alex/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

environment

Browse Source
This commit is contained in:
Alex Mickelson
2026-02-07 13:59:39 -07:00
parent eb111fb5f8
commit 5f55fe11a3
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
nix/modules/gitea-runner.nix
View File

@@ -52,15 +52,19 @@
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d /data/runner 0755 gitea-runner gitea-runner -" "d /data/runner 0755 gitea-runner gitea-runner -"
"f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -" "f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
"d /home/gitea-runner 0755 gitea-runner gitea-runner -"
]; ];
systemd.services.gitea-runner-infrastructure.serviceConfig = { systemd.services.gitea-runner-infrastructure.serviceConfig = {
# Let systemd create the working directory with proper permissions # Use the actual location where the module creates the .runner file
WorkingDirectory = lib.mkForce "/home/gitea-runner"; WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
WorkingDirectoryMode = lib.mkForce "0755";
ReadWritePaths = lib.mkForce [ ]; ReadWritePaths = lib.mkForce [
"/var/lib/gitea-runner"
"/data/cloudflare/"
"/data/runner/infrastructure"
"/data/runner"
"/home/github/infrastructure"
];
# Disable all sandboxing features # Disable all sandboxing features
DynamicUser = lib.mkForce false; DynamicUser = lib.mkForce false;
@@ -89,7 +93,7 @@
User = lib.mkForce "gitea-runner"; User = lib.mkForce "gitea-runner";
Group = lib.mkForce "gitea-runner"; Group = lib.mkForce "gitea-runner";
DeviceAllow = lib.mkForce [ ]; DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
DevicePolicy = lib.mkForce "auto"; DevicePolicy = lib.mkForce "auto";
Restart = lib.mkForce "always"; Restart = lib.mkForce "always";