wip

.gitea/workflows/check-flake.yaml

@@ -12,16 +12,16 @@ env:
 
 jobs:
   check-flake:
-    runs-on: nixos
+    runs-on: ubuntu-latest
     steps:
-      # - run: node --version
+      - run: node --version
-      # - name: Install basic dependencies
+      - name: Install basic dependencies
-      #   run: apt-get update && apt-get install -y --no-install-recommends sudo curl ca-certificates xz-utils
+        run: apt-get update && apt-get install -y --no-install-recommends sudo curl ca-certificates xz-utils
 
-      # - name: Install Nix
+      - name: Install Nix
-      #   uses: https://github.com/cachix/install-nix-action@v20
+        uses: https://github.com/cachix/install-nix-action@v20
-      #   with:
+        with:
-      #     github_access_token: ${{ secrets.__GITHUB_TOKEN }}
+          github_access_token: ${{ secrets.__GITHUB_TOKEN }}
 
       - name: Install dependencies
         run: nix profile install nixpkgs#nodejs-18_x
@@ -31,8 +31,12 @@ jobs:
         with:
           fetch-depth: 0
 
-      # - name: Get ENV var names
+      - name: Get ENV var names
-      #   run: printenv | cut -d'=' -f1
+        run: printenv | cut -d'=' -f1
+
+      - name: List files in the repository
+        run: |
+          ls ${{ gitea.workspace }}
 
       - name: Check Flake
         run: nix flake check --show-trace

common/server/default.nix

@@ -10,7 +10,6 @@
     ./matrix.nix
     ./zerobin.nix
     ./gitea.nix
-    ./gitea-runner.nix
     ./privatebin/privatebin.nix
     ./radio.nix
     ./samba.nix

common/server/gitea-runner.nix

@@ -1,52 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  cfg = config.services.gitea-runner;
-in
-{
-  options.services.gitea-runner = {
-    enable = lib.mkEnableOption "Enables gitea runner";
-    dataDir = lib.mkOption {
-      default = "/var/lib/gitea-runner";
-      type = lib.types.str;
-      description = lib.mdDoc "gitea runner data directory.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    virtualisation.docker.enable = true;
-
-    users.users.gitea-runner = {
-      description = "Gitea Runner Service";
-      home = cfg.dataDir;
-      useDefaultShell = true;
-      group = "gitea-runner";
-      isSystemUser = true;
-      createHome = true;
-      extraGroups = [
-        "docker" # allow creating docker containers
-      ];
-    };
-    users.groups.gitea-runner = { };
-
-    systemd.services.gitea-runner = {
-      description = "Gitea Runner";
-
-      serviceConfig = {
-        WorkingDirectory = cfg.dataDir;
-        User = "gitea-runner";
-        Group = "gitea-runner";
-      };
-
-      requires = [ "network-online.target" ];
-      after = [ "network.target" "network-online.target" ];
-      wantedBy = [ "multi-user.target" ];
-
-      path = with pkgs; [ gitea-actions-runner ];
-
-      script = ''
-        exec act_runner daemon
-      '';
-    };
-  };
-}

flake.lock

@@ -185,16 +185,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1691888369,
+        "lastModified": 1695825837,
-        "narHash": "sha256-fBS5YOyiziv7tmR+yCJHr1Tm15Ve4PO1syyJwE9Xnuc=",
+        "narHash": "sha256-4Ne11kNRnQsmSJCRSSNkFRSnHC4Y5gPDBIQGjjPfJiU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a4d0fe7270cc03eeb1aba4e8b343fe47bfd7c4d5",
+        "rev": "5cfafa12d57374f48bcc36fda3274ada276cf69e",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "master",
+        "ref": "nixos-23.05",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -1,6 +1,6 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05";
 
     flake-utils.url = "github:numtide/flake-utils";
 

machines/phil/default.nix

@@ -6,5 +6,21 @@
   ];
 
   networking.hostName = "phil";
-  services.gitea-runner.enable = true;
+
+  services.gitea-actions-runner.instances.inst = {
+    enable = true;
+    name = config.networking.hostName;
+    url = "https://git.neet.dev/";
+    tokenFile = "/run/agenix/gitea-actions-runner-token";
+    labels = [
+      # provide a debian base with nodejs for actions
+      "debian-latest:docker://node:18-bullseye"
+      # fake the ubuntu name, because node provides no ubuntu builds
+      "ubuntu-latest:docker://node:18-bullseye"
+      # provide native execution on the host
+      #"native:host"
+    ];
+  };
+  virtualisation.docker.enable = true;
+  age.secrets.gitea-actions-runner-token.file = ../../secrets/gitea-actions-runner-token.age;
 }

machines/phil/properties.nix

@@ -8,8 +8,8 @@
 
   systemRoles = [
     "server"
-    "gitea-runner"
     "nix-builder"
+    "gitea-actions-runner"
   ];
 
   hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlgRPpuUkZqe8/lHugRPm/m2vcN9psYhh5tENHZt9I2";

machines/storage/s0/default.nix

@@ -9,9 +9,24 @@
 
   # system.autoUpgrade.enable = true;
 
-  # gitea runner and allow it to build ARM derivations
+  # gitea runner and allow it to build ARM derivationsFV
-  services.gitea-runner.enable = true;
+  services.gitea-actions-runner.instances.inst = {
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+    enable = true;
+    name = config.networking.hostName;
+    url = "https://git.neet.dev/";
+    tokenFile = "/run/agenix/gitea-actions-runner-token";
+    labels = [
+      # provide a debian base with nodejs for actions
+      "debian-latest:docker://node:18-bullseye"
+      # fake the ubuntu name, because node provides no ubuntu builds
+      "ubuntu-latest:docker://node:18-bullseye"
+      # provide native execution on the host
+      #"native:host"
+    ];
+  };
+  virtualisation.docker.enable = true;
+  age.secrets.gitea-actions-runner-token.file = ../../../secrets/gitea-actions-runner-token.age;
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ]; # todo: still needed?
   nix.gc.automatic = lib.mkForce false; # allow the nix store to serve as a build cache
 
   # binary cache

machines/storage/s0/properties.nix

@@ -10,6 +10,7 @@
     "server"
     "pia"
     "binary-cache"
+    "gitea-actions-runner"
   ];
 
   hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwiXcUFtAvZCayhu4+AIcF+Ktrdgv9ee/mXSIhJbp4q";

secrets/gitea-actions-runner-token.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 hPp1nw H88561/4YspJuLV0lOA7mfeHjwL291W/N3HWmiq8E0M
+mqLeaNk2B2OUZo4NEDLicpSN9Qw1NAsLOSCb3Ar+iXA
+-> ssh-ed25519 dMQYog CUuZSrofDHbBLtxgc4kg2h3Qgs99c3oudBGGV0iP/24
+9D/ZjZqJh8XeUo/UFA6ojcJIlwUqYSg+Itx2vREXdas
+-> p-grease #!rAT w\]efbQ
+/WNOqhMfFrl1holyeok7pf/joMso1LtjbB00BeUGecVdkDhj71TxLgc+5tor/3D/
+FC65ymMPL2t1j/G+qcow19X6bjWkytY
+--- XDThYXsCIJLrOEBXbKwpnRSzvcBuVp+NiQ2Uung74fk
+—L93%g\šqcÃÂZÏ÷ÆH\ 7ß—Ü<E28094>€Liµ¹W u¶â]¶ÇT=ÒHjl%—HÁfW=ðjþí£³Î“Ë­ÂáJ’–1a<31>Kéþ

secrets/secrets.nix

@@ -43,4 +43,7 @@ with roles;
   # backups
   "backblaze-s3-backups.age".publicKeys = personal ++ server;
   "restic-password.age".publicKeys = personal ++ server;
+
+  # gitea actions runner
+  "gitea-actions-runner-token.age".publicKeys = gitea-actions-runner;
 }