steffen/cryodev
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

replace deploy-rs CI with Comin pull-based deployment

Browse source 
- Add Comin service for cryodev-main (polls git repo, auto-deploys)
- Fix cryodev-pi Comin URL (cryodev-server.git -> cryodev.git)
- Remove deploy-rs from CI pipeline (was insecure with shared runner)
- Remove deploy SSH key, root SSH login, sudo rules for gitea-runner
- Revert PermitRootLogin back to 'no'
- CI now only runs flake-check + build (no deploy)
- Deployment happens via Comin (both hosts poll and self-deploy)
This commit is contained in:
steffen 2026-03-14 14:43:15 +01:00
parent ed806bf5fb
commit c45a603d1c
11 changed files with 37 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

9
modules/nixos/forgejo-runner/default.nix
View file

@ -31,15 +31,6 @@ in
config = mkIf cfg.enable {
nix.settings.trusted-users = [ "gitea-runner" ];
# Allow gitea-runner to manage deploy keys and SSH config for CI/CD
security.sudo.extraConfig = ''
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/tee /etc/deploy/key
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/tee /etc/ssh/ssh_config.d/deploy.conf
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/mkdir -p /etc/deploy
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/chmod 600 /etc/deploy/key
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/rm -f /etc/deploy/key /etc/ssh/ssh_config.d/deploy.conf
'';
services.gitea-actions-runner = {
package = pkgs.forgejo-runner;
instances.default = {

2
modules/nixos/openssh/default.nix
View file

@ -9,7 +9,7 @@ in
ports = mkDefault [ 2299 ];
openFirewall = mkDefault true;
settings = {
PermitRootLogin = mkDefault "prohibit-password";
PermitRootLogin = mkDefault "no";
PasswordAuthentication = mkDefault false;
};
};