alex/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gitea runner

Browse Source
This commit is contained in:
Alex Mickelson
2026-02-07 14:08:10 -07:00
parent 91e94da379
commit 78bf6e2cce
1 changed files with 16 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

78
nix/modules/gitea-runner.nix
View File

@@ -7,7 +7,7 @@
url = "https://git.alexmickelson.guru"; url = "https://git.alexmickelson.guru";
tokenFile = "/data/runner/gitea-infrastructure-token.txt"; tokenFile = "/data/runner/gitea-infrastructure-token.txt";
labels = [ labels = [
"home-server:host" # Changed from just "home-server" "home-server:host"
"native:host" "native:host"
]; ];
hostPackages = with pkgs; [ hostPackages = with pkgs; [
@@ -28,10 +28,6 @@
container = { container = {
enabled = false; enabled = false;
}; };
# Add explicit host settings
host = {
workdir_parent = "/var/lib/gitea-runner/infrastructure";
};
}; };
}; };
}; };
@@ -58,65 +54,23 @@
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d /data/runner 0755 gitea-runner gitea-runner -" "d /data/runner 0755 gitea-runner gitea-runner -"
"f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -" "f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
"d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -"
"d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -"
]; ];
systemd.services.gitea-runner-infrastructure.serviceConfig = { # Completely override the service to run as a simple user process
WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure"; systemd.services.gitea-runner-infrastructure.serviceConfig = lib.mkForce {
Type = "simple";
User = "gitea-runner";
Group = "gitea-runner";
WorkingDirectory = "/var/lib/gitea-runner/infrastructure";
Restart = "always";
RestartSec = "5s";
ReadWritePaths = lib.mkForce [ # No sandboxing - inherit everything from the system
"/var/lib/gitea-runner" PrivateTmp = false;
"/data/cloudflare/" ProtectSystem = false;
"/data/runner/infrastructure" ProtectHome = false;
"/data/runner" NoNewPrivileges = false;
"/home/github/infrastructure"
];
# CRITICAL: Allow the runner to create child processes without namespace restrictions
BindReadOnlyPaths = lib.mkForce [
"/nix/store"
"/nix/var"
"/run/current-system"
];
# Completely disable mount namespace isolation
PrivateMounts = lib.mkForce false;
MountFlags = lib.mkForce "shared"; # Share mounts with child processes
# Allow the runner process to use unshare/clone without restrictions
SystemCallFilter = lib.mkForce [ ];
RestrictNamespaces = lib.mkForce false;
# Give the runner CAP_SYS_ADMIN to create namespaces if needed, but inherit parent's
AmbientCapabilities = lib.mkForce [ "CAP_SYS_ADMIN" ];
CapabilityBoundingSet = lib.mkForce [ "CAP_SYS_ADMIN" ];
# Disable all other sandboxing features
DynamicUser = lib.mkForce false;
PrivateDevices = lib.mkForce false;
PrivateTmp = lib.mkForce false;
PrivateUsers = lib.mkForce false;
ProtectClock = lib.mkForce false;
ProtectControlGroups = lib.mkForce false;
ProtectHome = lib.mkForce false;
ProtectHostname = lib.mkForce false;
ProtectKernelLogs = lib.mkForce false;
ProtectKernelModules = lib.mkForce false;
ProtectKernelTunables = lib.mkForce false;
ProtectProc = lib.mkForce "default";
ProtectSystem = lib.mkForce false;
NoNewPrivileges = lib.mkForce false;
RestrictRealtime = lib.mkForce false;
RestrictSUIDSGID = lib.mkForce false;
RemoveIPC = lib.mkForce false;
LockPersonality = lib.mkForce false;
RestrictAddressFamilies = lib.mkForce [ ];
User = lib.mkForce "gitea-runner";
Group = lib.mkForce "gitea-runner";
DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
DevicePolicy = lib.mkForce "auto";
Restart = lib.mkForce "always";
}; };
} }