builder: massive config cleanup, breakdown into modules, use disko

2026-07-19 12:29:39 +02:00
parent 76ad137946
commit 48d784a964
7 changed files with 276 additions and 207 deletions
@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.frajul.gitea-runner;
+in {
+  options = {
+    frajul.gitea-runner = {
+      enable = lib.mkEnableOption "gitea-runner";
+      secretsFile = lib.mkOption {
+        type = lib.types.path;
+        description = "A sops encrpyted file containing a 'gitea_token' secret";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.docker.enable = true;
+
+    sops.secrets."gitea_token" = {
+      owner = config.users.users.nix.name;
+      sopsFile = cfg.secretsFile;
+    };
+
+    services.gitea-actions-runner.instances."builder" = {
+      enable = true;
+      url = "https://gitlab.julian-mutter.de";
+      name = "builder";
+      tokenFile = config.sops.secrets."gitea_token".path;
+      labels = [
+        # fake the ubuntu name, because node provides no ubuntu builds
+        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        # my custom nix+devenv ci container
+        "nix-ci:docker://gitlab.julian-mutter.de/julian/nix-ci-container:latest"
+        # devenv
+        "devenv:docker://ghcr.io/cachix/devenv/devenv:latest"
+        # provide native execution on the host
+        "nixos:host"
+      ];
+      # Packages are intjected into PATH for "nixos:host"
+      hostPackages = with pkgs; [
+        bash
+        coreutils
+        curl
+        gawk
+        gitMinimal
+        nodejs # Required by many standard actions (like actions/checkout)
+        docker
+        devenv
+        wget
+        nix
+      ];
+    };
+  };
+}
@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.frajul.gitlab-runner;
+in {
+  options = {
+    frajul.gitlab-runner = {
+      enable = lib.mkEnableOption "gitlab-runner";
+      secretsFile = lib.mkOption {
+        type = lib.types.path;
+        description = "A sops encrpyted file containing a 'gitlab_runner_token' secret";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.gitlab-runner.enable = true;
+
+    sops.secrets."gitlab_runner_token".sopsFile = cfg.secretsFile;
+    services.gitlab-runner.services.default = {
+      # File should contain at least these two variables:
+      authenticationTokenConfigFile = config.sops.secrets."gitlab_runner_token".path;
+      dockerImage = "alpine:latest";
+      dockerVolumes = [
+        "/var/run/docker.sock:/var/run/docker.sock"
+      ];
+    };
+  };
+}