steffen/cryodev
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix forgejo-runner token: use SOPS template with TOKEN= prefix

Browse source 
The gitea-actions-runner NixOS module expects tokenFile to be an
EnvironmentFile containing TOKEN=<value>, but sops-nix writes only
the raw secret value. Use a sops template to prepend TOKEN= prefix.
This commit is contained in:
steffen 2026-03-14 12:43:07 +01:00
parent 086e760b9e
commit 82f3be3b9d
3 changed files with 13 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hosts/cryodev-main/secrets.yaml
View file

@ -1,7 +1,7 @@
tailscale:
auth-key: ENC[AES256_GCM,data:v5C3DqYJsDKq6oUa/3G6WKxyKeIK4EJLNxWMbKjSbwe5MPtS4sZjFszMviKcEVGW,iv:4G8irABGuVhOYnK15EjbpNQ4B9VY/NdwCrfz+YAMzvA=,tag:0Vhq/TJgx+48frRy30yKFg==,type:str]
forgejo-runner:
token: ENC[AES256_GCM,data:/i9KVMeEXYwQnn0=,iv:pILMNbhDviifDUFRINi6n9dtGSAeqxKMdBgjYwtXXEM=,tag:JCj5v5BZdZteo0MdTVKREw==,type:str]
token: ENC[AES256_GCM,data:sdnJcyRiTLxXoZDNbEzJAjpiK+iSUH0gV0XwbEQf94IE/6IZz5/zHw==,iv:py+qqp3VAwBGEpYiQwft3jnQS943JaBlrcckColv4f8=,tag:rtmRwW8rpXB6Pv+LSkp+Fw==,type:str]
headplane:
cookie_secret: ENC[AES256_GCM,data:HICF31i6yCLZGNeOFYTR3Bp0a7i0UKOvGAvx/pD3NB4=,iv:ZtK8r1YUWnf5Af0Ls341k0w1mZm+D5Rb0E1uS5z/Gdo=,tag:vwM9+4dpcmnjn/wR6Ty/MQ==,type:str]
agent_pre_authkey: ENC[AES256_GCM,data:QvhPi2lhyP7w6HTeOSS8660NzIY9Q6AOhlOGQXnvz+qYu9vOAMQPOFMZfie5+e8g,iv:X60wVOEUIsTiMHrrd4lId0VpR7VfFDr74p8RGka3+18=,tag:kIvaHrOWIM+VQ+Qz1GiheQ==,type:str]
@ -31,7 +31,7 @@ sops:
MEpGbGlQbVRsM1NxN1JxY2J1MVNTTE0KuIvuM2c1VIXKv0LGLb0NwqtSyBYcRcb1
uiIjNV0UzEt/WvnCeUTMPgIXBHk6jWcaKe13v6MHeha+/CVZ9Su/Lw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-03-14T11:30:38Z"
mac: ENC[AES256_GCM,data:CbK8Yd39gpxLd2m5O43UKOW3jU1h4d7NRyQd3IruxEsUgokt1v9W9aXTyXvyv4fnbOaYqGxw7e8a08MECS3GtUuFpXJFK4rWDET2mU2OweoG1h6uPejyg0ejPHa+PMI7dFcADTn6W//6WZcCbQhHrAuISrUG9/JZtOod28SZWp4=,iv:KtDNJnQwgNRETDA17v4jq0rESHADfaAH4cBeCUbeEv4=,tag:825/Y83J270NZ17mTmYMew==,type:str]
lastmodified: "2026-03-14T11:38:57Z"
mac: ENC[AES256_GCM,data:gmxyp3XaHeU/CT2lgo14wIbJsKs/JrZmUPhgHwo1XRN5Sf/Su6lHOpVlQS1M6R3+ZlBnS/oEur+y0gydCCqhJK1C3Y5YuUfPlOWOeQWMVxQBqxWkyemvz5KgGseDc9nG09FpoGEYa4sSeuD1J6vRsGcZiOStaA6s8NICWivdWcQ=,iv:cYILLrScr7cFiLx5INbc9z3BT7LaCjLnCH0wdn3lZ1k=,tag:IIRb/Tu8YqWNiHXH7CSOfQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.11.0

6
hosts/cryodev-main/services/default.nix
View file

@ -10,8 +10,8 @@
./sops.nix
# Stufe 2: Erst aktivieren wenn Headscale/Forgejo laufen und echte Secrets existieren
# ./forgejo-runner.nix # braucht: forgejo-runner/token (Forgejo)
# ./headplane.nix # braucht: headplane/agent_pre_authkey (Headscale)
# ./tailscale.nix # braucht: tailscale/auth-key (Headscale)
./forgejo-runner.nix # braucht: forgejo-runner/token (Forgejo)
./headplane.nix # braucht: headplane/agent_pre_authkey (Headscale)
./tailscale.nix # braucht: tailscale/auth-key (Headscale)
];
}

8
hosts/cryodev-main/services/forgejo-runner.nix
View file

@ -13,10 +13,16 @@
services.forgejo-runner = {
enable = true;
url = "https://${constants.services.forgejo.fqdn}";
tokenFile = config.sops.secrets."forgejo-runner/token".path;
tokenFile = config.sops.templates."forgejo-runner-token".path;
};
sops.secrets."forgejo-runner/token" = {
mode = "0400";
};
sops.templates."forgejo-runner-token" = {
content = ''
TOKEN=${config.sops.placeholder."forgejo-runner/token"}
'';
};
}