Back out "hades: remove gitlab runners"

This backs out commit 771ba29.
alarsyo · Feb 22, 2025 · bce3b20 · bce3b20
1 parent e14c5f3
commit bce3b20
Show file tree

Hide file tree

Showing 5 changed files with 71 additions and 0 deletions.
diff --git a/hosts/hades/default.nix b/hosts/hades/default.nix
@@ -157,6 +157,57 @@ in {
   services = {
     openssh.enable = true;
     vnstat.enable = true;
+
+    gitlab-runner = {
+      enable = true;
+      settings = {
+        concurrent = 4;
+      };
+      services = {
+        nix = {
+          authenticationTokenConfigFile = config.age.secrets."gitlab-runner/hades-nix-runner-env".path;
+          dockerImage = "alpine";
+          dockerVolumes = [
+            "/nix/store:/nix/store:ro"
+            "/nix/var/nix/db:/nix/var/nix/db:ro"
+            "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+          ];
+          dockerDisableCache = true;
+          preBuildScript = pkgs.writeScript "setup-container" ''
+            mkdir -p -m 0755 /nix/var/log/nix/drvs
+            mkdir -p -m 0755 /nix/var/nix/gcroots
+            mkdir -p -m 0755 /nix/var/nix/profiles
+            mkdir -p -m 0755 /nix/var/nix/temproots
+            mkdir -p -m 0755 /nix/var/nix/userpool
+            mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+            mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+            mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+            mkdir -p -m 0700 "$HOME/.nix-defexpr"
+
+            . ${pkgs.nix}/etc/profile.d/nix.sh
+
+            ${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [nix cacert git openssh])}
+
+            ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
+            ${pkgs.nix}/bin/nix-channel --update nixpkgs
+
+            mkdir -p ~/.config/nix
+            echo "experimental-features = nix-command flakes" > ~/.config/nix/nix.conf
+          '';
+          environmentVariables = {
+            ENV = "/etc/profile";
+            USER = "root";
+            NIX_REMOTE = "daemon";
+            PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+            NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
+          };
+        };
+        default = {
+          authenticationTokenConfigFile = config.age.secrets."gitlab-runner/hades-runner-env".path;
+          dockerImage = "debian:stable";
+        };
+      };
+    };
   };
 
   virtualisation.docker.enable = true;

diff --git a/hosts/hades/secrets.nix b/hosts/hades/secrets.nix
@@ -13,6 +13,9 @@
         // attrs;
     in
       lib.mapAttrs toSecret {
+        "gitlab-runner/hades-nix-runner-env" = {};
+        "gitlab-runner/hades-runner-env" = {};
+
         "lohr/shared-secret" = {};
 
         "matrix-synapse/secret-config" = {

diff --git a/modules/secrets/gitlab-runner/hades-nix-runner-env.age b/modules/secrets/gitlab-runner/hades-nix-runner-env.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 k2gHjw 0Qkzquxwa8PSNg6yq+CsfC4JfPLfxEIBKq1krrynlxg
+QOHmNCQsV10zSnYvEeSpK95oXXlS+J4pw6EIR1KzxoU
+-> ssh-ed25519 pX8y2g YbFzF2/mWizY4SOnNKzkcBEEsHYc1mTCpzWZ5vf6Zy0
+p2E9Uh0rWa8qbf2SvB5e4lxS+MEx5KGumKd28UHW0/0
+--- naIsBkYqZMgekqmxTgESGMuFIKoagS68mfXbid7k9e0
+U�<"���{24>�e�^�����*C���g f�{���v���I��_��F�oe3.6,cF�K
+��$�9]�@��{<���As��p!v� ת���ǕC���r�0iV��8�>~L
diff --git a/modules/secrets/gitlab-runner/hades-runner-env.age b/modules/secrets/gitlab-runner/hades-runner-env.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 k2gHjw EQkuI0FlwczzVWR3wvx+lXUNd0NnUjpBhOhmmIJ8Xhk
+SXMz4M9n7kcuacBkJUg//iLYLJ5qP2BlQnD2zALskuw
+-> ssh-ed25519 pX8y2g fmzHtkHXHjHiva7dGs7Khof1VzMMj6CLC4oghYf7lEk
+Yx6G693eo5EqviIj/8t5JWjziYCSSJlwDNG92FPc7ro
+--- /vsxhnYSHZFsDJtDbl8TKTgDS/XwqkTOXB2isT6K+LY
+b��Ǚ��)<FL�0(S���0SN��Ȓ}��S뚼����Z�"����Q?o�jH�;h@�b^���h��k^zi��?��U� �GJ������k1<�(z�-��iq���

diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix
@@ -13,6 +13,8 @@ let
 in {
   "gandi/api-key.age".publicKeys = [alarsyo hades];
 
+  "gitlab-runner/hades-runner-env.age".publicKeys = [alarsyo hades];
+  "gitlab-runner/hades-nix-runner-env.age".publicKeys = [alarsyo hades];
   "gitlab-runner/thanatos-runner-env.age".publicKeys = [alarsyo thanatos];
   "gitlab-runner/thanatos-nix-runner-env.age".publicKeys = [alarsyo thanatos];