Jörg Thalheim
809520c03b
All checks were successful
build / test (push) Successful in 7s
gitea: check runner label
flake.lock: Update
Flake lock file updates:
• Updated input 'disko':
'github:nix-community/disko/15c4d57b41b6b57024aec015e5d30a4ed4713034' (2023-07-04)
→ 'github:nix-community/disko/68eb09b1833301d729ae6e89583173b6ceaade1c' (2023-07-13)
• Updated input 'homepage':
'git+https://git.clan.lol/clan/clan-homepage?ref=refs/heads/main&rev=ffe31cffbdcc22fbf92bde02beda9b17aebe6a82' (2023-07-05)
→ 'git+https://git.clan.lol/clan/clan-homepage?ref=refs/heads/main&rev=b1573761fd03b6d6ae2170211953e08a2f430b8c' (2023-07-11)
• Updated input 'nixpkgs':
'github:Mic92/nixpkgs/9e9bef88786414db7178ad610e7874730d21c5bb' (2023-07-13)
→ 'github:Mic92/nixpkgs/76873846521e9f2eacc3d2db7c3643b222e22a59' (2023-07-13)
• Updated input 'sops-nix':
'github:Mic92/sops-nix/5ed3c22c1fa0515e037e36956a67fe7e32c92957' (2023-07-02)
→ 'github:Mic92/sops-nix/88b964df6981e4844c07be8c192aa6bdca768a10' (2023-07-12)
• Updated input 'srvos':
'github:numtide/srvos/c9fa5cf4b6014807655bf8356b3cddc86f741b7a' (2023-07-03)
→ 'github:numtide/srvos/e8ae8c0ac816b6388199a475bd6188943e47f5b9' (2023-07-13)
• Updated input 'treefmt-nix':
'github:numtide/treefmt-nix/df3f32b0cc253dfc7009b7317e8f0e7ccd70b1cf' (2023-06-29)
→ 'github:numtide/treefmt-nix/f1dca68b908f3dd656b923b9fb62f7d755133662' (2023-07-13)
flake.lock: Update
Flake lock file updates:
• Updated input 'nixpkgs':
'github:Mic92/nixpkgs/76873846521e9f2eacc3d2db7c3643b222e22a59' (2023-07-13)
→ 'github:Mic92/nixpkgs/21d75bf07c3cd8c10aea2e86e7d683e12b8bc5c4' (2023-07-13)
flake.lock: Update
Flake lock file updates:
• Updated input 'nixpkgs':
'github:Mic92/nixpkgs/21d75bf07c3cd8c10aea2e86e7d683e12b8bc5c4' (2023-07-13)
→ 'github:Mic92/nixpkgs/dc54601ce60a6e7b427d124550d43067ee605b53' (2023-07-13)
76 lines
1.9 KiB
Nix
76 lines
1.9 KiB
Nix
{ config, self, pkgs, lib, ... }:
|
|
|
|
{
|
|
systemd.services.gitea-runner-nix-token = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "gitea.service" ];
|
|
environment = {
|
|
GITEA_CUSTOM = "/var/lib/gitea/custom";
|
|
GITEA_WORK_DIR = "/var/lib/gitea";
|
|
};
|
|
script = ''
|
|
set -euo pipefail
|
|
token=$(${lib.getExe self.packages.${pkgs.hostPlatform.system}.gitea} actions generate-runner-token)
|
|
echo "TOKEN=$token" > /var/lib/gitea-actions-runner/token
|
|
'';
|
|
unitConfig.ConditionPathExists = [ "!/var/lib/gitea-actions-runner/token" ];
|
|
serviceConfig = {
|
|
User = "gitea";
|
|
Group = "gitea";
|
|
StateDirectory = "gitea-actions-runner";
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
};
|
|
|
|
systemd.services.gitea-runner-nix = {
|
|
after = [ "gitea-runner-nix-token.service" ];
|
|
requires = [ "gitea-runner-nix-token.service" ];
|
|
# TODO: systemd confinment
|
|
#serviceConfig = {
|
|
# Environment = [
|
|
# "NIX_REMOTE=daemon"
|
|
# "PAGER=cat"
|
|
# ];
|
|
# BindPaths = [
|
|
# "/nix/var/nix/daemon-socket/socket"
|
|
# "/run/nscd/socket"
|
|
# "/var/lib/drone"
|
|
# ];
|
|
#};
|
|
};
|
|
|
|
services.gitea-actions-runner.instances.nix = {
|
|
enable = true;
|
|
name = "nix-runner";
|
|
# take the git root url from the gitea config
|
|
# only possible if you've also configured your gitea though the same nix config
|
|
# otherwise you need to set it manually
|
|
url = config.services.gitea.settings.server.ROOT_URL;
|
|
# use your favourite nix secret manager to get a path for this
|
|
tokenFile = "/var/lib/gitea-actions-runner/token";
|
|
labels = [ "nix:host" ];
|
|
hostPackages = with pkgs; [
|
|
bash
|
|
coreutils
|
|
curl
|
|
gawk
|
|
gitMinimal
|
|
gnused
|
|
jq
|
|
nixUnstable
|
|
nodejs
|
|
wget
|
|
gnutar
|
|
bash
|
|
config.nix.package
|
|
gzip
|
|
];
|
|
settings = {
|
|
runner.envs = {
|
|
HOME = "/var/lib/gitea-runner/nix";
|
|
};
|
|
};
|
|
};
|
|
}
|