more woodpecker updates
This commit is contained in:
		
							parent
							
								
									a309cf3fb3
								
							
						
					
					
						commit
						47e073f9d1
					
				|  | @ -16,6 +16,7 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS), | ||||||
| 	A('bridge', '69.61.38.225', TTL(300)), | 	A('bridge', '69.61.38.225', TTL(300)), | ||||||
| 	A('rss', '69.61.38.225', TTL(300)), | 	A('rss', '69.61.38.225', TTL(300)), | ||||||
| 	A('git', '69.61.38.225', TTL(300)), | 	A('git', '69.61.38.225', TTL(300)), | ||||||
|  | 	A('ci', '69.61.38.225', TTL(300)), | ||||||
| 	// vultr -> nulled: lituus
 | 	// vultr -> nulled: lituus
 | ||||||
| 	A('@', '45.77.48.108', TTL(300)), | 	A('@', '45.77.48.108', TTL(300)), | ||||||
| 	A('jitsi', '45.77.48.108', TTL(300)), | 	A('jitsi', '45.77.48.108', TTL(300)), | ||||||
|  |  | ||||||
|  | @ -6,6 +6,7 @@ | ||||||
|     ../profiles/server |     ../profiles/server | ||||||
|     ../profiles/metrics |     ../profiles/metrics | ||||||
|     ../profiles/gitea |     ../profiles/gitea | ||||||
|  |     ../profiles/woodpecker-server | ||||||
|     ../profiles/rss-bridge |     ../profiles/rss-bridge | ||||||
|     ../profiles/mount-mossnet |     ../profiles/mount-mossnet | ||||||
|     ../profiles/freshrss |     ../profiles/freshrss | ||||||
|  |  | ||||||
|  | @ -3,6 +3,8 @@ | ||||||
|   users.users.woodpecker-runner = { |   users.users.woodpecker-runner = { | ||||||
|     isSystemUser = true; |     isSystemUser = true; | ||||||
|     group = "woodpecker-runner"; |     group = "woodpecker-runner"; | ||||||
|  |     home = "/var/lib/woodpecker"; | ||||||
|  |     createHome = true; | ||||||
|   }; |   }; | ||||||
|   users.groups.woodpecker-runner = { }; |   users.groups.woodpecker-runner = { }; | ||||||
|   # Allow the exec runner to write to build with nix |   # Allow the exec runner to write to build with nix | ||||||
|  | @ -33,15 +35,19 @@ | ||||||
|     ]; |     ]; | ||||||
|     serviceConfig = { |     serviceConfig = { | ||||||
|       Environment = [ |       Environment = [ | ||||||
|         "WOODPECKER_RUNNER_CAPACITY=2" |         "WOODPECKER_RUNNER_CAPACITY=6" | ||||||
|         "WOODPECKER_RUNNER_NAME=woodpecker-agent" |         "WOODPECKER_RUNNER_NAME=woodpecker-agent" | ||||||
|  |         "WOODPECKER_SERVER=https://ci.sealight.xyz/" | ||||||
|  |         "WOODPECKER_HOSTNAME=mossnet" | ||||||
|  |         "WOODPECKER_BACKEND=local" | ||||||
|         "NIX_REMOTE=daemon" |         "NIX_REMOTE=daemon" | ||||||
|         "PAGER=cat" |         "PAGER=cat" | ||||||
|       ]; |       ]; | ||||||
|       BindPaths = [ |       BindPaths = [ | ||||||
|         "/nix/var/nix/daemon-socket/socket" |         "/nix/var/nix/daemon-socket/socket" | ||||||
|         "/run/nscd/socket" |         "/run/nscd/socket" | ||||||
|         # "/var/lib/woodpecker" |         "/var/lib/woodpecker" | ||||||
|  |         "/var/empty/usr" | ||||||
|       ]; |       ]; | ||||||
|       BindReadOnlyPaths = [ |       BindReadOnlyPaths = [ | ||||||
|         "/etc/passwd:/etc/passwd" |         "/etc/passwd:/etc/passwd" | ||||||
|  |  | ||||||
|  | @ -1,6 +1,12 @@ | ||||||
|  | { self, ... }: | ||||||
| { | { | ||||||
|  |   age.secrets.woodpecker-server-secrets.owner = "woodpecker"; | ||||||
|  |   age.secrets.woodpecker-server-secrets.file = "${self}/secrets/woodpecker-server-secrets.age"; | ||||||
|  | 
 | ||||||
|  |   age.secrets.woodpecker-agent-secret.owner = "woodpecker"; | ||||||
|  |   age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age"; | ||||||
|   users.users.woodpecker = { |   users.users.woodpecker = { | ||||||
|     group = woodpecker; |     group = "woodpecker"; | ||||||
|     description = "woodpecker user"; |     description = "woodpecker user"; | ||||||
|     home = "/var/lib/woodpecker"; |     home = "/var/lib/woodpecker"; | ||||||
|     createHome = true; |     createHome = true; | ||||||
|  | @ -28,12 +34,11 @@ | ||||||
|     wantedBy = [ "multi-user.target" ]; |     wantedBy = [ "multi-user.target" ]; | ||||||
|     serviceConfig = { |     serviceConfig = { | ||||||
|       EnvironmentFile = [ |       EnvironmentFile = [ | ||||||
|         # GITEA_CLIENT_SECRET etc |         /run/agenix/woodpecker-server-secrets | ||||||
|         # /run/agenix/woodpecker |         /run/agenix/woodpecker-agent-secret | ||||||
|       ]; |       ]; | ||||||
|       Environment = [ |       Environment = [ | ||||||
|         "WOODPECKER_OPEN=true" |         "WOODPECKER_OPEN=true" | ||||||
|         "WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}" |  | ||||||
| 
 | 
 | ||||||
|         "WOODPECKER_GITEA=true" |         "WOODPECKER_GITEA=true" | ||||||
|         "WOODPECKER_GITEA_URL=https://git.sealight.xyz" |         "WOODPECKER_GITEA_URL=https://git.sealight.xyz" | ||||||
|  | @ -42,6 +47,12 @@ | ||||||
|         "WOODPECKER_DATABASE_DRIVER=postgres" |         "WOODPECKER_DATABASE_DRIVER=postgres" | ||||||
|         "WOODPECKER_SERVER_PORT=:3030" |         "WOODPECKER_SERVER_PORT=:3030" | ||||||
|         "WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username |         "WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username | ||||||
|  |         "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt" | ||||||
|  |         "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts" | ||||||
|  |         "${builtins.toFile "ssh_config" '' | ||||||
|  |           Host git.sealight.xyz | ||||||
|  |           ForwardAgent yes | ||||||
|  |         ''}:/etc/ssh/ssh_config" | ||||||
|       ]; |       ]; | ||||||
|       ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server"; |       ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server"; | ||||||
|       User = woodpecker; |       User = woodpecker; | ||||||
|  |  | ||||||
|  | @ -26,7 +26,6 @@ in | ||||||
| 
 | 
 | ||||||
|   "wallabag.age".publicKeys = [ mossnet ]; |   "wallabag.age".publicKeys = [ mossnet ]; | ||||||
|   "woodpecker-agent-secret.age".publicKeys = [ mossnet helix ]; |   "woodpecker-agent-secret.age".publicKeys = [ mossnet helix ]; | ||||||
|   "woodpecker-client-id.age".publicKeys = [ helix ]; |   "woodpecker-server-secrets.age".publicKeys = [ helix ]; | ||||||
|   "woodpecker-client-secret.age".publicKeys = [ helix ]; |  | ||||||
|   "gitea-dbpass.age".publicKeys = [ helix ]; |   "gitea-dbpass.age".publicKeys = [ helix ]; | ||||||
| } | } | ||||||
|  |  | ||||||
							
								
								
									
										
											BIN
										
									
								
								secrets/woodpecker-server-secrets.age
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										
											BIN
										
									
								
								secrets/woodpecker-server-secrets.age
									
									
									
									
									
										Normal file
									
								
							
										
											Binary file not shown.
										
									
								
							
		Loading…
	
		Reference in a new issue