klaatuandroot
de1ec998e6
- Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in shell mode, with options for enable, instanceURL, name, labels, and tokenFile (agenix secret path). - Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with appropriate labels. Agenix secret placeholders left with TODOs. - Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday midnight) that runs nix flake update and opens a PR if flake.lock changed, using GITEA_TOKEN secret for authentication. Closes part of #15 (NixOS shell runners + flake-lock workflow).
93 lines
1.9 KiB
Nix
93 lines
1.9 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
metadata,
|
|
top,
|
|
...
|
|
}:
|
|
|
|
{
|
|
imports = [
|
|
./boot.nix
|
|
./hardware-configuration.nix
|
|
# ./virt.nix
|
|
top.nix-hardware.nixosModules.system76
|
|
];
|
|
|
|
age.secrets = {
|
|
gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
|
|
# TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age
|
|
# gitea-runner-zeke.file = ../../../secrets/gitea-runner-zeke.age;
|
|
};
|
|
|
|
boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
|
|
|
|
greg = {
|
|
kubernetes = {
|
|
enable = true;
|
|
vipInterface = "enp12s0";
|
|
priority = 253;
|
|
};
|
|
nebula.enable = true;
|
|
remote-builder.enable = true;
|
|
runner = {
|
|
enable = true;
|
|
vbox = false;
|
|
};
|
|
gitea-runner = {
|
|
enable = true;
|
|
labels = [ "self-hosted" "bare-metal" "host:zeke" ];
|
|
# TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age
|
|
# tokenFile = config.age.secrets.gitea-runner-zeke.path;
|
|
};
|
|
tailscale = {
|
|
enable = true;
|
|
tags = [ "home" ];
|
|
};
|
|
};
|
|
|
|
hardware = {
|
|
nvidia = {
|
|
modesetting.enable = true;
|
|
powerManagement = {
|
|
enable = false;
|
|
finegrained = false;
|
|
};
|
|
nvidiaSettings = true;
|
|
open = true;
|
|
};
|
|
system76 = {
|
|
firmware-daemon.enable = true;
|
|
#kernel-modules.enable = true;
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
hostName = "zeke";
|
|
networkmanager.enable = lib.mkForce true;
|
|
enableIPv6 = false;
|
|
useDHCP = false;
|
|
interfaces.enp12s0.useDHCP = true;
|
|
};
|
|
|
|
# Let's do a sound thing
|
|
services = {
|
|
k3s = {
|
|
extraFlags = [
|
|
"--tls-san ${metadata.hosts.${config.networking.hostName}.ip}"
|
|
#"--bind-address ${ip}"
|
|
];
|
|
};
|
|
};
|
|
|
|
users.users.greg.extraGroups = [
|
|
"podman"
|
|
];
|
|
|
|
# virtualisation.virtualbox.host = {
|
|
# enableExtensionPack = true;
|
|
# headless = true;
|
|
# enableWebService = true;
|
|
# };
|
|
}
|