gitea runner

nix/modules/gitea-runner.nix

@@ -58,19 +58,45 @@
   "d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -"
 ];
 
-  # Completely override the service to run as a simple user process
-  systemd.services.gitea-runner-infrastructure.serviceConfig = lib.mkForce {
-    Type = "simple";
-    User = "gitea-runner";
-    Group = "gitea-runner";
-    WorkingDirectory = "/var/lib/gitea-runner/infrastructure";
-    Restart = "always";
-    RestartSec = "5s";
+# Override only the sandboxing settings, keep ExecStart from the module
+systemd.services.gitea-runner-infrastructure.serviceConfig = {
+  # Keep the working directory
+  WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
   
-    # No sandboxing - inherit everything from the system
-    PrivateTmp = false;
-    ProtectSystem = false;
-    ProtectHome = false;
-    NoNewPrivileges = false;
+  # Override user/group
+  User = lib.mkForce "gitea-runner";
+  Group = lib.mkForce "gitea-runner";
+  
+  # Remove ALL sandboxing - run as a normal user process
+  DynamicUser = lib.mkForce false;
+  PrivateDevices = lib.mkForce false;
+  PrivateMounts = lib.mkForce false;
+  PrivateTmp = lib.mkForce false;
+  PrivateUsers = lib.mkForce false;
+  ProtectClock = lib.mkForce false;
+  ProtectControlGroups = lib.mkForce false;
+  ProtectHome = lib.mkForce false;
+  ProtectHostname = lib.mkForce false;
+  ProtectKernelLogs = lib.mkForce false;
+  ProtectKernelModules = lib.mkForce false;
+  ProtectKernelTunables = lib.mkForce false;
+  ProtectProc = lib.mkForce "default";
+  ProtectSystem = lib.mkForce false;
+  NoNewPrivileges = lib.mkForce false;
+  RestrictNamespaces = lib.mkForce false;
+  RestrictRealtime = lib.mkForce false;
+  RestrictSUIDSGID = lib.mkForce false;
+  RemoveIPC = lib.mkForce false;
+  LockPersonality = lib.mkForce false;
+  SystemCallFilter = lib.mkForce [ ];
+  RestrictAddressFamilies = lib.mkForce [ ];
+  ReadWritePaths = lib.mkForce [ ];
+  BindReadOnlyPaths = lib.mkForce [ ];
+  
+  # Allow access to devices
+  DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
+  DevicePolicy = lib.mkForce "auto";
+  
+  Restart = lib.mkForce "always";
 };
 }