hosts: add kabtopci prototype
This commit is contained in:
19
modules/services/kabtopci/default.nix
Normal file
19
modules/services/kabtopci/default.nix
Normal file
@@ -0,0 +1,19 @@
|
||||
#
|
||||
# Services
|
||||
#
|
||||
# flake.nix
|
||||
# ├─ ./hosts
|
||||
# │ └─ home.nix
|
||||
# └─ ./modules
|
||||
# └─ ./services
|
||||
# └─ default.nix *
|
||||
# └─ ...
|
||||
#
|
||||
|
||||
[
|
||||
# ./microvm.nix
|
||||
./hydra.nix
|
||||
]
|
||||
|
||||
# picom, polybar and sxhkd are pulled from desktop module
|
||||
# redshift temporarely disables
|
||||
59
modules/services/kabtopci/gitea_runner.nix
Normal file
59
modules/services/kabtopci/gitea_runner.nix
Normal file
@@ -0,0 +1,59 @@
|
||||
{ lib, config, pkgs, ... }:
|
||||
|
||||
{
|
||||
virtualisation = {
|
||||
podman ={
|
||||
enable = true;
|
||||
autoPrune.enable = true;
|
||||
dockerCompat = true;
|
||||
};
|
||||
containers.containersConf.settings = {
|
||||
# podman seems to not work with systemd-resolved
|
||||
containers.dns_servers = [ "8.8.8.8" "8.8.4.4" ];
|
||||
};
|
||||
};
|
||||
|
||||
services.gitea-actions-runner.instances = {
|
||||
cirunner = {
|
||||
enable = true;
|
||||
url = "https://git.kabtop.de";
|
||||
name = "CI Kabtop runner";
|
||||
tokenFile = config.age.secrets."services/gitea/cirunner-token".path;
|
||||
labels = [
|
||||
"ci"
|
||||
"debian-latest:docker://node:18-bullseye"
|
||||
"ubuntu-latest:docker://node:16-bullseye"
|
||||
"ubuntu-22.04:docker://node:16-bullseye"
|
||||
"ubuntu-20.04:docker://node:16-bullseye"
|
||||
"ubuntu-18.04:docker://node:16-buster"
|
||||
"native:host"
|
||||
];
|
||||
hostPackages = with pkgs; [
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
nodejs
|
||||
wget
|
||||
];
|
||||
settings = {
|
||||
# container.options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nixuser --device=/dev/kvm";
|
||||
# the default network that also respects our dns server settings
|
||||
container.network = "host";
|
||||
container.privileged = false;
|
||||
# container.valid_volumes = [
|
||||
# "/nix"
|
||||
# "${storeDeps}/bin"
|
||||
# "${storeDeps}/etc/ssl"
|
||||
# ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets."services/gitea/cirunner-token" = {
|
||||
file = ../../../secrets/services/gitea/cirunner-token.age;
|
||||
owner = "gitea-runner";
|
||||
};
|
||||
}
|
||||
78
modules/services/kabtopci/hydra.nix
Normal file
78
modules/services/kabtopci/hydra.nix
Normal file
@@ -0,0 +1,78 @@
|
||||
{ lib, config, pkgs, ... }:
|
||||
|
||||
{
|
||||
services = {
|
||||
hydra = {
|
||||
enable = true;
|
||||
hydraURL = "https://hydra.ci.kabtop.de";
|
||||
listenHost = "127.0.0.1";
|
||||
notificationSender = "hydra@kabtop.de";
|
||||
useSubstitutes = true;
|
||||
minimumDiskFree = 30;
|
||||
};
|
||||
nix-serve = {
|
||||
enable = true;
|
||||
port = 5001;
|
||||
bindAddress = "127.0.0.1";
|
||||
secretKeyFile = config.age.secrets."keys/nixsign".path;
|
||||
};
|
||||
nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
virtualHosts = {
|
||||
"ci.kabtop.de" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
default = true;
|
||||
locations."/".return = "503";
|
||||
};
|
||||
"hydra.ci.kabtop.de" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:3000";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Port 443;
|
||||
'';
|
||||
};
|
||||
};
|
||||
"cache.ci.kabtop.de" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults = {
|
||||
email = "webmaster@kabtop.de";
|
||||
webroot = "/var/lib/acme/acme-challenge";
|
||||
#server = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
||||
};
|
||||
};
|
||||
|
||||
nix = {
|
||||
settings = {
|
||||
trusted-users = [
|
||||
"hydra"
|
||||
];
|
||||
allowed-uris = "github:";
|
||||
};
|
||||
|
||||
extraOptions = ''
|
||||
secret-key-files = ${config.age.secrets."keys/nixsign".path}
|
||||
'';
|
||||
};
|
||||
|
||||
age.secrets."keys/nixsign" = {
|
||||
file = ../../../secrets/keys/nixservepriv.age;
|
||||
owner = "hydra";
|
||||
};
|
||||
|
||||
}
|
||||
129
modules/services/kabtopci/microvm.nix
Normal file
129
modules/services/kabtopci/microvm.nix
Normal file
@@ -0,0 +1,129 @@
|
||||
{ config, microvm, lib, pkgs, user, agenix, impermanence, ... }:
|
||||
let
|
||||
name = "gitea-runner";
|
||||
in
|
||||
{
|
||||
microvm = {
|
||||
autostart = [
|
||||
name
|
||||
];
|
||||
vms = {
|
||||
${name} = {
|
||||
|
||||
inherit pkgs;
|
||||
|
||||
config = {
|
||||
imports =
|
||||
[ agenix.nixosModules.default ] ++
|
||||
[ impermanence.nixosModules.impermanence ] ++
|
||||
[( ./gitea_runner.nix )];
|
||||
|
||||
networking = {
|
||||
hostName = "${name}";
|
||||
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedUDPPorts = [ ];
|
||||
allowedTCPPorts = [ ];
|
||||
};
|
||||
};
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks = {
|
||||
"10-lan" = {
|
||||
matchConfig.Name = "*";
|
||||
networkConfig = {
|
||||
DHCP = "yes";
|
||||
IPv6AcceptRA = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users.${user} = { # System User
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
uid = 2000;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo= kabbone@kabc"
|
||||
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIgo4IP8ISUohyAMiDc3zEe6ESUE3un7eN5FhVtxZHmcAAAABHNzaDo= kabbone@kabc"
|
||||
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKVDApb3vZ+i97V4xLJh8rUF6z5OVYfORlXYbLhdQO15AAAABHNzaDo= kabbone@hades.home.opel-online.de"
|
||||
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0q++epdX7feQxvmC2m/CJEoJbkqtAJy6Ml6WKHxryZAAAABHNzaDo= kabbone@hades.home.opel-online.de"
|
||||
];
|
||||
};
|
||||
services = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
hostKeys = [
|
||||
{
|
||||
path = "/persist/etc/ssh/ssh_host_ed25519_key";
|
||||
type = "ed25519";
|
||||
}
|
||||
{
|
||||
path = "/persist/etc/ssh/ssh_host_rsa_key";
|
||||
type = "rsa";
|
||||
bits = 4096;
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."/persist".neededForBoot = lib.mkForce true;
|
||||
|
||||
environment = {
|
||||
systemPackages = with pkgs; [ # Default packages install system-wide
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
nodejs
|
||||
wget
|
||||
];
|
||||
persistence."/persist" = {
|
||||
directories = [
|
||||
"/var/log"
|
||||
"/var/lib/private"
|
||||
];
|
||||
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
microvm = {
|
||||
hypervisor = "qemu";
|
||||
vcpu = 4;
|
||||
mem = 4096;
|
||||
balloonMem = 4096;
|
||||
#kernel = pkgs.linuxKernel.packages.linux_latest;
|
||||
interfaces = [
|
||||
{
|
||||
type = "user";
|
||||
id = "vm-${name}";
|
||||
mac = "04:00:00:00:00:02";
|
||||
} ];
|
||||
shares = [{
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
tag = "ro-store";
|
||||
proto = "virtiofs";
|
||||
}
|
||||
{
|
||||
source = "/etc/vm-persist/${name}";
|
||||
mountPoint = "/persist";
|
||||
tag = "persist";
|
||||
proto = "virtiofs";
|
||||
}];
|
||||
#writableStoreOverlay = "/nix/.rw-store";
|
||||
#storeOnDisk = true;
|
||||
};
|
||||
|
||||
system.stateVersion = "23.05";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user