alex/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gitea runner

Browse Source
This commit is contained in:
Alex Mickelson
2026-02-07 14:03:42 -07:00
parent bc9d243c28
commit 2f176f9474
1 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
nix/modules/gitea-runner.nix
View File

@@ -55,7 +55,6 @@
]; ];
systemd.services.gitea-runner-infrastructure.serviceConfig = { systemd.services.gitea-runner-infrastructure.serviceConfig = {
# Use the actual location where the module creates the .runner file
WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure"; WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
ReadWritePaths = lib.mkForce [ ReadWritePaths = lib.mkForce [
@@ -65,13 +64,21 @@
"/data/runner" "/data/runner"
"/home/github/infrastructure" "/home/github/infrastructure"
]; ];
BindReadOnlyPaths = [
# CRITICAL: Completely disable mount namespace isolation
PrivateMounts = lib.mkForce false;
MountFlags = lib.mkForce "";
# Also bind the nix store
BindReadOnlyPaths = lib.mkForce [
"/nix/store" "/nix/store"
"/nix/var"
"/run/current-system"
]; ];
# Disable all sandboxing features
# Disable all other sandboxing features
DynamicUser = lib.mkForce false; DynamicUser = lib.mkForce false;
PrivateDevices = lib.mkForce false; PrivateDevices = lib.mkForce false;
PrivateMounts = lib.mkForce false;
PrivateTmp = lib.mkForce false; PrivateTmp = lib.mkForce false;
PrivateUsers = lib.mkForce false; PrivateUsers = lib.mkForce false;
ProtectClock = lib.mkForce false; ProtectClock = lib.mkForce false;