alex/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

simplify

Browse Source
This commit is contained in:
Alex Mickelson
2026-02-07 14:42:07 -07:00
parent 7e30a419db
commit ac3c221711
1 changed files with 76 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
nix/modules/gitea-runner.nix
View File

@@ -30,13 +30,9 @@
}; };
}; };
}; };
}; };
environment.pathsToLink = [ users.users.gitea-runner = {
"/bin"
];
users.users.gitea-runner = {
isNormalUser = true; isNormalUser = true;
description = "Gitea Actions Runner"; description = "Gitea Actions Runner";
home = "/home/gitea-runner"; home = "/home/gitea-runner";
@@ -47,27 +43,16 @@ users.users.gitea-runner = {
kubernetes-helm kubernetes-helm
]; ];
shell = pkgs.bash; shell = pkgs.bash;
}; };
users.groups.gitea-runner = { }; users.groups.gitea-runner = { };
systemd.tmpfiles.rules = [ systemd.services.gitea-runner-infrastructure.serviceConfig = {
"d /data/runner 0755 gitea-runner gitea-runner -"
"f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
"d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -"
"d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -"
];
# Override only the sandboxing settings, keep ExecStart from the module
systemd.services.gitea-runner-infrastructure.serviceConfig = {
# Keep the working directory
WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure"; WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
# Override user/group
User = lib.mkForce "gitea-runner"; User = lib.mkForce "gitea-runner";
Group = lib.mkForce "gitea-runner"; Group = lib.mkForce "gitea-runner";
# Remove ALL sandboxing - run as a normal user process
DynamicUser = lib.mkForce false; DynamicUser = lib.mkForce false;
PrivateDevices = lib.mkForce false; PrivateDevices = lib.mkForce false;
PrivateMounts = lib.mkForce false; PrivateMounts = lib.mkForce false;
@@ -93,10 +78,9 @@ systemd.services.gitea-runner-infrastructure.serviceConfig = {
ReadWritePaths = lib.mkForce [ ]; ReadWritePaths = lib.mkForce [ ];
BindReadOnlyPaths = lib.mkForce [ ]; BindReadOnlyPaths = lib.mkForce [ ];
# Allow access to devices
DeviceAllow = lib.mkForce [ "/dev/zfs rw" ]; DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
DevicePolicy = lib.mkForce "auto"; DevicePolicy = lib.mkForce "auto";
Restart = lib.mkForce "always"; Restart = lib.mkForce "always";
}; };
} }