alex/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gitea runner

Browse Source
This commit is contained in:
Alex Mickelson
2026-02-07 14:10:20 -07:00
parent 78bf6e2cce
commit 6e9d586b9c
1 changed files with 90 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

70
nix/modules/gitea-runner.nix
View File

@@ -30,13 +30,13 @@
}; };
}; };
}; };
}; };
environment.pathsToLink = [ environment.pathsToLink = [
"/bin" "/bin"
]; ];
users.users.gitea-runner = { users.users.gitea-runner = {
isNormalUser = true; isNormalUser = true;
description = "Gitea Actions Runner"; description = "Gitea Actions Runner";
home = "/home/gitea-runner"; home = "/home/gitea-runner";
@@ -47,30 +47,56 @@
kubernetes-helm kubernetes-helm
]; ];
shell = pkgs.bash; shell = pkgs.bash;
}; };
users.groups.gitea-runner = { }; users.groups.gitea-runner = { };
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d /data/runner 0755 gitea-runner gitea-runner -" "d /data/runner 0755 gitea-runner gitea-runner -"
"f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -" "f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
"d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -" "d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -"
"d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -" "d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -"
]; ];
# Completely override the service to run as a simple user process # Override only the sandboxing settings, keep ExecStart from the module
systemd.services.gitea-runner-infrastructure.serviceConfig = lib.mkForce { systemd.services.gitea-runner-infrastructure.serviceConfig = {
Type = "simple"; # Keep the working directory
User = "gitea-runner"; WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
Group = "gitea-runner";
WorkingDirectory = "/var/lib/gitea-runner/infrastructure";
Restart = "always";
RestartSec = "5s";
# No sandboxing - inherit everything from the system # Override user/group
PrivateTmp = false; User = lib.mkForce "gitea-runner";
ProtectSystem = false; Group = lib.mkForce "gitea-runner";
ProtectHome = false;
NoNewPrivileges = false; # Remove ALL sandboxing - run as a normal user process
}; DynamicUser = lib.mkForce false;
PrivateDevices = lib.mkForce false;
PrivateMounts = lib.mkForce false;
PrivateTmp = lib.mkForce false;
PrivateUsers = lib.mkForce false;
ProtectClock = lib.mkForce false;
ProtectControlGroups = lib.mkForce false;
ProtectHome = lib.mkForce false;
ProtectHostname = lib.mkForce false;
ProtectKernelLogs = lib.mkForce false;
ProtectKernelModules = lib.mkForce false;
ProtectKernelTunables = lib.mkForce false;
ProtectProc = lib.mkForce "default";
ProtectSystem = lib.mkForce false;
NoNewPrivileges = lib.mkForce false;
RestrictNamespaces = lib.mkForce false;
RestrictRealtime = lib.mkForce false;
RestrictSUIDSGID = lib.mkForce false;
RemoveIPC = lib.mkForce false;
LockPersonality = lib.mkForce false;
SystemCallFilter = lib.mkForce [ ];
RestrictAddressFamilies = lib.mkForce [ ];
ReadWritePaths = lib.mkForce [ ];
BindReadOnlyPaths = lib.mkForce [ ];
# Allow access to devices
DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
DevicePolicy = lib.mkForce "auto";
Restart = lib.mkForce "always";
};
} }