helm/hosts/profiles/woodpecker-agent/default.nix

{ pkgs, config, self, ... }:
{
  users.users.woodpecker-runner = {
    isSystemUser = true;
    group = "woodpecker-runner";
    home = "/var/lib/woodpecker";
    createHome = true;
    extraGroups = [ "docker" ];
  };
  users.groups.woodpecker-runner = { };
  # Allow the exec runner to write to build with nix
  nix.settings.allowed-users = [ "woodpecker-runner" ];
  virtualisation.docker.enable = true;

  age.secrets.woodpecker-agent-secret.owner = "woodpecker-runner";
  age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age";

  systemd.services.woodpecker-agent = {
    enable = true;
    ### MANUALLY RESTART SERVICE IF CHANGED
    restartIfChanged = true;
    # confinement.enable = true;
    # confinement.packages = [
    #   pkgs.git
    #   pkgs.gnutar
    #   pkgs.bash
    #   pkgs.nixFlakes
    #   pkgs.gzip
    # ];
    # path = [
    #   pkgs.git
    #   pkgs.gnutar
    #   pkgs.bash
    #   pkgs.nixFlakes
    #   pkgs.gzip
    # ];
    serviceConfig = {
      Type = "simple";
      Environment = [
        "WOODPECKER_RUNNER_CAPACITY=6"
        "WOODPECKER_RUNNER_NAME=woodpecker-agent"
        "WOODPECKER_SERVER=ci.sealight.xyz:9000"
        "WOODPECKER_HOSTNAME=mossnet"
        "WOODPECKER_BACKEND=docker"
        "NIX_REMOTE=daemon"
        "PAGER=cat"
        # "WOODPECKER_PROTO=https"
        # "WOODPECKER_LOG_LEVEL=debug"
      ];
      WorkingDirectory = "/var/lib/woodpecker";
      # Runtime directory and mode
      RuntimeDirectory = "woodpecker";
      RuntimeDirectoryMode = "0755";
      # Access write directories
      ReadWritePaths = [ "/var/lib/woodpecker" ];
      EnvironmentFile = [
        /run/agenix/woodpecker-agent-secret
      ];
      ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent";
      User = "woodpecker-runner";
      Group = "woodpecker-runner";
    };
  };
}