environment

.gitea/workflows/apply-kubernetes.yml

@@ -1,6 +1,19 @@
 name: Apply Kuberentes Configs
 on: [push, workflow_dispatch]
 jobs:
+  test-environment:
+    runs-on: home-server
+    steps:
+      - name: test basic commands
+        run: |
+          echo "=== Environment Info ==="
+          whoami
+          pwd
+          echo "=== Test bash ==="
+          bash --version
+          echo "=== Test git ==="
+          git --version
+          echo "=== Success ==="
   update-repo:
     runs-on: home-server
     steps:

nix/modules/gitea-runner.nix

@@ -1,103 +1,102 @@
 { pkgs, lib, ... }:
 {
   services.gitea-actions-runner = {
-    instances.infrastructure = {
+  instances.infrastructure = {
-      enable = true;
+    enable = true;
-      name = "infrastructure-runner";
+    name = "infrastructure-runner";
-      url = "https://git.alexmickelson.guru";
+    url = "https://git.alexmickelson.guru";
-      tokenFile = "/data/runner/gitea-infrastructure-token.txt";
+    tokenFile = "/data/runner/gitea-infrastructure-token.txt";
-      labels = [
+    labels = [
-        "home-server"
+      "home-server:host"
-        "native:host"
+      "native:host"
-      ];
+    ];
-      hostPackages = with pkgs; [
+    hostPackages = with pkgs; [
-        bashNonInteractive
+      bashNonInteractive
-        bash
+      bash
-        coreutils
+      coreutils
-        docker
+      docker
-        git
+      git
-        git-secret
+      git-secret
-        zfs
+      zfs
-        sanoid
+      sanoid
-        mbuffer
+      mbuffer
-        lzop
+      lzop
-        kubectl
+      kubectl
-        kubernetes-helm
+      kubernetes-helm
-      ];
+    ];
-      settings = {
+    settings = {
-        container = { enabled = false; };
+      container = { 
+        enabled = false;
       };
     };
   };
+};
 
-  environment.pathsToLink = [
+environment.pathsToLink = [
-    "/bin"
+  "/bin"
+];
+
+users.users.gitea-runner = {
+  isNormalUser = true;
+  description = "Gitea Actions Runner";
+  home = "/home/gitea-runner";
+  createHome = true;
+  group = "gitea-runner";
+  extraGroups = [ "docker" ];
+  packages = with pkgs; [
+    kubernetes-helm
   ];
+  shell = pkgs.bash;
+};
 
-  users.users.gitea-runner = {
+users.groups.gitea-runner = { };
-    isNormalUser = true;
-    description = "Gitea Actions Runner";
-    home = "/home/gitea-runner";
-    createHome = true;
-    group = "gitea-runner";
-    extraGroups = [ "docker" ];
-    packages = with pkgs; [
-      kubernetes-helm
-    ];
-    shell = pkgs.bash;
-  };
 
-  users.groups.gitea-runner = { };
+systemd.tmpfiles.rules = [
+  "d /data/runner 0755 gitea-runner gitea-runner -"
+  "f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
+  "d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -"
+  "d /var/lib/gitea-runner/infrastructure 0755 gitea-runner gitea-runner -"
+];
 
-  systemd.tmpfiles.rules = [
+# Override only the sandboxing settings, keep ExecStart from the module
-    "d /data/runner 0755 gitea-runner gitea-runner -"
+systemd.services.gitea-runner-infrastructure.serviceConfig = {
-    "f /data/runner/gitea-infrastructure-token.txt 0600 gitea-runner gitea-runner -"
+  # Keep the working directory
-  ];
+  WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
-
+  
-  systemd.services.gitea-runner-infrastructure.serviceConfig = {
+  # Override user/group
-    # Use the actual location where the module creates the .runner file
+  User = lib.mkForce "gitea-runner";
-    WorkingDirectory = lib.mkForce "/var/lib/gitea-runner/infrastructure";
+  Group = lib.mkForce "gitea-runner";
-    
+  
-    ReadWritePaths = lib.mkForce [ 
+  # Remove ALL sandboxing - run as a normal user process
-      "/var/lib/gitea-runner"
+  DynamicUser = lib.mkForce false;
-      "/data/cloudflare/"
+  PrivateDevices = lib.mkForce false;
-      "/data/runner/infrastructure"
+  PrivateMounts = lib.mkForce false;
-      "/data/runner"
+  PrivateTmp = lib.mkForce false;
-      "/home/github/infrastructure"
+  PrivateUsers = lib.mkForce false;
-    ];
+  ProtectClock = lib.mkForce false;
-    BindReadOnlyPaths = [
+  ProtectControlGroups = lib.mkForce false;
-      "/nix/store"
+  ProtectHome = lib.mkForce false;
-    ];
+  ProtectHostname = lib.mkForce false;
-    # Disable all sandboxing features
+  ProtectKernelLogs = lib.mkForce false;
-    DynamicUser = lib.mkForce false;
+  ProtectKernelModules = lib.mkForce false;
-    PrivateDevices = lib.mkForce false;
+  ProtectKernelTunables = lib.mkForce false;
-    PrivateMounts = lib.mkForce false;
+  ProtectProc = lib.mkForce "default";
-    PrivateTmp = lib.mkForce false;
+  ProtectSystem = lib.mkForce false;
-    PrivateUsers = lib.mkForce false;
+  NoNewPrivileges = lib.mkForce false;
-    ProtectClock = lib.mkForce false;
+  RestrictNamespaces = lib.mkForce false;
-    ProtectControlGroups = lib.mkForce false;
+  RestrictRealtime = lib.mkForce false;
-    ProtectHome = lib.mkForce false;
+  RestrictSUIDSGID = lib.mkForce false;
-    ProtectHostname = lib.mkForce false;
+  RemoveIPC = lib.mkForce false;
-    ProtectKernelLogs = lib.mkForce false;
+  LockPersonality = lib.mkForce false;
-    ProtectKernelModules = lib.mkForce false;
+  SystemCallFilter = lib.mkForce [ ];
-    ProtectKernelTunables = lib.mkForce false;
+  RestrictAddressFamilies = lib.mkForce [ ];
-    ProtectProc = lib.mkForce "default";
+  ReadWritePaths = lib.mkForce [ ];
-    ProtectSystem = lib.mkForce false;
+  BindReadOnlyPaths = lib.mkForce [ ];
-    NoNewPrivileges = lib.mkForce false;
+  
-    RestrictNamespaces = lib.mkForce false;
+  # Allow access to devices
-    RestrictRealtime = lib.mkForce false;
+  DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
-    RestrictSUIDSGID = lib.mkForce false;
+  DevicePolicy = lib.mkForce "auto";
-    RemoveIPC = lib.mkForce false;
+  
-    LockPersonality = lib.mkForce false;
+  Restart = lib.mkForce "always";
-    SystemCallFilter = lib.mkForce [ ];
+};
-    RestrictAddressFamilies = lib.mkForce [ ];
-    
-    User = lib.mkForce "gitea-runner";
-    Group = lib.mkForce "gitea-runner";
-    
-    DeviceAllow = lib.mkForce [ "/dev/zfs rw" ];
-    DevicePolicy = lib.mkForce "auto";
-    
-    Restart = lib.mkForce "always";
-  };
 }