workflow

.gitea/workflows/apply-kubernetes.yml

@@ -11,9 +11,9 @@ jobs:
             cd infrastructure
             echo "Infrastructure folder exists. Resetting to the most recent commit."
             git reset --hard HEAD
-              git pull https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }} $(git rev-parse --abbrev-ref HEAD)
+            git pull https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.alexmickelson.guru/${{ gitea.repository }} $(git rev-parse --abbrev-ref HEAD)
           else
-            git clone https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git
+            git clone https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.alexmickelson.guru/${{ gitea.repository }}.git
           fi
   update-infrastructure:
     runs-on: home-server

nix/home-server.nix

@@ -7,6 +7,7 @@
       <home-manager/nixos>
       ./modules/k3s.nix
       ./modules/pci-passthrough.nix
+      ./modules/gitea-runner.nix
     ];
   security.pam.loginLimits = [
     {
@@ -288,72 +289,6 @@
     };
   };
   
-  services.gitea-actions-runner = {
-    instances.infrastructure = {
-      enable = true;
-      name = "infrastructure-runner";
-      url = "https://git.alexmickelson.guru";
-      tokenFile = "/data/runner/gitea-infrastructure-token.txt";
-      labels = [
-        "home-server"
-        "native:host"
-      ];
-      hostPackages = with pkgs; [
-        bashNonInteractive
-        bash
-        coreutils
-        docker
-        git
-        git-secret
-        zfs
-        sanoid
-        mbuffer
-        lzop
-        kubectl
-        kubernetes-helm
-      ];
-
-      settings = {
-        container = { enabled = false; };
-      };
-    };
-  };
-
-  environment.pathsToLink = [
-    "/bin"
-  ];
-  systemd.services.gitea-runner-infrastructure.serviceConfig = {
-    ReadWritePaths = [
-      "/data/cloudflare/"
-      "/data/runner/infrastructure"
-      "/data/runner"
-      "/home/github/infrastructure"
-    ];
-
-    PrivateDevices = false;
-    DeviceAllow = [ "/dev/zfs rw" ];
-
-    ProtectProc = "default";
-    ProtectSystem = false;
-    PrivateMounts = false;
-    PrivateUsers = false;
-    ProtectHome = false;
-
-    Restart = lib.mkForce "always";
-  };
-  users.users.gitea-runner = {
-    isNormalUser = true;
-    description = "Gitea Actions Runner";
-    home = "/home/gitea-runner";
-    createHome = true;
-    extraGroups = [ "docker" ];
-    packages = with pkgs; [
-      kubernetes-helm
-    ];
-    shell = pkgs.bash;
-  };
-
-  
   networking.firewall.enable = false;
 
   # This value determines the NixOS release from which the default

nix/modules/gitea-runner.nix

@@ -0,0 +1,103 @@
+{ pkgs, lib, ... }:
+{
+  services.gitea-actions-runner = {
+    instances.infrastructure = {
+      enable = true;
+      name = "infrastructure-runner";
+      url = "https://git.alexmickelson.guru";
+      tokenFile = "/data/runner/gitea-infrastructure-token.txt";
+      labels = [
+        "home-server"
+        "native:host"
+      ];
+      hostPackages = with pkgs; [
+        bashNonInteractive
+        bash
+        coreutils
+        docker
+        git
+        git-secret
+        zfs
+        sanoid
+        mbuffer
+        lzop
+        kubectl
+        kubernetes-helm
+      ];
+      settings = {
+        container = { enabled = false; };
+      };
+    };
+  };
+
+  environment.pathsToLink = [
+    "/bin"
+  ];
+
+  users.users.gitea-runner = {
+    isNormalUser = true;
+    description = "Gitea Actions Runner";
+    home = "/home/gitea-runner";
+    createHome = true;
+    group = "gitea-runner";
+    extraGroups = [ "docker" ];
+    packages = with pkgs; [
+      kubernetes-helm
+    ];
+    shell = pkgs.bash;
+  };
+
+  users.groups.gitea-runner = { };
+
+  systemd.tmpfiles.rules = [
+    "d /data/runner 0755 gitea-runner gitea-runner -"
+    "f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
+  ];
+
+  systemd.services.gitea-runner-infrastructure.serviceConfig = {
+    # Use the actual location where the module creates the .runner file
+    WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
+    
+    ReadWritePaths = lib.mkForce [ 
+      "/var/lib/gitea-runner"
+      "/data/cloudflare/"
+      "/data/runner/infrastructure"
+      "/data/runner"
+      "/home/github/infrastructure"
+    ];
+    BindReadOnlyPaths = [
+      "/nix/store"
+    ];
+    # Disable all sandboxing features
+    DynamicUser = lib.mkForce false;
+    PrivateDevices = lib.mkForce false;
+    PrivateMounts = lib.mkForce false;
+    PrivateTmp = lib.mkForce false;
+    PrivateUsers = lib.mkForce false;
+    ProtectClock = lib.mkForce false;
+    ProtectControlGroups = lib.mkForce false;
+    ProtectHome = lib.mkForce false;
+    ProtectHostname = lib.mkForce false;
+    ProtectKernelLogs = lib.mkForce false;
+    ProtectKernelModules = lib.mkForce false;
+    ProtectKernelTunables = lib.mkForce false;
+    ProtectProc = lib.mkForce "default";
+    ProtectSystem = lib.mkForce false;
+    NoNewPrivileges = lib.mkForce false;
+    RestrictNamespaces = lib.mkForce false;
+    RestrictRealtime = lib.mkForce false;
+    RestrictSUIDSGID = lib.mkForce false;
+    RemoveIPC = lib.mkForce false;
+    LockPersonality = lib.mkForce false;
+    SystemCallFilter = lib.mkForce [ ];
+    RestrictAddressFamilies = lib.mkForce [ ];
+    
+    User = lib.mkForce "gitea-runner";
+    Group = lib.mkForce "gitea-runner";
+    
+    DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
+    DevicePolicy = lib.mkForce "auto";
+    
+    Restart = lib.mkForce "always";
+  };
+}