klaatu
81936ac524
buildbot/nix-eval Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-isaiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-jeremiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-zeke Build done.
buildbot/nix-build Build done.
- Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in shell mode, with options for enable, instanceURL, name, labels, and tokenFile (agenix secret path). - Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with appropriate labels. Agenix secret placeholders left with TODOs. - Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday midnight) that runs nix flake update and opens a PR if flake.lock changed, using GITEA_TOKEN secret for authentication. Closes part of #15 (NixOS shell runners + flake-lock workflow).
90 lines
1.9 KiB
Nix
90 lines
1.9 KiB
Nix
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
|
|
{
|
|
imports = [
|
|
./git.nix
|
|
./hardware-configuration.nix
|
|
./podman.nix
|
|
./matrix.nix
|
|
./nextcloud.nix
|
|
./nginx.nix
|
|
./postgres.nix
|
|
];
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
bind
|
|
graphviz
|
|
nix-du
|
|
pgloader
|
|
];
|
|
|
|
age.secrets = {
|
|
# TODO: Greg add agenix secret at secrets/gitea-runner-linode.age
|
|
# gitea-runner-linode.file = ../../../secrets/gitea-runner-linode.age;
|
|
};
|
|
|
|
greg = {
|
|
home = false;
|
|
linode.enable = true;
|
|
nebula = {
|
|
enable = true;
|
|
isLighthouse = true;
|
|
};
|
|
proxies."immich.thehellings.com" = {
|
|
genAliases = false;
|
|
target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}";
|
|
ssl = true;
|
|
};
|
|
tailscale.enable = true;
|
|
gitea-runner = {
|
|
enable = true;
|
|
labels = [ "self-hosted" "host:linode" ];
|
|
# TODO: Greg add agenix secret at secrets/gitea-runner-linode.age
|
|
# tokenFile = config.age.secrets.gitea-runner-linode.path;
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
networkmanager.enable = lib.mkForce false;
|
|
hostName = "linode";
|
|
domain = "thehellings.com";
|
|
nameservers = [ "100.88.91.27" ];
|
|
};
|
|
|
|
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
|
|
"Host chronicles.shire-zebra.ts.net"
|
|
" User backup"
|
|
" IdentityFile /etc/ssh/backup_ed25519"
|
|
" StrictHostKeyChecking no"
|
|
" UserKnownHostsFile /dev/null"
|
|
];
|
|
|
|
services = {
|
|
immich-public-proxy = {
|
|
enable = true;
|
|
immichUrl = "https://immich.shire-zebra.ts.net";
|
|
};
|
|
};
|
|
|
|
security.sudo.extraRules = [
|
|
{
|
|
users = [ "gitlab-runner" ];
|
|
commands = [
|
|
{
|
|
command = "/run/current-system/sw/bin/systemctl";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/podman";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
}
|