e2e87d5694
Runner runs on the same server it deploys to, so SSH to itself was unnecessarily complex. Now builds locally and activates directly. - Replace deploy-rs SSH workflow with local build + switch - Add NOPASSWD sudo for gitea-runner to run nix-env and switch-to-configuration (required for local deployment) - Remove SSH key setup from deploy workflow
74 lines
1.6 KiB
Nix
74 lines
1.6 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
cfg = config.services.forgejo-runner;
|
|
|
|
inherit (lib)
|
|
mkEnableOption
|
|
mkIf
|
|
mkOption
|
|
types
|
|
;
|
|
in
|
|
{
|
|
options.services.forgejo-runner = {
|
|
enable = mkEnableOption "Nix-based Forgejo Runner service";
|
|
url = mkOption {
|
|
type = types.str;
|
|
description = "Forgejo instance URL.";
|
|
};
|
|
tokenFile = mkOption {
|
|
type = types.path;
|
|
description = "Path to EnvironmentFile containing TOKEN=...";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
nix.settings.trusted-users = [ "gitea-runner" ];
|
|
|
|
# Allow gitea-runner to deploy system configurations without password
|
|
security.sudo.extraConfig = ''
|
|
gitea-runner ALL=(root) NOPASSWD: /run/current-system/sw/bin/nix-env -p /nix/var/nix/profiles/system --set *
|
|
gitea-runner ALL=(root) NOPASSWD: /nix/store/*/bin/switch-to-configuration *
|
|
'';
|
|
|
|
services.gitea-actions-runner = {
|
|
package = pkgs.forgejo-runner;
|
|
instances.default = {
|
|
enable = true;
|
|
name = "${config.networking.hostName}-nix";
|
|
inherit (cfg) url tokenFile;
|
|
|
|
labels = [ "host:host" ];
|
|
|
|
hostPackages = with pkgs; [
|
|
bash
|
|
coreutils
|
|
curl
|
|
gitMinimal
|
|
gnused
|
|
nix
|
|
nodejs
|
|
openssh
|
|
deploy-rs
|
|
];
|
|
|
|
settings = {
|
|
log.level = "info";
|
|
runner = {
|
|
capacity = 1;
|
|
envs = {
|
|
NIX_CONFIG = "extra-experimental-features = nix-command flakes";
|
|
NIX_REMOTE = "daemon";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|