split out repo

.gitea/workflows/apply-kubernetes.yml

@@ -1,36 +1,11 @@
 name: Apply Kuberentes Configs
 on: [push, workflow_dispatch]
 jobs:
-  test-environment:
-    runs-on: home-server
-    steps:
-      - name: test basic commands
-        run: |
-          echo "=== Environment Info ==="
-          whoami
-          pwd
-          echo "=== Test bash ==="
-          bash --version
-          echo "=== Test git ==="
-          git --version
-          echo "=== Success ==="
   update-repo:
-    runs-on: home-server
+    uses: ./.gitea/workflows/update-repo.yml
-    steps:
-      - name: checkout repo
-        working-directory: /home/gitea-runner
-        run: |
-          if [ -d "infrastructure" ]; then
-            cd infrastructure
-            echo "Infrastructure folder exists. Resetting to the most recent commit."
-            git reset --hard HEAD
-            git pull https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.alexmickelson.guru/${{ gitea.repository }} $(git rev-parse --abbrev-ref HEAD)
-          else
-            git clone https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.alexmickelson.guru/${{ gitea.repository }}.git
-          fi
   update-infrastructure:
     runs-on: home-server
-    needs: update-repo
+    needs: update-repo-folder
     steps:
       - name: update home server containers
         env:

.gitea/workflows/update-repo.yml

@@ -0,0 +1,19 @@
+name: Update Repository
+on:
+  workflow_call:
+
+jobs:
+  update-repo-folder:
+    runs-on: home-server
+    steps:
+      - name: checkout repo
+        working-directory: /home/gitea-runner
+        run: |
+          if [ -d "infrastructure" ]; then
+            cd infrastructure
+            echo "Infrastructure folder exists. Resetting to the most recent commit."
+            git reset --hard HEAD
+            git pull https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.alexmickelson.guru/${{ gitea.repository }} $(git rev-parse --abbrev-ref HEAD)
+          else
+            git clone https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.alexmickelson.guru/${{ gitea.repository }}.git
+          fi

nix/modules/gitea-runner.nix

@@ -32,10 +32,6 @@
     };
   };
 
-environment.pathsToLink = [
-  "/bin"
-];
-
   users.users.gitea-runner = {
     isNormalUser = true;
     description = "Gitea Actions Runner";
@@ -51,23 +47,12 @@ users.users.gitea-runner = {
 
   users.groups.gitea-runner = { };
 
-systemd.tmpfiles.rules = [
-  "d /data/runner 0755 gitea-runner gitea-runner -"
-  "f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
-  "d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -"
-  "d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -"
-];
-
-# Override only the sandboxing settings, keep ExecStart from the module
   systemd.services.gitea-runner-infrastructure.serviceConfig = {
-  # Keep the working directory
     WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
     
-  # Override user/group
     User = lib.mkForce "gitea-runner";
     Group = lib.mkForce "gitea-runner";
     
-  # Remove ALL sandboxing - run as a normal user process
     DynamicUser = lib.mkForce false;
     PrivateDevices = lib.mkForce false;
     PrivateMounts = lib.mkForce false;
@@ -93,7 +78,6 @@ systemd.services.gitea-runner-infrastructure.serviceConfig = {
     ReadWritePaths = lib.mkForce [ ];
     BindReadOnlyPaths = lib.mkForce [ ];
     
-  # Allow access to devices
     DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
     DevicePolicy = lib.mkForce "auto";