From 310008ca0282ebefc2b44c5f673166385904c1ea Mon Sep 17 00:00:00 2001 From: Nathan McCarty Date: Mon, 5 Sep 2022 20:52:22 -0400 Subject: [PATCH] Add gitlab runner back to oracles --- machines/oracles/configuration.nix | 50 +++++++++++++++++++++++++++++- modules/linux/linux/base.nix | 2 +- modules/linux/virtualization.nix | 2 ++ secrets/oracles/gitlab.yaml | 30 ++++++++++++++++++ 4 files changed, 82 insertions(+), 2 deletions(-) create mode 100644 secrets/oracles/gitlab.yaml diff --git a/machines/oracles/configuration.nix b/machines/oracles/configuration.nix index 5ff5e6e..b8addc0 100644 --- a/machines/oracles/configuration.nix +++ b/machines/oracles/configuration.nix @@ -17,12 +17,17 @@ owner = config.users.users.nathan.name; group = config.users.users.nathan.group; }; + "nix-asuran" = { + format = "yaml"; + sopsFile = ../../secrets/oracles/gitlab.yaml; + }; }; # Setup system configuration nathan = { programs = { utils = { devel = true; + binfmt = true; }; }; services = { @@ -55,6 +60,9 @@ setupGrub = true; nix.autoUpdate = true; harden = false; + virtualization = { + docker = true; + }; }; }; # Configure networking @@ -169,13 +177,16 @@ } ]; }; + + # Setup vhost for pack website services.nginx.virtualHosts."pack.forward-progress.net" = { enableACME = true; forceSSL = true; locations."/".root = "/var/www/pack.forward-progress.net"; root = "/var/www/pack.forward-progress.net"; }; - # Backup postgres + + # Backup postgres, as used by matrix services.postgresqlBackup = { #enable = true; compression = "none"; @@ -183,4 +194,41 @@ startAt = "OnCalendar=00/2:00"; }; + # Setup the gitlab runners + services.gitlab-runner = + let + nix-shared = with lib; { + dockerImage = "nixpkgs/nix-flakes"; + dockerVolumes = [ + "/var/sharedstore:/sharedstore" + ]; + dockerDisableCache = true; + dockerPrivileged = true; + }; + in + { + enable = true; + concurrent = 4; + checkInterval = 1; + services = { + # default-asuran = { + # registrationConfigFile = "/var/lib/secret/gitlab-runner/asuran-default"; + # dockerImage = "debian:stable"; + # dockerVolumes = [ + # "/var/run/docker.sock:/var/run/docker.sock" + # ]; + # dockerPrivileged = true; + # tagList = [ "linux-own" ]; + # }; + + nix-asuran = nix-shared // { + registrationConfigFile = config.sops.secrets.nix-asuran.path; + tagList = [ "nix" ]; + requestConcurrency = 8; + limit = 4; + runUntagged = true; + }; + }; + }; + } diff --git a/modules/linux/linux/base.nix b/modules/linux/linux/base.nix index bc0b0ec..dbcbfbc 100644 --- a/modules/linux/linux/base.nix +++ b/modules/linux/linux/base.nix @@ -44,7 +44,7 @@ with lib; enable = true; allowReboot = true; # Update from the flake - flake = "github:nathans-flakes/system"; + flake = "github:nathans-flakes/system/rewrite"; # Attempt to update daily at 2AM dates = "2:00"; }; diff --git a/modules/linux/virtualization.nix b/modules/linux/virtualization.nix index d8fc76a..c45fd8a 100644 --- a/modules/linux/virtualization.nix +++ b/modules/linux/virtualization.nix @@ -23,6 +23,8 @@ with lib; # Automatically prune to keep things lean autoPrune.enable = true; }; + # Make sure our containers can reach the network + boot.kernel.sysctl."net.ipv4.ip_forward" = true; }) (mkIf nc.virtualization.lxc { virtualisation.lxd = { diff --git a/secrets/oracles/gitlab.yaml b/secrets/oracles/gitlab.yaml new file mode 100644 index 0000000..49e6d2d --- /dev/null +++ b/secrets/oracles/gitlab.yaml @@ -0,0 +1,30 @@ +nix-asuran: ENC[AES256_GCM,data:RXjgVChMgDP1YodyEZyUJejD8g/eXVvbBzZ7N1oUmkKEDgjjetHxZVt8h4BfCyymQaZA9wP2wtq4/jiWdOKrYuKsnCZ3SR4qJpxjkOe0W+hh,iv:pLmBWY6ZB4S4OrRJRiOhxBKGJvPsGQcJRarmZY6aFSw=,tag:uliGhjYATCn0qvpsG3Ux/A==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1ud80054jwf6ff7xx65ta6g7qxx2flc24r5gyyfjz43kvppjutqyskr2qm2 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkUkxDNzRaaXk5MjFSK3o2 + aWhRamxEb3FFMGo3OUVDL25udVg5UDM3SHhFCnZEWmluYklvcjh2ZWk0K2kvSUZj + YzFMUHdaQlhhQi8ya3l5KzB4NzBDdlEKLS0tIHVLSlFkUEdoK3hzQ2V5VlZTSW9Q + MWw3OG9CN3BkanZsUEVPbjBRclVTLzAKYyjhfh/VZDx9RnlcS6palMaGDOSYPha0 + i3bU8KvH0cc/FhSkv320Owwrwq4ocI3ZSWEWXVgmnwxLuXi2pNW3Qw== + -----END AGE ENCRYPTED FILE----- + - recipient: age12ayrv88xjt4r276fzc9du70x8q0r7xutt85vj627ykf4k8kgms4sc6wywn + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZSjFkRkpjcytHV1RCSEc1 + TnlQR2c2cUtVT3dUZGQrb1JEWFFyNmNSekdBCjRYUHdDZGdQRWFkZHdISzgrNHdO + S2hlQThUckRDVE9RM1czcWFpVWMzczAKLS0tIGFrZFhVWk5SR3dtVUFwQjdCaEJ5 + R3NHOS83TmIyaG1yYjdJODFuVmZ6aTAKF/PP60jU0JlN8TchHeTp0T5Fhg55kMHc + t9Dv+PBkscQxO3VxUD3Oqw9/c/C5Abm8KgcWmYrLa00+2zbMC0oZEA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2022-09-06T00:47:48Z" + mac: ENC[AES256_GCM,data:7LHqZlBtRw+dN5Ed2bSPl7onYbI6m3rpFSqJ2qJM7dLK0wLSrJoP9K0chfLKDthTtw21KRv9m0SyAOsjv1ek8uyD7PIE5hhmtWGWm/rrDMLtLt+NWxQWBdM2sMGughvzhRG0auLUF8WaWHaoRuQyG9qlmO8lXMspS7/dfDQUcdQ=,iv:ciThIEZv4nom9w6XQS2rtw+lAlPcpGMLeuUjfAkTiWg=,tag:G0C0d6+fRGZ0Bq/GeczIrg==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.7.3