alex/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

simplify

Browse Source
This commit is contained in:
Alex Mickelson
2026-02-07 14:42:07 -07:00
parent 7e30a419db
commit ac3c221711
1 changed files with 76 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

160
nix/modules/gitea-runner.nix
View File

@@ -1,102 +1,86 @@
{ pkgs, lib, ... }: { pkgs, lib, ... }:
{ {
services.gitea-actions-runner = { services.gitea-actions-runner = {
instances.infrastructure = { instances.infrastructure = {
enable = true; enable = true;
name = "infrastructure-runner"; name = "infrastructure-runner";
url = "https://git.alexmickelson.guru"; url = "https://git.alexmickelson.guru";
tokenFile = "/data/runner/gitea-infrastructure-token.txt"; tokenFile = "/data/runner/gitea-infrastructure-token.txt";
labels = [ labels = [
"home-server:host" "home-server:host"
"native:host" "native:host"
]; ];
hostPackages = with pkgs; [ hostPackages = with pkgs; [
bashNonInteractive bashNonInteractive
bash bash
coreutils coreutils
docker docker
git git
git-secret git-secret
zfs zfs
sanoid sanoid
mbuffer mbuffer
lzop lzop
kubectl kubectl
kubernetes-helm kubernetes-helm
]; ];
settings = { settings = {
container = { container = {
enabled = false; enabled = false;
};
}; };
}; };
}; };
};
environment.pathsToLink = [ users.users.gitea-runner = {
"/bin" isNormalUser = true;
]; description = "Gitea Actions Runner";
home = "/home/gitea-runner";
createHome = true;
group = "gitea-runner";
extraGroups = [ "docker" ];
packages = with pkgs; [
kubernetes-helm
];
shell = pkgs.bash;
};
users.users.gitea-runner = { users.groups.gitea-runner = { };
isNormalUser = true;
description = "Gitea Actions Runner";
home = "/home/gitea-runner";
createHome = true;
group = "gitea-runner";
extraGroups = [ "docker" ];
packages = with pkgs; [
kubernetes-helm
];
shell = pkgs.bash;
};
users.groups.gitea-runner = { }; systemd.services.gitea-runner-infrastructure.serviceConfig = {
WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
systemd.tmpfiles.rules = [ User = lib.mkForce "gitea-runner";
"d /data/runner 0755 gitea-runner gitea-runner -" Group = lib.mkForce "gitea-runner";
"f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
"d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -"
"d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -"
];
# Override only the sandboxing settings, keep ExecStart from the module DynamicUser = lib.mkForce false;
systemd.services.gitea-runner-infrastructure.serviceConfig = { PrivateDevices = lib.mkForce false;
# Keep the working directory PrivateMounts = lib.mkForce false;
WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure"; PrivateTmp = lib.mkForce false;
PrivateUsers = lib.mkForce false;
ProtectClock = lib.mkForce false;
ProtectControlGroups = lib.mkForce false;
ProtectHome = lib.mkForce false;
ProtectHostname = lib.mkForce false;
ProtectKernelLogs = lib.mkForce false;
ProtectKernelModules = lib.mkForce false;
ProtectKernelTunables = lib.mkForce false;
ProtectProc = lib.mkForce "default";
ProtectSystem = lib.mkForce false;
NoNewPrivileges = lib.mkForce false;
RestrictNamespaces = lib.mkForce false;
RestrictRealtime = lib.mkForce false;
RestrictSUIDSGID = lib.mkForce false;
RemoveIPC = lib.mkForce false;
LockPersonality = lib.mkForce false;
SystemCallFilter = lib.mkForce [ ];
RestrictAddressFamilies = lib.mkForce [ ];
ReadWritePaths = lib.mkForce [ ];
BindReadOnlyPaths = lib.mkForce [ ];
# Override user/group DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
User = lib.mkForce "gitea-runner"; DevicePolicy = lib.mkForce "auto";
Group = lib.mkForce "gitea-runner";
# Remove ALL sandboxing - run as a normal user process Restart = lib.mkForce "always";
DynamicUser = lib.mkForce false; };
PrivateDevices = lib.mkForce false;
PrivateMounts = lib.mkForce false;
PrivateTmp = lib.mkForce false;
PrivateUsers = lib.mkForce false;
ProtectClock = lib.mkForce false;
ProtectControlGroups = lib.mkForce false;
ProtectHome = lib.mkForce false;
ProtectHostname = lib.mkForce false;
ProtectKernelLogs = lib.mkForce false;
ProtectKernelModules = lib.mkForce false;
ProtectKernelTunables = lib.mkForce false;
ProtectProc = lib.mkForce "default";
ProtectSystem = lib.mkForce false;
NoNewPrivileges = lib.mkForce false;
RestrictNamespaces = lib.mkForce false;
RestrictRealtime = lib.mkForce false;
RestrictSUIDSGID = lib.mkForce false;
RemoveIPC = lib.mkForce false;
LockPersonality = lib.mkForce false;
SystemCallFilter = lib.mkForce [ ];
RestrictAddressFamilies = lib.mkForce [ ];
ReadWritePaths = lib.mkForce [ ];
BindReadOnlyPaths = lib.mkForce [ ];
# Allow access to devices
DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
DevicePolicy = lib.mkForce "auto";
Restart = lib.mkForce "always";
};
} }