helm/hosts/profiles/woodpecker-agent/default.nix

{ pkgs, config, self, ... }:
{
  users.users.woodpecker-runner = {
    isSystemUser = true;
    group = "woodpecker-runner";
  };
  users.groups.woodpecker-runner = { };
  # Allow the exec runner to write to build with nix
  nix.settings.allowed-users = [ "woodpecker-runner" ];

  age.secrets.woodpecker-agent-secret.owner = "woodpecker-runner";
  age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age";

  systemd.services.woodpecker-runner-exec = {
    enable = true;
    wantedBy = [ "multi-user.target" ];
    ### MANUALLY RESTART SERVICE IF CHANGED
    restartIfChanged = true;
    confinement.enable = true;
    confinement.packages = [
      pkgs.git
      pkgs.gnutar
      pkgs.bash
      pkgs.nixFlakes
      pkgs.gzip
    ];
    path = [
      pkgs.git
      pkgs.gnutar
      pkgs.bash
      pkgs.nixFlakes
      pkgs.gzip
    ];
    serviceConfig = {
      Environment = [
        "WOODPECKER_RUNNER_CAPACITY=2"
        "WOODPECKER_RUNNER_NAME=woodpecker-agent"
        "NIX_REMOTE=daemon"
        "PAGER=cat"
      ];
      BindPaths = [
        "/nix/var/nix/daemon-socket/socket"
        "/run/nscd/socket"
        # "/var/lib/woodpecker"
      ];
      BindReadOnlyPaths = [
        "/etc/passwd:/etc/passwd"
        "/etc/group:/etc/group"
        "/nix/var/nix/profiles/system/etc/nix:/etc/nix"
        "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
        "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
        "${builtins.toFile "ssh_config" ''
          Host git.sealight.xyz
          ForwardAgent yes
        ''}:/etc/ssh/ssh_config"
        "/etc/machine-id"
        "/etc/resolv.conf"
        "/nix/"
      ];
      EnvironmentFile = [
        /run/agenix/woodpecker-agent-secret
      ];
      ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent";
      User = "woodpecker-runner";
      Group = "woodpecker-runner";
    };
  };
}