environment

.gitea/workflows/apply-kubernetes.yml

@@ -1,6 +1,19 @@
 name: Apply Kuberentes Configs
 on: [push, workflow_dispatch]
 jobs:
+  test-environment:
+    runs-on: home-server
+    steps:
+      - name: test basic commands
+        run: |
+          echo "=== Environment Info ==="
+          whoami
+          pwd
+          echo "=== Test bash ==="
+          bash --version
+          echo "=== Test git ==="
+          git --version
+          echo "=== Success ==="
   update-repo:
     runs-on: home-server
     steps:

nix/modules/gitea-runner.nix

@@ -7,7 +7,7 @@
     url = "https://git.alexmickelson.guru";
     tokenFile = "/data/runner/gitea-infrastructure-token.txt";
     labels = [
-        "home-server"
+      "home-server:host"
       "native:host"
     ];
     hostPackages = with pkgs; [
@@ -25,16 +25,18 @@
       kubernetes-helm
     ];
     settings = {
-        container = { enabled = false; };
+      container = { 
+        enabled = false;
       };
     };
   };
+};
 
-  environment.pathsToLink = [
+environment.pathsToLink = [
   "/bin"
-  ];
+];
 
-  users.users.gitea-runner = {
+users.users.gitea-runner = {
   isNormalUser = true;
   description = "Gitea Actions Runner";
   home = "/home/gitea-runner";
@@ -45,30 +47,27 @@
     kubernetes-helm
   ];
   shell = pkgs.bash;
-  };
+};
 
-  users.groups.gitea-runner = { };
+users.groups.gitea-runner = { };
 
-  systemd.tmpfiles.rules = [
+systemd.tmpfiles.rules = [
   "d /data/runner 0755 gitea-runner gitea-runner -"
   "f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
-  ];
+  "d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -"
+  "d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -"
+];
 
-  systemd.services.gitea-runner-infrastructure.serviceConfig = {
+# Override only the sandboxing settings, keep ExecStart from the module
-    # Use the actual location where the module creates the .runner file
+systemd.services.gitea-runner-infrastructure.serviceConfig = {
+  # Keep the working directory
   WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
   
-    ReadWritePaths = lib.mkForce [ 
+  # Override user/group
-      "/var/lib/gitea-runner"
+  User = lib.mkForce "gitea-runner";
-      "/data/cloudflare/"
+  Group = lib.mkForce "gitea-runner";
-      "/data/runner/infrastructure"
+  
-      "/data/runner"
+  # Remove ALL sandboxing - run as a normal user process
-      "/home/github/infrastructure"
-    ];
-    BindReadOnlyPaths = [
-      "/nix/store"
-    ];
-    # Disable all sandboxing features
   DynamicUser = lib.mkForce false;
   PrivateDevices = lib.mkForce false;
   PrivateMounts = lib.mkForce false;
@@ -91,13 +90,13 @@
   LockPersonality = lib.mkForce false;
   SystemCallFilter = lib.mkForce [ ];
   RestrictAddressFamilies = lib.mkForce [ ];
+  ReadWritePaths = lib.mkForce [ ];
+  BindReadOnlyPaths = lib.mkForce [ ];
   
-    User = lib.mkForce "gitea-runner";
+  # Allow access to devices
-    Group = lib.mkForce "gitea-runner";
-    
   DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
   DevicePolicy = lib.mkForce "auto";
   
   Restart = lib.mkForce "always";
-  };
+};
 }