORAGE_URL = "s3.thehellings.lan:9000";
+        #   };
+        # };
+      };
+    };
     openssh = {
       enable = true;
       settings.PermitRootLogin = "yes";
     };
-    proxmox-ve.enable = true;
+    proxmox-ve = {
+      enable = true;
+      ipAddress = (builtins.elemAt config.networking.interfaces.br0.ipv4.addresses 0).address;
+    };
   };
 
   system.stateVersion = lib.mkForce "24.05";
 
+  systemd.services.gitlab-runner = {
+    after = [ "network-online.target" ];
+    requires = [ "network-online.target" ];
+  };
+
   users = {
     users = {
       greg = {
@@ -104,13 +175,17 @@
     };
   };
 
-  virtualisation.libvirtd = {
-    enable = true;
-    allowedBridges = [
-      "br0"
-      "virbr0"
-    ];
-    onBoot = "ignore"; # only restart VMs labeled 'autostart'
-    qemu.ovmf.enable = true;
+  virtualisation = {
+    podman.enable = true;
+    libvirtd = {
+      enable = true;
+      allowedBridges = [
+        "br0"
+        "virbr0"
+      ];
+      onBoot = "ignore"; # only restart VMs labeled 'autostart'
+      qemu.ovmf.enable = true;
+    };
+    oci-containers.backend = "podman";
   };
 }