steffen/cryodev
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix CI deploy: use global SSH config for deploy-rs

Browse source 
The nix-daemon runs as root and cannot access the gitea-runner user's
~/.ssh directory. Solution: write the deploy key and SSH config to
/etc/deploy/ and /etc/ssh/ssh_config.d/ which are readable by all
users including the nix-daemon.

- Deploy key is written to /etc/deploy/key (cleaned up after deploy)
- SSH config in /etc/ssh/ssh_config.d/deploy.conf (cleaned up after)
- Minimal NOPASSWD sudo rules for gitea-runner to manage these files
- Reverts local deploy approach, back to deploy-rs over SSH
This commit is contained in:
steffen 2026-03-14 14:35:56 +01:00
parent e2e87d5694
commit ed806bf5fb
2 changed files with 30 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
modules/nixos/forgejo-runner/default.nix
View file

@ -31,10 +31,13 @@ in
config = mkIf cfg.enable {
nix.settings.trusted-users = [ "gitea-runner" ];
# Allow gitea-runner to deploy system configurations without password
# Allow gitea-runner to manage deploy keys and SSH config for CI/CD
security.sudo.extraConfig = ''
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/nix-env -p /nix/var/nix/profiles/system --set *
gitea-runner ALL=(root) NOPASSWD: /nix/store/*/bin/switch-to-configuration *
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/tee /etc/deploy/key
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/tee /etc/ssh/ssh_config.d/deploy.conf
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/mkdir -p /etc/deploy
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/chmod 600 /etc/deploy/key
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/rm -f /etc/deploy/key /etc/ssh/ssh_config.d/deploy.conf
'';
services.gitea-actions-runner = {