phfroidmont/self-hosting
1
0
Fork 0
mirror of https://github.com/phfroidmont/self-hosting.git synced 2025-12-25 05:36:59 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix gitlab-runner registration

Browse source
This commit is contained in:
Paul-Henri Froidmont 2024-07-08 18:51:24 +02:00
parent 3701d9ba1e
commit 51c5b08985
Signed by: phfroidmont
GPG key ID: BE948AFD7E7873BE
2 changed files with 59 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

96
modules/gitlab-runner.nix
View file

@ -1,7 +1,14 @@
{ config, lib, pkgs, ... }: {
config,
lib,
pkgs,
...
}:
with lib; with lib;
let cfg = config.custom.services.gitlab-runner; let
in { cfg = config.custom.services.gitlab-runner;
in
{
options.custom.services.gitlab-runner = { options.custom.services.gitlab-runner = {
enable = mkEnableOption "gitlab-runner"; enable = mkEnableOption "gitlab-runner";
}; };
@ -33,52 +40,61 @@ in {
}; };
}; };
config = let hostConfig = config; config =
in args@{ config, ... }: { let
hostConfig = config;
in
args@{ config, ... }:
{
nix = { nix = {
package = pkgs.nixVersions.latest; package = pkgs.nixVersions.latest;
extraOptions = '' extraOptions = ''
experimental-features = nix-command flakes experimental-features = nix-command flakes
'';
};
environment.systemPackages = with pkgs; [
git
htop
nload
];
users.groups.gitlab-runner = { };
users.users.gitlab-runner = {
isSystemUser = true;
group = config.users.groups.gitlab-runner.name;
};
programs.ssh.extraConfig = ''
StrictHostKeyChecking=no
UserKnownHostsFile=/dev/null
''; '';
};
environment.systemPackages = with pkgs; [ git htop nload ]; networking.useHostResolvConf = lib.mkForce false;
users.groups.gitlab-runner = { }; services = {
users.users.gitlab-runner = { openssh.enable = true;
isSystemUser = true; resolved.enable = true;
group = config.users.groups.gitlab-runner.name; gitlab-runner = {
}; enable = true;
services = {
programs.ssh.extraConfig = '' shell = {
StrictHostKeyChecking=no authenticationTokenConfigFile = hostConfig.sops.secrets.runnerRegistrationConfig.path;
UserKnownHostsFile=/dev/null executor = "shell";
''; };
services = {
openssh.enable = true;
gitlab-runner = {
enable = true;
services = {
shell = {
registrationConfigFile =
hostConfig.sops.secrets.runnerRegistrationConfig.path;
executor = "shell";
tagList = [ "nix" ];
}; };
}; };
}; };
};
systemd.services.gitlab-runner.serviceConfig = { systemd.services.gitlab-runner.serviceConfig = {
DynamicUser = lib.mkForce false; DynamicUser = lib.mkForce false;
User = config.users.users.gitlab-runner.name; User = config.users.users.gitlab-runner.name;
Group = config.users.groups.gitlab-runner.name; Group = config.users.groups.gitlab-runner.name;
}; };
system.stateVersion = "22.05"; system.stateVersion = "22.05";
}; };
}; };
}; };
} }

6
secrets.enc.yml
View file

@ -7,7 +7,7 @@ nix:
cache_secret_key: ENC[AES256_GCM,data:Q2mRU+EuTyqjYNvbuyGLqoDSqa/7EPlzNuCJU7QUBRSozf1D4dDzAPNU47xZ2rKcjz6Eg4OhAZLlGeFw9le8SzHOSJ65UYHoMMc6Rpvv/fPhgg2s2UMArrqyO3ultj1pVe3eIIRzBQcdoFqVDg==,iv:jhMTWEO6ahcZl+Dq6mA+mWIie8T0Dq1ZYe/HHYAD5ss=,tag:2GRmd2z96+TGI7MdvOBEdA==,type:str] cache_secret_key: ENC[AES256_GCM,data:Q2mRU+EuTyqjYNvbuyGLqoDSqa/7EPlzNuCJU7QUBRSozf1D4dDzAPNU47xZ2rKcjz6Eg4OhAZLlGeFw9le8SzHOSJ65UYHoMMc6Rpvv/fPhgg2s2UMArrqyO3ultj1pVe3eIIRzBQcdoFqVDg==,iv:jhMTWEO6ahcZl+Dq6mA+mWIie8T0Dq1ZYe/HHYAD5ss=,tag:2GRmd2z96+TGI7MdvOBEdA==,type:str]
gitlab: gitlab:
password: ENC[AES256_GCM,data:+DptcLNXBmI7c8TrlF2U3+4FAeg=,iv:POtL7Cu6KvgEs9SFokR1G9yviqvqUcy8KNlB42FU9PQ=,tag:yWgsuDou+R05EEe7j8r7WA==,type:str] password: ENC[AES256_GCM,data:+DptcLNXBmI7c8TrlF2U3+4FAeg=,iv:POtL7Cu6KvgEs9SFokR1G9yviqvqUcy8KNlB42FU9PQ=,tag:yWgsuDou+R05EEe7j8r7WA==,type:str]
runner_registration_config: ENC[AES256_GCM,data:BxkP4+moNV4eip9g2MoOFzZgWvYHELQ3qOJxMAGV9Ffdy5Fhl7mFNE85yv2I09hg2hwd68V3ThwiZ7eBoOi87bDRN82PeIyDqPtjbNA1ZcLJqE8=,iv:I/1wzcVSiz90cgRqMhGfN1wdB0EVQYVPyFn3RvSbTaw=,tag:8hMKQfmtPZf3nbs4LjnH3w==,type:str] runner_registration_config: ENC[AES256_GCM,data:R+9UIDgrTx8xiz4DRRjB4ocyib43lIfQyxWTW+d8/UzkA87GFIraSLIjhnoDFhk57s3jQGUtmudl709z410V8+EXbLB81gl1mJqaXQ==,iv:qckhsamd24VVTB7glMcVyMsLJo9jON3Nc9JfeGOM0xI=,tag:/DOmtSrQOoIzpMHH/oBnFQ==,type:str]
synapse: synapse:
db_password: ENC[AES256_GCM,data:hy2BgTsRaZDQZULTW/csmnRy5ZjDEuPqxyuINv0ov5pFzDkozJVL1wut3HgBXjYZ8bqNjS5pCPQtkznw,iv:i41zKGwvPGIEZP0ZjhRaY4UMeOXBovQmLr1e1ewZhV4=,tag:3kKKYouH+lOrNxPJE5ul/Q==,type:str] db_password: ENC[AES256_GCM,data:hy2BgTsRaZDQZULTW/csmnRy5ZjDEuPqxyuINv0ov5pFzDkozJVL1wut3HgBXjYZ8bqNjS5pCPQtkznw,iv:i41zKGwvPGIEZP0ZjhRaY4UMeOXBovQmLr1e1ewZhV4=,tag:3kKKYouH+lOrNxPJE5ul/Q==,type:str]
macaroon_secret_key: ENC[AES256_GCM,data:6n1gCit2MC8l4VR9DSUR87BB+hY5Oza33423sbV8sNIXmZsPzhyvxaBalK/0TVjLH6Q=,iv:OgHxNG96ZW4+LPZhLAtOD01Wibad6vSX6s4BrPE67YE=,tag:OGIz/ufUwt8/pUMLvoaXtg==,type:str] macaroon_secret_key: ENC[AES256_GCM,data:6n1gCit2MC8l4VR9DSUR87BB+hY5Oza33423sbV8sNIXmZsPzhyvxaBalK/0TVjLH6Q=,iv:OgHxNG96ZW4+LPZhLAtOD01Wibad6vSX6s4BrPE67YE=,tag:OGIz/ufUwt8/pUMLvoaXtg==,type:str]
@ -69,8 +69,8 @@ sops:
azure_kv: [] azure_kv: []
hc_vault: [] hc_vault: []
age: [] age: []
lastmodified: "2024-04-23T20:29:30Z" lastmodified: "2024-07-08T16:25:47Z"
mac: ENC[AES256_GCM,data:6CYH1MYnM9rIYM9L5ipd3Q3ypA8n/1BnnnnecBWaADevVYQ/p1TfxHJKKlOVP7PAOLs3B2gM4Prr1vqQSe8nYHd5FAWSyXtfhpqnMOlEoNHCPuLKjK3bE4TjbvCxP9RsJIwTE3evJAQGKreWRW8/ml5mGiwkhrdTEe+MSR/n138=,iv:jvPXJK8vomDgw8wcr2nn9GIjeGlPswRQo7RFHgOSZjs=,tag:VjKJkjmmNs04h0THbAEfUA==,type:str] mac: ENC[AES256_GCM,data:xQS7zypupl05ohpgmLycHFMAH46fStNk9cAV0bW7RBTdpXyO+/Crit9D+/mbMdRxbMXy1xywi65YKq8BJpg2o2ReH0tIHdN1IZIyqHtPSyUJ5IM6D9dWZBBiSLuYM8eU0jloORqTkRLUUqIHM6nuOoDdfE+SaNFhDhIQd+j+6ZI=,iv:j3ezzOn03fS4NaAUkngQnwFzDvrg4BwUAVdkYXnwIAI=,tag:FA6LeG6PfkufRtJCdl3iTg==,type:str]
pgp: pgp:
- created_at: "2023-10-17T21:02:13Z" - created_at: "2023-10-17T21:02:13Z"
enc: | enc: |