Rework how gitlab-runners are defined

hosts/jude/virt.nix

@@ -14,9 +14,48 @@ let
   ];
 in
 {
-  greg.vmdev.enable = true;
+  specialisation = {
+    vbox.configuration = {
 
-  age.secrets.runner-reg.file = ../../secrets/gitlab/isaiah-vbox-runner-reg.age;
+      greg = {
+        podman.enable = lib.mkForce false;
+        vmdev.enable = lib.mkForce false;
+      };
+
+      users.extraGroups.vboxusers.members = [ "greg" ];
+
+      virtualisation = {
+        virtualbox.host = {
+          enable = true;
+          enableExtensionPack = true;
+        };
+      };
+
+      services.gitlab-runner.services = lib.mkForce {
+        vbox = {
+          authenticationTokenConfigFile = config.age.secrets.vbox.path;
+          environmentVariables = {
+            EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+          };
+          executor = "shell";
+          limit = 5;
+        };
+      };
+
+      systemd.services.gitlab-runner = {
+        serviceConfig = {
+          DevicePolicy = lib.mkForce "auto";
+          User = "root";
+          DynamicUser = lib.mkForce false;
+        };
+      };
+    };
+  };
+
+  age.secrets = {
+    qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age;
+    vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age;
+  };
 
   # These options enable sharing of the GPU with the VM
   boot = {
@@ -39,15 +78,18 @@ in
       ("vfio-pci.ids=" + (lib.concatStringsSep "," passthru))
     ];
   };
+
+  greg.vmdev.enable = true;
+
   hardware.graphics.enable = true;
 
   services.gitlab-runner = {
     enable = true;
     settings.concurrent = 5;
-    services.vbox = {
+    services.qemu = {
       executor = "shell";
       limit = 5;
-      authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
+      authenticationTokenConfigFile = config.age.secrets.qemu.path;
       environmentVariables = {
         EFI_DIR = "${pkgs.OVMF.fd}/FV/";
       };
@@ -55,17 +97,6 @@ in
   };
 
   systemd.services = {
-    gitlab-runner = {
-      conflicts = [ "libvirtd.service" ];
-      preStart = builtins.concatStringsSep "\n" [
-        "${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv"
-        "${pkgs.kmod}/bin/modprobe vboxnetadp"
-      ];
-      postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv";
-      wantedBy = pkgs.lib.mkForce [ ];
-      serviceConfig.User = "root";
-    };
-
     "libvirt-nosleep@" = {
       description = "Prevent sleep while %i is running";
       serviceConfig = {

modules/nixos/vmdev.nix

@@ -58,36 +58,8 @@ with lib;
           };
         };
       };
-
-      virtualbox.host = {
-        enable = true;
-        enableExtensionPack = true;
-      };
     };
 
-    # Configuration for vbox user performance
-    users.extraGroups.vboxusers.members = [ cfg.user ];
-
     boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
-
-    # Configure the services more
-    systemd.services = {
-      libvirtd = {
-        preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}";
-        postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm";
-        conflicts = [ "vbox.service" ];
-        #overrideStrategy = "asDropin";
-      };
-      vbox = {
-        preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt";
-        postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
-        script = "echo Started";
-        conflicts = [ "libvirtd.service" ];
-        unitConfig = {
-          Type = "oneshot";
-          RemainAfterExit = "yes";
-        };
-      };
-    };
   };
 }

secrets/gitlab/isaiah-qemu-runner-reg.age

@@ -1,40 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 64uajw Owu2iq5FOcCnfmc7WkPZjpje4+l/Y9JpadTmc8ChxW4
-kpN4BikG6+7GCSplNVFDrQtc0hKpVf7MGeLBdEtxvY4
--> ssh-ed25519 oyEmTw e0Irdtmkgx3pHkJKZ0M2wzfVmE+b/tsQ+a1mZTtW8XM
-sjJNMwLtamfVYpM5nxvcTVverm41U3xpwTYQ63Q/N84
--> ssh-ed25519 mOmPfg On+SiDGuqOceWJOF8XZNWVHlseoJ7SWmrv2L7NXsjXQ
-83KaBly8y4n8L9vclbojrKMTI71uuyvYgey0b9cxy4g
--> ssh-ed25519 YJiRbw vdtkHgNYQsmiSqEQMAstt1mUIDQV8ZYd/zm6BJYpFGo
-zFXmTVzZbPJTdM/hRPVXaIj0JSl9OuWY3Rb91/y0dBc
--> ssh-ed25519 aY2AXA 9wbue2xbS4RCxt9Qv75oPDxc4ccCPdSnlRG758OGW0k
-/5vK7IO8KafpczgAqtPx2wppxa6moy1/Lvnfxn5H02s
--> ssh-ed25519 xNtnoA aVFWpqxsXmmzd8qGM2ZKM8PjYutfaYm/ZRgjMeCR9j8
-+xBg6M9RnnlsA1Ahb4gZOywOnWr+3bs3bRTYFVIKr38
--> ssh-ed25519 AQhf1g 7uTLGKz6PRaEypfKxVhHladHaTOxXzLDCwSaguVpEU0
-ruCZuzyZB2MzO8On2JYae3jycom0sTDoY8Bkh4ruQyo
--> ssh-ed25519 B8wa7Q gxEB1ehbBnd4hcHWhSXKzXUfC8Nvkhis3c8FXtbfaQA
-jHfJtyqB2kt0GqaRPtLc3gIcjh/YGhfgvGzXw3rm9DA
--> ssh-ed25519 8UnW5Q wJF80kCk+LgGpYPTreA3iTwY/QrhR/rLagNyWKerGzw
-eZnYt6N7Trr3J1WGB0Nv3zHJTnML+n+iNkvzdL3jm4w
--> ssh-ed25519 0/WsKg bcN7gFP1Vm0MpWWuPW795gD8Q1E3xLr1CMycggtSqRA
-6m1NXOBG/Wyz21hCRrj/VbfmhX7QzI8ekAQ+XXnyy38
--> ssh-ed25519 Nl/5yA PoO47KPvS1RXL3QA7PjQDdxL/Z5oYTPivx/gMBXOBWE
-yTw7f+qbRyerQQ7JR6DqgkfKDTajkanhMlEmQIV0kCI
--> ssh-ed25519 GdLgCQ gI8fo4YpyT/qIEZPn3XIa4R+38ICcTIG1BdTMP+iUH8
-RbU4uOP6RMQZ+DRKrEcZN+GwjLzjq+2pUdk9xm3Xlr4
--> ssh-ed25519 tOH/HQ mIrauZ8OfOElsomdivvcdgpsSSDPPjrlJ/YQmnf5g18
-Mq/vcFQ2mGIPVB0uZS/qtO13WMTcs4CLRwl4YWrreJg
--> ssh-ed25519 FpzvfQ lC5aVnyJYH6t/PDDnQQNRqwOX4shQS3Ys1aOWfQ8sw4
-xgdHax+M3voH8OquVY0SqmSoODJCCVrWZJL1bPFlsp4
--> ssh-ed25519 kdPvzQ kHJVlbRYWqubO9xDybSQ1awWZW/OZRp76z/Hmny5dQY
-B1n6XLWZ2KBfzN0qniNBMKdZM40fjDogKkpHfEEQnW4
--> ssh-ed25519 onmXpg fHjrAjDy5Ce/hg1WNJc7IWEk8IxYXdR6h2asJ+1Uajs
-VxVISuHeVJ6NKTmGLNY7AbyGgdOVPIZoWkGNH8C7xJ0
--> ssh-ed25519 CnhD0g +JqkpM0pFRZiaNP49Y8IPDo9w5KqahsqJYugsYmIe3Y
-M44lsxcLqBh6AW/sf8zMcOg2euOqOytmOTtFtfMFHHc
--> ssh-ed25519 4ep2UA QvvgFgNihOAnItEV5W/MWkPOjrFALbTrQQf6PMO3CWw
-rLJIh6PomyyT/nJXdi2WRIpzZymNqWQ4QuHp2olJI0M
---- m9Xw9hvo+ZLlW8pe2/YdH5rqL0cUFPcTicrExwC7DGQ
-¯…ÀÜ6è²`ç@{XhçÅ ®Âœ10à–�¶=	½éý÷ìëËÏÏR’�LÜÿòw]�Ðûhxõþã£ú6¾’ÐéûÉÛ\íÑ÷ƒ1Ò¨)Ô¼yo­¥ƒi¤úžgê)nÛY␍-÷Ž‰­ågàëý„¬ˆcˆŽ�:#�ìqÀ¬(‰_‘6²I|,§éºôé­žHB>Êö˜á)K¿B5²Ô‹L¯æœ­³yâ†ÖÑlUêekvZ␍Ç)•‚¼
Ô=Bƒ”N¼”þ̨wØǬ“0y[ëÖÝÕƒãð*�òí‘ð'W”éê—¯‡mG¢úgè ‰Í
-¹±ÌBU¼¹¥âYkÙ�¦ó™#…R!]µ	š"gt^N¦Ÿúþq€ƒ+šPadÁwÿÞ$0Ž³Ä%*wi(T0ªÈ?^ì�ß÷Ÿ$S‡¦˜Bx7¢u­¬ç�ÙÙêýä�0ÊÉJBFãX'”@dj6<eo™éÒ&´œú°®”¬-`™ŸöÀ^}» ¹Ä.ttLTÿRDZGË&Øè|Î*óS¶U¬\DÉÑÝaL¦U¾Ü¯í",ûÛTÒ·Ì°-¢=èç-•8ŸVL.o(>·‚¬äÙÌPx¯åPnqmaö51

secrets/gitlab/isaiah-vbox-runner-reg.age

@@ -1,44 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 64uajw zaw1VrAOKf7WH+2V4MPaJ2NGfdRq2TPYV5LW10niQwI
-yt3kmG5Pi13ALMjusVxuydh/j6xMLNJP5hLp/ePKxcs
--> ssh-ed25519 oyEmTw a9q3TpbESuMSh2ut7D/JfgA4KV0e8c6/JQySA1uh3Wk
-haasKx1ZqqMf4tP1upDtgw7LOIw7J1D699Dl75LQ8IQ
--> ssh-ed25519 mOmPfg YDmQILepyMgtgVzriyRWks2QZpvt8zCsAhlrZI1Fl0o
-scnIfvhOAVAHh31EIBqmFBNbqXleJ2pcFPuMjDEnZ/w
--> ssh-ed25519 YJiRbw O6Ar5fSR+6OTZ/MMACKg+SOIRV4NtmMJ3MPexY/fAHs
-sBGDGkW5vfZcyQ/Hv/5xdAlOz1hYGRWMcO7tgDrNlG4
--> ssh-ed25519 aY2AXA oE4aRUnvlKUkrXkLxqdlmSeTblfk9uTWGzoMU/D22EE
-XaRuO3ORNgb0LRZKzRj0sMpJDFzyzhDIuXBYs/OxxWw
--> ssh-ed25519 xNtnoA TLM/kPHULyiUEymgksLHLVhhCT5rIMRc9etjkINaE0c
-JdDX25lXPXStWwoSWp1/WmgMeb3SDI8Z/OyiGyVF6mI
--> ssh-ed25519 AQhf1g pNMD0U938a14qqiMUFxTw8073SNF25IDJfjXGm7q9Ss
-Yuf5Z6AoHW9uj5hOWSc5eirqP+xH9wbuwknqh2JW4K0
--> ssh-ed25519 B8wa7Q KXIt7sQKcZpSnKbs30fT5ybgBwFghhmM/Ov8OjQsfxE
-BtZysD+2DVUcivWXnJdlW4Y2pLCoXLF7jP4IGj12Xo8
--> ssh-ed25519 8UnW5Q nLn5gfsYNAxDl8GatHyEyQMhpy+A5XvykowBYlVbPQ8
-w+XlgXrE0KcfDWZC+ya0tnyDXshDw582B803CItqLFc
--> ssh-ed25519 0/WsKg TbGuq0eETh1mVmsqtqkvhCiXAliz5WS7iqQ+OY01nXY
-GTXIQZf44Sjg4mVxQtD7+VOSx1eAOIr0gBxhAjMXK5U
--> ssh-ed25519 Nl/5yA fjC2SY379C5o9jBUetLXQApy00YVEa4A7Jr61yoCI0U
-/350ThLM1JCvg1E8kJib2ESP9nXRUI5QqTTun0QQtO4
--> ssh-ed25519 GdLgCQ H7g+SuknwgOy8PDEwK8UqrNG82ZoLisCSSFTxaNS1EU
-JVd1nDmgTSZ6oLdnp29Qlor39RHZN1q+hPEJl1RSw5s
--> ssh-ed25519 tOH/HQ PFuIUIqN8K9GoLsLOIdRHaFj5KclCuwGoRSoyH9WRHQ
-fkQNV36OpzgiufqmTyJYHsNlfa6THDrDzvVyaVVrtzI
--> ssh-ed25519 FpzvfQ +HL0H1U9HYiMuyVjd9hosnTntjV3Bf8N/KhdfbZSgV4
-rd7CNDUSU5GYRVfuPy8aEVNdWAv1DektrVb+JES5vTk
--> ssh-ed25519 kdPvzQ EsizsHpgHDbBWwDnRgPmSMy2Cmpvqpjd2wriSiW+xxg
-tGd9x8NQMMLaqYDFKWWfJvvdPyTS63OZOZGWqvfj1+I
--> ssh-ed25519 onmXpg u4zMl21Un8YqsRaH4STYGbI53K364RJ9fMDCKmUcbCY
-XHtAV9Z9jpPPVYGOPq7/jS0ZiTy4E9As2Dv4fAJUSVM
--> ssh-ed25519 CnhD0g 4VejzPLVJcGXdLQBY6/Fb4PKtrzvRpMltKBMjMM4UFk
-4IwAQAJxOZA3EYa816SbQeM61y2yV23fIDPe7w2wGUw
--> ssh-ed25519 4ep2UA PTIWvjuv8m66h8E6+QZJKxEmZ4RyoI4qwiMMrYhVDS4
-/28djh64HqyGhdOKzwFEseIH8BYGljkcQScV6rBx/Yk
---- UINMhgQK2hWVetzQg4cNYxksN4G+pOKGqvZ+Jl4Zl/k
-]á·Mƒ>;¹I9oæ�Z~/P*Tîö5sñÒ58åW–ùŽ”¤K
-g
-¡Ó7™ú<ôÀ&ËŽvªöL„³kQ=-“ÿµ
³0aRôIã•Ekæ}lµ‡ýœxAJâÈ}–Jä`
Ü
-/TÄl”Pv\SõûÎì|tÿžAH„‰ÑºGÝá‘Ý{P�ü‘@:3%HmÍ×c¹?d$ö€”­µJ.C3ð‘ÖLõ©zZŒì’ÌÚ×qÀzNžEÕ‡‘¼Â¸
-ȹeü¸v7A�o…¥>euòsuÇ9êrào~ˆXyñVU^È6-ïÊŸ±‹„�2ÍÝJÄ,&ËF^Âìan—}3ªe¦bsÉÅy_^2&á{§–r	“Î=Úq”ía<L-§N ²à¦É‘Ù2YFŒ2Ü–�Æ.ôèù”ßFá(ðØ…Èow*bøq"§ø,»e£‘@±èõwfĤ:zÈ(êý[
-añnݯG–¢_à¼Â
"+.z÷?ß0À'›X6OŒ¾ªôÐÑ»Á¾ò7Vôv;\	g