more woodpecker updates
This commit is contained in:
		
							parent
							
								
									a309cf3fb3
								
							
						
					
					
						commit
						47e073f9d1
					
				|  | @ -16,6 +16,7 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS), | |||
| 	A('bridge', '69.61.38.225', TTL(300)), | ||||
| 	A('rss', '69.61.38.225', TTL(300)), | ||||
| 	A('git', '69.61.38.225', TTL(300)), | ||||
| 	A('ci', '69.61.38.225', TTL(300)), | ||||
| 	// vultr -> nulled: lituus
 | ||||
| 	A('@', '45.77.48.108', TTL(300)), | ||||
| 	A('jitsi', '45.77.48.108', TTL(300)), | ||||
|  |  | |||
|  | @ -6,6 +6,7 @@ | |||
|     ../profiles/server | ||||
|     ../profiles/metrics | ||||
|     ../profiles/gitea | ||||
|     ../profiles/woodpecker-server | ||||
|     ../profiles/rss-bridge | ||||
|     ../profiles/mount-mossnet | ||||
|     ../profiles/freshrss | ||||
|  |  | |||
|  | @ -3,6 +3,8 @@ | |||
|   users.users.woodpecker-runner = { | ||||
|     isSystemUser = true; | ||||
|     group = "woodpecker-runner"; | ||||
|     home = "/var/lib/woodpecker"; | ||||
|     createHome = true; | ||||
|   }; | ||||
|   users.groups.woodpecker-runner = { }; | ||||
|   # Allow the exec runner to write to build with nix | ||||
|  | @ -33,15 +35,19 @@ | |||
|     ]; | ||||
|     serviceConfig = { | ||||
|       Environment = [ | ||||
|         "WOODPECKER_RUNNER_CAPACITY=2" | ||||
|         "WOODPECKER_RUNNER_CAPACITY=6" | ||||
|         "WOODPECKER_RUNNER_NAME=woodpecker-agent" | ||||
|         "WOODPECKER_SERVER=https://ci.sealight.xyz/" | ||||
|         "WOODPECKER_HOSTNAME=mossnet" | ||||
|         "WOODPECKER_BACKEND=local" | ||||
|         "NIX_REMOTE=daemon" | ||||
|         "PAGER=cat" | ||||
|       ]; | ||||
|       BindPaths = [ | ||||
|         "/nix/var/nix/daemon-socket/socket" | ||||
|         "/run/nscd/socket" | ||||
|         # "/var/lib/woodpecker" | ||||
|         "/var/lib/woodpecker" | ||||
|         "/var/empty/usr" | ||||
|       ]; | ||||
|       BindReadOnlyPaths = [ | ||||
|         "/etc/passwd:/etc/passwd" | ||||
|  |  | |||
|  | @ -1,6 +1,12 @@ | |||
| { self, ... }: | ||||
| { | ||||
|   age.secrets.woodpecker-server-secrets.owner = "woodpecker"; | ||||
|   age.secrets.woodpecker-server-secrets.file = "${self}/secrets/woodpecker-server-secrets.age"; | ||||
| 
 | ||||
|   age.secrets.woodpecker-agent-secret.owner = "woodpecker"; | ||||
|   age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age"; | ||||
|   users.users.woodpecker = { | ||||
|     group = woodpecker; | ||||
|     group = "woodpecker"; | ||||
|     description = "woodpecker user"; | ||||
|     home = "/var/lib/woodpecker"; | ||||
|     createHome = true; | ||||
|  | @ -28,12 +34,11 @@ | |||
|     wantedBy = [ "multi-user.target" ]; | ||||
|     serviceConfig = { | ||||
|       EnvironmentFile = [ | ||||
|         # GITEA_CLIENT_SECRET etc | ||||
|         # /run/agenix/woodpecker | ||||
|         /run/agenix/woodpecker-server-secrets | ||||
|         /run/agenix/woodpecker-agent-secret | ||||
|       ]; | ||||
|       Environment = [ | ||||
|         "WOODPECKER_OPEN=true" | ||||
|         "WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}" | ||||
| 
 | ||||
|         "WOODPECKER_GITEA=true" | ||||
|         "WOODPECKER_GITEA_URL=https://git.sealight.xyz" | ||||
|  | @ -42,6 +47,12 @@ | |||
|         "WOODPECKER_DATABASE_DRIVER=postgres" | ||||
|         "WOODPECKER_SERVER_PORT=:3030" | ||||
|         "WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username | ||||
|         "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt" | ||||
|         "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts" | ||||
|         "${builtins.toFile "ssh_config" '' | ||||
|           Host git.sealight.xyz | ||||
|           ForwardAgent yes | ||||
|         ''}:/etc/ssh/ssh_config" | ||||
|       ]; | ||||
|       ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server"; | ||||
|       User = woodpecker; | ||||
|  |  | |||
|  | @ -26,7 +26,6 @@ in | |||
| 
 | ||||
|   "wallabag.age".publicKeys = [ mossnet ]; | ||||
|   "woodpecker-agent-secret.age".publicKeys = [ mossnet helix ]; | ||||
|   "woodpecker-client-id.age".publicKeys = [ helix ]; | ||||
|   "woodpecker-client-secret.age".publicKeys = [ helix ]; | ||||
|   "woodpecker-server-secrets.age".publicKeys = [ helix ]; | ||||
|   "gitea-dbpass.age".publicKeys = [ helix ]; | ||||
| } | ||||
|  |  | |||
							
								
								
									
										
											BIN
										
									
								
								secrets/woodpecker-server-secrets.age
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										
											BIN
										
									
								
								secrets/woodpecker-server-secrets.age
									
									
									
									
									
										Normal file
									
								
							
										
											Binary file not shown.
										
									
								
							
		Loading…
	
		Reference in a new issue