split out repo

.gitea/workflows/apply-kubernetes.yml

@@ -1,36 +1,11 @@
 name: Apply Kuberentes Configs
 on: [push, workflow_dispatch]
 jobs:
-  test-environment:
-    runs-on: home-server
-    steps:
-      - name: test basic commands
-        run: |
-          echo "=== Environment Info ==="
-          whoami
-          pwd
-          echo "=== Test bash ==="
-          bash --version
-          echo "=== Test git ==="
-          git --version
-          echo "=== Success ==="
   update-repo:
-    runs-on: home-server
+    uses: ./.gitea/workflows/update-repo.yml
-    steps:
-      - name: checkout repo
-        working-directory: /home/gitea-runner
-        run: |
-          if [ -d "infrastructure" ]; then
-            cd infrastructure
-            echo "Infrastructure folder exists. Resetting to the most recent commit."
-            git reset --hard HEAD
-            git pull https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.alexmickelson.guru/${{ gitea.repository }} $(git rev-parse --abbrev-ref HEAD)
-          else
-            git clone https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.alexmickelson.guru/${{ gitea.repository }}.git
-          fi
   update-infrastructure:
     runs-on: home-server
-    needs: update-repo
+    needs: update-repo-folder
     steps:
       - name: update home server containers
         env:

.gitea/workflows/update-repo.yml

@@ -0,0 +1,19 @@
+name: Update Repository
+on:
+  workflow_call:
+
+jobs:
+  update-repo-folder:
+    runs-on: home-server
+    steps:
+      - name: checkout repo
+        working-directory: /home/gitea-runner
+        run: |
+          if [ -d "infrastructure" ]; then
+            cd infrastructure
+            echo "Infrastructure folder exists. Resetting to the most recent commit."
+            git reset --hard HEAD
+            git pull https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.alexmickelson.guru/${{ gitea.repository }} $(git rev-parse --abbrev-ref HEAD)
+          else
+            git clone https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.alexmickelson.guru/${{ gitea.repository }}.git
+          fi

nix/modules/gitea-runner.nix

@@ -1,102 +1,86 @@
 { pkgs, lib, ... }:
 {
   services.gitea-actions-runner = {
-  instances.infrastructure = {
+    instances.infrastructure = {
-    enable = true;
+      enable = true;
-    name = "infrastructure-runner";
+      name = "infrastructure-runner";
-    url = "https://git.alexmickelson.guru";
+      url = "https://git.alexmickelson.guru";
-    tokenFile = "/data/runner/gitea-infrastructure-token.txt";
+      tokenFile = "/data/runner/gitea-infrastructure-token.txt";
-    labels = [
+      labels = [
-      "home-server:host"
+        "home-server:host"
-      "native:host"
+        "native:host"
-    ];
+      ];
-    hostPackages = with pkgs; [
+      hostPackages = with pkgs; [
-      bashNonInteractive
+        bashNonInteractive
-      bash
+        bash
-      coreutils
+        coreutils
-      docker
+        docker
-      git
+        git
-      git-secret
+        git-secret
-      zfs
+        zfs
-      sanoid
+        sanoid
-      mbuffer
+        mbuffer
-      lzop
+        lzop
-      kubectl
+        kubectl
-      kubernetes-helm
+        kubernetes-helm
-    ];
+      ];
-    settings = {
+      settings = {
-      container = { 
+        container = { 
-        enabled = false;
+          enabled = false;
+        };
       };
     };
   };
-};
 
-environment.pathsToLink = [
+  users.users.gitea-runner = {
-  "/bin"
+    isNormalUser = true;
-];
+    description = "Gitea Actions Runner";
+    home = "/home/gitea-runner";
+    createHome = true;
+    group = "gitea-runner";
+    extraGroups = [ "docker" ];
+    packages = with pkgs; [
+      kubernetes-helm
+    ];
+    shell = pkgs.bash;
+  };
 
-users.users.gitea-runner = {
+  users.groups.gitea-runner = { };
-  isNormalUser = true;
-  description = "Gitea Actions Runner";
-  home = "/home/gitea-runner";
-  createHome = true;
-  group = "gitea-runner";
-  extraGroups = [ "docker" ];
-  packages = with pkgs; [
-    kubernetes-helm
-  ];
-  shell = pkgs.bash;
-};
 
-users.groups.gitea-runner = { };
+  systemd.services.gitea-runner-infrastructure.serviceConfig = {
-
+    WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
-systemd.tmpfiles.rules = [
+    
-  "d /data/runner 0755 gitea-runner gitea-runner -"
+    User = lib.mkForce "gitea-runner";
-  "f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
+    Group = lib.mkForce "gitea-runner";
-  "d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -"
+    
-  "d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -"
+    DynamicUser = lib.mkForce false;
-];
+    PrivateDevices = lib.mkForce false;
-
+    PrivateMounts = lib.mkForce false;
-# Override only the sandboxing settings, keep ExecStart from the module
+    PrivateTmp = lib.mkForce false;
-systemd.services.gitea-runner-infrastructure.serviceConfig = {
+    PrivateUsers = lib.mkForce false;
-  # Keep the working directory
+    ProtectClock = lib.mkForce false;
-  WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
+    ProtectControlGroups = lib.mkForce false;
-  
+    ProtectHome = lib.mkForce false;
-  # Override user/group
+    ProtectHostname = lib.mkForce false;
-  User = lib.mkForce "gitea-runner";
+    ProtectKernelLogs = lib.mkForce false;
-  Group = lib.mkForce "gitea-runner";
+    ProtectKernelModules = lib.mkForce false;
-  
+    ProtectKernelTunables = lib.mkForce false;
-  # Remove ALL sandboxing - run as a normal user process
+    ProtectProc = lib.mkForce "default";
-  DynamicUser = lib.mkForce false;
+    ProtectSystem = lib.mkForce false;
-  PrivateDevices = lib.mkForce false;
+    NoNewPrivileges = lib.mkForce false;
-  PrivateMounts = lib.mkForce false;
+    RestrictNamespaces = lib.mkForce false;
-  PrivateTmp = lib.mkForce false;
+    RestrictRealtime = lib.mkForce false;
-  PrivateUsers = lib.mkForce false;
+    RestrictSUIDSGID = lib.mkForce false;
-  ProtectClock = lib.mkForce false;
+    RemoveIPC = lib.mkForce false;
-  ProtectControlGroups = lib.mkForce false;
+    LockPersonality = lib.mkForce false;
-  ProtectHome = lib.mkForce false;
+    SystemCallFilter = lib.mkForce [ ];
-  ProtectHostname = lib.mkForce false;
+    RestrictAddressFamilies = lib.mkForce [ ];
-  ProtectKernelLogs = lib.mkForce false;
+    ReadWritePaths = lib.mkForce [ ];
-  ProtectKernelModules = lib.mkForce false;
+    BindReadOnlyPaths = lib.mkForce [ ];
-  ProtectKernelTunables = lib.mkForce false;
+    
-  ProtectProc = lib.mkForce "default";
+    DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
-  ProtectSystem = lib.mkForce false;
+    DevicePolicy = lib.mkForce "auto";
-  NoNewPrivileges = lib.mkForce false;
+    
-  RestrictNamespaces = lib.mkForce false;
+    Restart = lib.mkForce "always";
-  RestrictRealtime = lib.mkForce false;
+  };
-  RestrictSUIDSGID = lib.mkForce false;
-  RemoveIPC = lib.mkForce false;
-  LockPersonality = lib.mkForce false;
-  SystemCallFilter = lib.mkForce [ ];
-  RestrictAddressFamilies = lib.mkForce [ ];
-  ReadWritePaths = lib.mkForce [ ];
-  BindReadOnlyPaths = lib.mkForce [ ];
-  
-  # Allow access to devices
-  DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
-  DevicePolicy = lib.mkForce "auto";
-  
-  Restart = lib.mkForce "always";
-};
 }