alex/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gitea runner

Browse Source
This commit is contained in:
Alex Mickelson
2026-02-07 14:10:20 -07:00
parent 78bf6e2cce
commit 6e9d586b9c
1 changed files with 90 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

154
nix/modules/gitea-runner.nix
View File

@@ -1,76 +1,102 @@
{ pkgs, lib, ... }: { pkgs, lib, ... }:
{ {
services.gitea-actions-runner = { services.gitea-actions-runner = {
instances.infrastructure = { instances.infrastructure = {
enable = true; enable = true;
name = "infrastructure-runner"; name = "infrastructure-runner";
url = "https://git.alexmickelson.guru"; url = "https://git.alexmickelson.guru";
tokenFile = "/data/runner/gitea-infrastructure-token.txt"; tokenFile = "/data/runner/gitea-infrastructure-token.txt";
labels = [ labels = [
"home-server:host" "home-server:host"
"native:host" "native:host"
]; ];
hostPackages = with pkgs; [ hostPackages = with pkgs; [
bashNonInteractive bashNonInteractive
bash bash
coreutils coreutils
docker docker
git git
git-secret git-secret
zfs zfs
sanoid sanoid
mbuffer mbuffer
lzop lzop
kubectl kubectl
kubernetes-helm kubernetes-helm
]; ];
settings = { settings = {
container = { container = {
enabled = false; enabled = false;
};
}; };
}; };
}; };
};
environment.pathsToLink = [ environment.pathsToLink = [
"/bin" "/bin"
];
users.users.gitea-runner = {
isNormalUser = true;
description = "Gitea Actions Runner";
home = "/home/gitea-runner";
createHome = true;
group = "gitea-runner";
extraGroups = [ "docker" ];
packages = with pkgs; [
kubernetes-helm
]; ];
shell = pkgs.bash;
};
users.users.gitea-runner = { users.groups.gitea-runner = { };
isNormalUser = true;
description = "Gitea Actions Runner";
home = "/home/gitea-runner";
createHome = true;
group = "gitea-runner";
extraGroups = [ "docker" ];
packages = with pkgs; [
kubernetes-helm
];
shell = pkgs.bash;
};
users.groups.gitea-runner = { }; systemd.tmpfiles.rules = [
"d /data/runner 0755 gitea-runner gitea-runner -"
"f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
"d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -"
"d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -"
];
systemd.tmpfiles.rules = [ # Override only the sandboxing settings, keep ExecStart from the module
"d /data/runner 0755 gitea-runner gitea-runner -" systemd.services.gitea-runner-infrastructure.serviceConfig = {
"f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -" # Keep the working directory
"d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -" WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
"d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -"
]; # Override user/group
User = lib.mkForce "gitea-runner";
# Completely override the service to run as a simple user process Group = lib.mkForce "gitea-runner";
systemd.services.gitea-runner-infrastructure.serviceConfig = lib.mkForce {
Type = "simple"; # Remove ALL sandboxing - run as a normal user process
User = "gitea-runner"; DynamicUser = lib.mkForce false;
Group = "gitea-runner"; PrivateDevices = lib.mkForce false;
WorkingDirectory = "/var/lib/gitea-runner/infrastructure"; PrivateMounts = lib.mkForce false;
Restart = "always"; PrivateTmp = lib.mkForce false;
RestartSec = "5s"; PrivateUsers = lib.mkForce false;
ProtectClock = lib.mkForce false;
# No sandboxing - inherit everything from the system ProtectControlGroups = lib.mkForce false;
PrivateTmp = false; ProtectHome = lib.mkForce false;
ProtectSystem = false; ProtectHostname = lib.mkForce false;
ProtectHome = false; ProtectKernelLogs = lib.mkForce false;
NoNewPrivileges = false; ProtectKernelModules = lib.mkForce false;
}; ProtectKernelTunables = lib.mkForce false;
ProtectProc = lib.mkForce "default";
ProtectSystem = lib.mkForce false;
NoNewPrivileges = lib.mkForce false;
RestrictNamespaces = lib.mkForce false;
RestrictRealtime = lib.mkForce false;
RestrictSUIDSGID = lib.mkForce false;
RemoveIPC = lib.mkForce false;
LockPersonality = lib.mkForce false;
SystemCallFilter = lib.mkForce [ ];
RestrictAddressFamilies = lib.mkForce [ ];
ReadWritePaths = lib.mkForce [ ];
BindReadOnlyPaths = lib.mkForce [ ];
# Allow access to devices
DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
DevicePolicy = lib.mkForce "auto";
Restart = lib.mkForce "always";
};
} }