From ffd2dd78bc6343ed66a460db760c55e08601b463 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 21 May 2025 22:25:11 -0500 Subject: [PATCH] Rework how gitlab-runners are defined --- hosts/jude/virt.nix | 61 ++++++++++++++++----- modules/nixos/vmdev.nix | 28 ---------- secrets/gitlab/isaiah-qemu-runner-reg.age | 40 -------------- secrets/gitlab/isaiah-shell-runner-reg.age | Bin 2388 -> 0 bytes secrets/gitlab/isaiah-vbox-runner-reg.age | 44 --------------- secrets/gitlab/nixos-vbox-shell.age | Bin 0 -> 2466 bytes 6 files changed, 46 insertions(+), 127 deletions(-) delete mode 100644 secrets/gitlab/isaiah-qemu-runner-reg.age delete mode 100644 secrets/gitlab/isaiah-shell-runner-reg.age delete mode 100644 secrets/gitlab/isaiah-vbox-runner-reg.age create mode 100644 secrets/gitlab/nixos-vbox-shell.age diff --git a/hosts/jude/virt.nix b/hosts/jude/virt.nix index 0b94f07..23a993a 100644 --- a/hosts/jude/virt.nix +++ b/hosts/jude/virt.nix @@ -14,9 +14,48 @@ let ]; in { - greg.vmdev.enable = true; + specialisation = { + vbox.configuration = { - age.secrets.runner-reg.file = ../../secrets/gitlab/isaiah-vbox-runner-reg.age; + greg = { + podman.enable = lib.mkForce false; + vmdev.enable = lib.mkForce false; + }; + + users.extraGroups.vboxusers.members = [ "greg" ]; + + virtualisation = { + virtualbox.host = { + enable = true; + enableExtensionPack = true; + }; + }; + + services.gitlab-runner.services = lib.mkForce { + vbox = { + authenticationTokenConfigFile = config.age.secrets.vbox.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + }; + executor = "shell"; + limit = 5; + }; + }; + + systemd.services.gitlab-runner = { + serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + User = "root"; + DynamicUser = lib.mkForce false; + }; + }; + }; + }; + + age.secrets = { + qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age; + vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age; + }; # These options enable sharing of the GPU with the VM boot = { @@ -39,15 +78,18 @@ in ("vfio-pci.ids=" + (lib.concatStringsSep "," passthru)) ]; }; + + greg.vmdev.enable = true; + hardware.graphics.enable = true; services.gitlab-runner = { enable = true; settings.concurrent = 5; - services.vbox = { + services.qemu = { executor = "shell"; limit = 5; - authenticationTokenConfigFile = config.age.secrets.runner-reg.path; + authenticationTokenConfigFile = config.age.secrets.qemu.path; environmentVariables = { EFI_DIR = "${pkgs.OVMF.fd}/FV/"; }; @@ -55,17 +97,6 @@ in }; systemd.services = { - gitlab-runner = { - conflicts = [ "libvirtd.service" ]; - preStart = builtins.concatStringsSep "\n" [ - "${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv" - "${pkgs.kmod}/bin/modprobe vboxnetadp" - ]; - postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv"; - wantedBy = pkgs.lib.mkForce [ ]; - serviceConfig.User = "root"; - }; - "libvirt-nosleep@" = { description = "Prevent sleep while %i is running"; serviceConfig = { diff --git a/modules/nixos/vmdev.nix b/modules/nixos/vmdev.nix index b3e405c..66be451 100644 --- a/modules/nixos/vmdev.nix +++ b/modules/nixos/vmdev.nix @@ -58,36 +58,8 @@ with lib; }; }; }; - - virtualbox.host = { - enable = true; - enableExtensionPack = true; - }; }; - # Configuration for vbox user performance - users.extraGroups.vboxusers.members = [ cfg.user ]; - boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1"; - - # Configure the services more - systemd.services = { - libvirtd = { - preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}"; - postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm"; - conflicts = [ "vbox.service" ]; - #overrideStrategy = "asDropin"; - }; - vbox = { - preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt"; - postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv"; - script = "echo Started"; - conflicts = [ "libvirtd.service" ]; - unitConfig = { - Type = "oneshot"; - RemainAfterExit = "yes"; - }; - }; - }; }; } diff --git a/secrets/gitlab/isaiah-qemu-runner-reg.age b/secrets/gitlab/isaiah-qemu-runner-reg.age deleted file mode 100644 index 86f5a53..0000000 --- a/secrets/gitlab/isaiah-qemu-runner-reg.age +++ /dev/null @@ -1,40 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 64uajw Owu2iq5FOcCnfmc7WkPZjpje4+l/Y9JpadTmc8ChxW4 -kpN4BikG6+7GCSplNVFDrQtc0hKpVf7MGeLBdEtxvY4 --> ssh-ed25519 oyEmTw e0Irdtmkgx3pHkJKZ0M2wzfVmE+b/tsQ+a1mZTtW8XM -sjJNMwLtamfVYpM5nxvcTVverm41U3xpwTYQ63Q/N84 --> ssh-ed25519 mOmPfg On+SiDGuqOceWJOF8XZNWVHlseoJ7SWmrv2L7NXsjXQ -83KaBly8y4n8L9vclbojrKMTI71uuyvYgey0b9cxy4g --> ssh-ed25519 YJiRbw vdtkHgNYQsmiSqEQMAstt1mUIDQV8ZYd/zm6BJYpFGo -zFXmTVzZbPJTdM/hRPVXaIj0JSl9OuWY3Rb91/y0dBc --> ssh-ed25519 aY2AXA 9wbue2xbS4RCxt9Qv75oPDxc4ccCPdSnlRG758OGW0k -/5vK7IO8KafpczgAqtPx2wppxa6moy1/Lvnfxn5H02s --> ssh-ed25519 xNtnoA aVFWpqxsXmmzd8qGM2ZKM8PjYutfaYm/ZRgjMeCR9j8 -+xBg6M9RnnlsA1Ahb4gZOywOnWr+3bs3bRTYFVIKr38 --> ssh-ed25519 AQhf1g 7uTLGKz6PRaEypfKxVhHladHaTOxXzLDCwSaguVpEU0 -ruCZuzyZB2MzO8On2JYae3jycom0sTDoY8Bkh4ruQyo --> ssh-ed25519 B8wa7Q gxEB1ehbBnd4hcHWhSXKzXUfC8Nvkhis3c8FXtbfaQA -jHfJtyqB2kt0GqaRPtLc3gIcjh/YGhfgvGzXw3rm9DA --> ssh-ed25519 8UnW5Q wJF80kCk+LgGpYPTreA3iTwY/QrhR/rLagNyWKerGzw -eZnYt6N7Trr3J1WGB0Nv3zHJTnML+n+iNkvzdL3jm4w --> ssh-ed25519 0/WsKg bcN7gFP1Vm0MpWWuPW795gD8Q1E3xLr1CMycggtSqRA -6m1NXOBG/Wyz21hCRrj/VbfmhX7QzI8ekAQ+XXnyy38 --> ssh-ed25519 Nl/5yA PoO47KPvS1RXL3QA7PjQDdxL/Z5oYTPivx/gMBXOBWE -yTw7f+qbRyerQQ7JR6DqgkfKDTajkanhMlEmQIV0kCI --> ssh-ed25519 GdLgCQ gI8fo4YpyT/qIEZPn3XIa4R+38ICcTIG1BdTMP+iUH8 -RbU4uOP6RMQZ+DRKrEcZN+GwjLzjq+2pUdk9xm3Xlr4 --> ssh-ed25519 tOH/HQ mIrauZ8OfOElsomdivvcdgpsSSDPPjrlJ/YQmnf5g18 -Mq/vcFQ2mGIPVB0uZS/qtO13WMTcs4CLRwl4YWrreJg --> ssh-ed25519 FpzvfQ lC5aVnyJYH6t/PDDnQQNRqwOX4shQS3Ys1aOWfQ8sw4 -xgdHax+M3voH8OquVY0SqmSoODJCCVrWZJL1bPFlsp4 --> ssh-ed25519 kdPvzQ kHJVlbRYWqubO9xDybSQ1awWZW/OZRp76z/Hmny5dQY -B1n6XLWZ2KBfzN0qniNBMKdZM40fjDogKkpHfEEQnW4 --> ssh-ed25519 onmXpg fHjrAjDy5Ce/hg1WNJc7IWEk8IxYXdR6h2asJ+1Uajs -VxVISuHeVJ6NKTmGLNY7AbyGgdOVPIZoWkGNH8C7xJ0 --> ssh-ed25519 CnhD0g +JqkpM0pFRZiaNP49Y8IPDo9w5KqahsqJYugsYmIe3Y -M44lsxcLqBh6AW/sf8zMcOg2euOqOytmOTtFtfMFHHc --> ssh-ed25519 4ep2UA QvvgFgNihOAnItEV5W/MWkPOjrFALbTrQQf6PMO3CWw -rLJIh6PomyyT/nJXdi2WRIpzZymNqWQ4QuHp2olJI0M ---- m9Xw9hvo+ZLlW8pe2/YdH5rqL0cUFPcTicrExwC7DGQ -6`@{Xh œ10= RLw]hx6\1Ҩ)Լyoig)nY - gc:#q(_6I|,魞HB>)KB5ԋL札ylUekvZ )=BN̨wǬ0y[Ճ*'WꗯmGg -BUYkِ#R!] "gt^N q+Padw$0%*wi(T0 ?^$SBx7¢ u0JBFX'@dj6PxPnqma51 \ No newline at end of file diff --git a/secrets/gitlab/isaiah-shell-runner-reg.age b/secrets/gitlab/isaiah-shell-runner-reg.age deleted file mode 100644 index 1bcaafa9e7d8e834f6196358a5349503452adc58..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2388 zcmZXVYwYWE9mb8}z{!Ycym3jCC5RyN(93!ig7&hmTen`ec5SBydvDjRm$hrVMg4n8 zOw7>$#selsAiVI17(zrt6r-3B!6kS`%uhB;-_>6AVKq(hllWIMJgr<_vA-Fq+tP z+v|XR6-Wyj$SFldq@K;KA%ipwZdh1w18)=}W^I9iw7SJDWeLLHj# zk~s+3syZv8U{R3#a?tR)a#)*X!jwU^JN%$PTyn%kz7hls3kP zWmU1<$eJxkXyWw_YonCVhl2Ksoe$M1v)g$(77M8 z%Pa*4hqVz}qN7SX(<=eP@(xMC-LWB)u})ZZgHJNLuOmFII^Lv`wDE}Hh}PB>EXwGH z?26}wu$SuuxT6*ZDgGB`nbSUob7AXc;LBR+B~dH zTmtBpY8z?9FjFwamii<2q>S z%cEhWRb*&;0~0U%lGRIxk#mFD&;mx3S)LCWqZ$!5%{xv^F#wp;NLmTIakbn~hiRq61N?qV zI!ZMSr*WPOMJFRol4NL%rLw$KVXZ;z{$SE04QrM+gVtc&MMo1P6>-KlFuH>%J%wh* zW;T)b>&XKS$Vr0gFbSR>rg7P>@|E@wM#Dax`eeAnV?GnPnlPN1!1*4>F{C>PM5&vH zS+;88{pC`N5MyV~P{bqNca_z~2ectSn+Yr;p}p~jhJP%_oRSvP3k5-y4f)!6H@oI zrIYq{M73wsvLNhg*~BHUX{?bl#vBcRhkWI3=F*bxfrp)Bl8^=W35YYnQVoDtrLhGz zRE;A+7*8q;@c1!GM7APzasenpU2AO$Ys+;j16gMpuc3`jXas1Na>^+s)Fr*XF^js% zN{xBqFb(lCSfkphhXqg$aTE9!h=4jtP64I5pSqcUKOR>(7UJ#i9ww%;KE#2ho z1XAUdQ!`1a@xf$Y0YJWkBWR5Q#fqeEO*Hi{E|k_;Y`{{My&AKl=Vh zpR!M$MRh-AAJn(}YbeDUgAo_OTQzup+V za{By}zj^I`{Y@8L^_~k}HKhlOlkfWGrC)gIYhQkE6ELT3{l7N>v+Hkc!sw-^pLp!4 zxBTPHSN!{Z<#pI45P9Ucw|=_nfb=Q1#4DulyTv^8=i5#RKYX=Ot%-`a9_v%%KI;T`Hs)r{bYXKW8YpJzxS@QpStVpf8KrZ nlY_qxzkdgL>hV8+0T diff --git a/secrets/gitlab/isaiah-vbox-runner-reg.age b/secrets/gitlab/isaiah-vbox-runner-reg.age deleted file mode 100644 index 186fe99..0000000 --- a/secrets/gitlab/isaiah-vbox-runner-reg.age +++ /dev/null @@ -1,44 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 64uajw zaw1VrAOKf7WH+2V4MPaJ2NGfdRq2TPYV5LW10niQwI -yt3kmG5Pi13ALMjusVxuydh/j6xMLNJP5hLp/ePKxcs --> ssh-ed25519 oyEmTw a9q3TpbESuMSh2ut7D/JfgA4KV0e8c6/JQySA1uh3Wk -haasKx1ZqqMf4tP1upDtgw7LOIw7J1D699Dl75LQ8IQ --> ssh-ed25519 mOmPfg YDmQILepyMgtgVzriyRWks2QZpvt8zCsAhlrZI1Fl0o -scnIfvhOAVAHh31EIBqmFBNbqXleJ2pcFPuMjDEnZ/w --> ssh-ed25519 YJiRbw O6Ar5fSR+6OTZ/MMACKg+SOIRV4NtmMJ3MPexY/fAHs -sBGDGkW5vfZcyQ/Hv/5xdAlOz1hYGRWMcO7tgDrNlG4 --> ssh-ed25519 aY2AXA oE4aRUnvlKUkrXkLxqdlmSeTblfk9uTWGzoMU/D22EE -XaRuO3ORNgb0LRZKzRj0sMpJDFzyzhDIuXBYs/OxxWw --> ssh-ed25519 xNtnoA TLM/kPHULyiUEymgksLHLVhhCT5rIMRc9etjkINaE0c -JdDX25lXPXStWwoSWp1/WmgMeb3SDI8Z/OyiGyVF6mI --> ssh-ed25519 AQhf1g pNMD0U938a14qqiMUFxTw8073SNF25IDJfjXGm7q9Ss -Yuf5Z6AoHW9uj5hOWSc5eirqP+xH9wbuwknqh2JW4K0 --> ssh-ed25519 B8wa7Q KXIt7sQKcZpSnKbs30fT5ybgBwFghhmM/Ov8OjQsfxE -BtZysD+2DVUcivWXnJdlW4Y2pLCoXLF7jP4IGj12Xo8 --> ssh-ed25519 8UnW5Q nLn5gfsYNAxDl8GatHyEyQMhpy+A5XvykowBYlVbPQ8 -w+XlgXrE0KcfDWZC+ya0tnyDXshDw582B803CItqLFc --> ssh-ed25519 0/WsKg TbGuq0eETh1mVmsqtqkvhCiXAliz5WS7iqQ+OY01nXY -GTXIQZf44Sjg4mVxQtD7+VOSx1eAOIr0gBxhAjMXK5U --> ssh-ed25519 Nl/5yA fjC2SY379C5o9jBUetLXQApy00YVEa4A7Jr61yoCI0U -/350ThLM1JCvg1E8kJib2ESP9nXRUI5QqTTun0QQtO4 --> ssh-ed25519 GdLgCQ H7g+SuknwgOy8PDEwK8UqrNG82ZoLisCSSFTxaNS1EU -JVd1nDmgTSZ6oLdnp29Qlor39RHZN1q+hPEJl1RSw5s --> ssh-ed25519 tOH/HQ PFuIUIqN8K9GoLsLOIdRHaFj5KclCuwGoRSoyH9WRHQ -fkQNV36OpzgiufqmTyJYHsNlfa6THDrDzvVyaVVrtzI --> ssh-ed25519 FpzvfQ +HL0H1U9HYiMuyVjd9hosnTntjV3Bf8N/KhdfbZSgV4 -rd7CNDUSU5GYRVfuPy8aEVNdWAv1DektrVb+JES5vTk --> ssh-ed25519 kdPvzQ EsizsHpgHDbBWwDnRgPmSMy2Cmpvqpjd2wriSiW+xxg -tGd9x8NQMMLaqYDFKWWfJvvdPyTS63OZOZGWqvfj1+I --> ssh-ed25519 onmXpg u4zMl21Un8YqsRaH4STYGbI53K364RJ9fMDCKmUcbCY -XHtAV9Z9jpPPVYGOPq7/jS0ZiTy4E9As2Dv4fAJUSVM --> ssh-ed25519 CnhD0g 4VejzPLVJcGXdLQBY6/Fb4PKtrzvRpMltKBMjMM4UFk -4IwAQAJxOZA3EYa816SbQeM61y2yV23fIDPe7w2wGUw --> ssh-ed25519 4ep2UA PTIWvjuv8m66h8E6+QZJKxEmZ4RyoI4qwiMMrYhVDS4 -/28djh64HqyGhdOKzwFEseIH8BYGljkcQScV6rBx/Yk ---- UINMhgQK2hWVetzQg4cNYxksN4G+pOKGqvZ+Jl4Zl/k -]M>;I9oZ~/P*T5s58 WK -g -7<&ˎvLkQ=-0aRIEk}lxAJ}J` -/TlPv\S|tAHѺG{P@:3%Hmc?d$J.C3LzZ qzNEՇ¸ -ȹev7A o>eusu9ro~XyVU^6-ʟ2J ,&F^an}3ebsy_^2&{r =qa$UUVSQTH=N6;H zAPPcq7$nFUBOr$;8u1W+AS4J#{!w~T#8 zu!zbqS*?Tp>&ODLW^LcWdK}yPjAaW!ns^~Hl1TBjr#tA$f z6iX9UDH$cAhzK@lXHhF4&KNBhF`$_;idSjFB9w}E6$got&8j1gE7b1CRS(hK?X-1C z`Ep*@Tj)^tL3Y9peH2426=En^wKSts4B?MmF9Ih!hSpCi-e4l}b8M*op&8 z)aBDD$%itzsCDN_CX}6)zK(-*)m5|309>i^z%oms$*o}+rHeQ;n-HXIr_F{dQP1m| zLs$SFDKa*YqXFX2q=*xfDrN&%8V|w(uJB=@dD*bFuE|4wir4{^!r3grT~QW?sUoYG zD=%D6qgcs_#W~sZRHLz-HlMW!m8erTuOXolQY4Faz<#@%%@b-lnQ&ct8mNvgLm6VK zgl}4j~2vs8X?$b)2dhcM2u3iIgPLqSSe1@HlQZx2C<}s-O$1@w@4s7B>7&W z=JYeGnVS$AD6QFA={86Ss?dxu+VEhov6pySsiCHkaTDH7>tOl3E!1I}8MJ47K5f%* zqr1>o*@R4(abx5blAw>;$f!b+c0)BAvsyn4MnJ040|c;DzpWZwdl}6_X-*)+d;@0r zJRCR`NP#xBorWpF6cOrtj`M||O`Two8+PKYr`BrIb%;O+xNfNcShp=$5NwbHU8A}i z90hS~K6T=Ppc_df$9*C7Wzux!fF=@jr=%2q0nn%QtpQGB#;WHndE{EsWB~ihQuhcG zhL)yo$h~lkHL}j8gSjn{E@p+$s8PDma1$45uc{slM*zF#IKuBVQV1xdR_K(Lx9rej zQ(T{>ke2g6aVUK&Z=8X1*FA3fpq9w1>}in;{sVs;Uxip?(s#d3)J6J&NfnHCbY|8pgMaHD7L6 zS^|0wM(2fHDYMK6ovGzb)+*SMBlWbt^};GMg?b8&1rC~yS3EB{&6Q+#?5v_DGk=pC zIt8FBw^cGsoH?>k>m;cNwQQ4#rx{Ahsi_NXwWBOG&2h7;o0eJ%dw4M6@Y9ydUGiBa z)H8Y5Y9ap0=tRt9CKhFZw%dn-t8RM}Sl3K*)4icmPY}0)skBY$K8>z7 z1-B48&2q35#aT3*VcTzmjj*K<^{od5&e&p%VRnx${c>XfEsCRQf1a1N+;>+#fEQUR zbs@NxHzgKcAR(M*x#QIGeDtm>jvV~t;o9dv^6jrZ@Q=4{yzDa%CVMXU^O0vC zdHj~A9{BrrPQ2kM`;Y(ll52PVdgqmB-abY=mtFK1aM!m!cE*MGed6fBJ-g)-H@|XK z?aak@cbZRM_83^o-Hn z%YXjrtP}rw|Nh|q-A7(H=aoOc`SxqY?w5Ph4{!L{)rZ*~vj@NQLXw}4-^3~NC(9=e zUxe&?_TFo6J9*g%6_KKjfD c4=bxnkKcXHzpJzEIdAd9n38{g&7K4Q2Q=YOtpET3 literal 0 HcmV?d00001