diff --git a/dns/dnsconfig.js b/dns/dnsconfig.js index bab57f6b..c5543530 100644 --- a/dns/dnsconfig.js +++ b/dns/dnsconfig.js @@ -16,6 +16,7 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS), A('bridge', '69.61.38.225', TTL(300)), A('rss', '69.61.38.225', TTL(300)), A('git', '69.61.38.225', TTL(300)), + A('ci', '69.61.38.225', TTL(300)), // vultr -> nulled: lituus A('@', '45.77.48.108', TTL(300)), A('jitsi', '45.77.48.108', TTL(300)), diff --git a/hosts/helix/default.nix b/hosts/helix/default.nix index 8e7b1775..5eb1e10a 100644 --- a/hosts/helix/default.nix +++ b/hosts/helix/default.nix @@ -6,6 +6,7 @@ ../profiles/server ../profiles/metrics ../profiles/gitea + ../profiles/woodpecker-server ../profiles/rss-bridge ../profiles/mount-mossnet ../profiles/freshrss diff --git a/hosts/profiles/woodpecker-agent/default.nix b/hosts/profiles/woodpecker-agent/default.nix index eb50a06c..139067b4 100644 --- a/hosts/profiles/woodpecker-agent/default.nix +++ b/hosts/profiles/woodpecker-agent/default.nix @@ -3,6 +3,8 @@ users.users.woodpecker-runner = { isSystemUser = true; group = "woodpecker-runner"; + home = "/var/lib/woodpecker"; + createHome = true; }; users.groups.woodpecker-runner = { }; # Allow the exec runner to write to build with nix @@ -33,15 +35,19 @@ ]; serviceConfig = { Environment = [ - "WOODPECKER_RUNNER_CAPACITY=2" + "WOODPECKER_RUNNER_CAPACITY=6" "WOODPECKER_RUNNER_NAME=woodpecker-agent" + "WOODPECKER_SERVER=https://ci.sealight.xyz/" + "WOODPECKER_HOSTNAME=mossnet" + "WOODPECKER_BACKEND=local" "NIX_REMOTE=daemon" "PAGER=cat" ]; BindPaths = [ "/nix/var/nix/daemon-socket/socket" "/run/nscd/socket" - # "/var/lib/woodpecker" + "/var/lib/woodpecker" + "/var/empty/usr" ]; BindReadOnlyPaths = [ "/etc/passwd:/etc/passwd" diff --git a/hosts/profiles/woodpecker-server/default.nix b/hosts/profiles/woodpecker-server/default.nix index ee6bad23..f14e2ed8 100644 --- a/hosts/profiles/woodpecker-server/default.nix +++ b/hosts/profiles/woodpecker-server/default.nix @@ -1,6 +1,12 @@ +{ self, ... }: { + age.secrets.woodpecker-server-secrets.owner = "woodpecker"; + age.secrets.woodpecker-server-secrets.file = "${self}/secrets/woodpecker-server-secrets.age"; + + age.secrets.woodpecker-agent-secret.owner = "woodpecker"; + age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age"; users.users.woodpecker = { - group = woodpecker; + group = "woodpecker"; description = "woodpecker user"; home = "/var/lib/woodpecker"; createHome = true; @@ -28,12 +34,11 @@ wantedBy = [ "multi-user.target" ]; serviceConfig = { EnvironmentFile = [ - # GITEA_CLIENT_SECRET etc - # /run/agenix/woodpecker + /run/agenix/woodpecker-server-secrets + /run/agenix/woodpecker-agent-secret ]; Environment = [ "WOODPECKER_OPEN=true" - "WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}" "WOODPECKER_GITEA=true" "WOODPECKER_GITEA_URL=https://git.sealight.xyz" @@ -42,6 +47,12 @@ "WOODPECKER_DATABASE_DRIVER=postgres" "WOODPECKER_SERVER_PORT=:3030" "WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username + "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt" + "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts" + "${builtins.toFile "ssh_config" '' + Host git.sealight.xyz + ForwardAgent yes + ''}:/etc/ssh/ssh_config" ]; ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server"; User = woodpecker; diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 374cd2a9..414c1a62 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -26,7 +26,6 @@ in "wallabag.age".publicKeys = [ mossnet ]; "woodpecker-agent-secret.age".publicKeys = [ mossnet helix ]; - "woodpecker-client-id.age".publicKeys = [ helix ]; - "woodpecker-client-secret.age".publicKeys = [ helix ]; + "woodpecker-server-secrets.age".publicKeys = [ helix ]; "gitea-dbpass.age".publicKeys = [ helix ]; } diff --git a/secrets/woodpecker-server-secrets.age b/secrets/woodpecker-server-secrets.age new file mode 100644 index 00000000..48396ff0 Binary files /dev/null and b/secrets/woodpecker-server-secrets.age differ