phfroidmont/self-hosting
1
0
Fork 0
mirror of https://github.com/phfroidmont/self-hosting.git synced 2025-12-25 05:36:59 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update inputs to fix OpenSSH CVE-2024-6387

Browse source
This commit is contained in:
Paul-Henri Froidmont 2024-07-02 18:16:26 +02:00
parent 781d6dcfac
commit 053fd23097
Signed by: phfroidmont
GPG key ID: BE948AFD7E7873BE
8 changed files with 118 additions and 120 deletions
Download patch file Download diff file Expand all files Collapse all files

90
modules/gitlab-runner.nix
View file

@ -1,9 +1,7 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.custom.services.gitlab-runner;
in
{
let cfg = config.custom.services.gitlab-runner;
in {
options.custom.services.gitlab-runner = {
enable = mkEnableOption "gitlab-runner";
};
@ -35,58 +33,52 @@ in
};
};
config =
let
hostConfig = config;
in
args@{ config, ... }: {
config = let hostConfig = config;
in args@{ config, ... }: {
nix = {
package = pkgs.nixUnstable;
extraOptions = ''
experimental-features = nix-command flakes
'';
};
environment.systemPackages = with pkgs; [
git
htop
nload
];
users.groups.gitlab-runner = { };
users.users.gitlab-runner = {
isSystemUser = true;
group = config.users.groups.gitlab-runner.name;
};
programs.ssh.extraConfig = ''
StrictHostKeyChecking=no
UserKnownHostsFile=/dev/null
nix = {
package = pkgs.nixVersions.latest;
extraOptions = ''
experimental-features = nix-command flakes
'';
};
services = {
openssh.enable = true;
gitlab-runner = {
enable = true;
services = {
shell = {
registrationConfigFile = hostConfig.sops.secrets.runnerRegistrationConfig.path;
executor = "shell";
tagList = [ "nix" ];
};
environment.systemPackages = with pkgs; [ git htop nload ];
users.groups.gitlab-runner = { };
users.users.gitlab-runner = {
isSystemUser = true;
group = config.users.groups.gitlab-runner.name;
};
programs.ssh.extraConfig = ''
StrictHostKeyChecking=no
UserKnownHostsFile=/dev/null
'';
services = {
openssh.enable = true;
gitlab-runner = {
enable = true;
services = {
shell = {
registrationConfigFile =
hostConfig.sops.secrets.runnerRegistrationConfig.path;
executor = "shell";
tagList = [ "nix" ];
};
};
};
systemd.services.gitlab-runner.serviceConfig = {
DynamicUser = lib.mkForce false;
User = config.users.users.gitlab-runner.name;
Group = config.users.groups.gitlab-runner.name;
};
system.stateVersion = "22.05";
};
systemd.services.gitlab-runner.serviceConfig = {
DynamicUser = lib.mkForce false;
User = config.users.users.gitlab-runner.name;
Group = config.users.groups.gitlab-runner.name;
};
system.stateVersion = "22.05";
};
};
};
}