more woodpecker updates

dns/dnsconfig.js

@@ -16,6 +16,7 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
 	A('bridge', '69.61.38.225', TTL(300)),
 	A('rss', '69.61.38.225', TTL(300)),
 	A('git', '69.61.38.225', TTL(300)),
+	A('ci', '69.61.38.225', TTL(300)),
 	// vultr -> nulled: lituus
 	A('@', '45.77.48.108', TTL(300)),
 	A('jitsi', '45.77.48.108', TTL(300)),

hosts/helix/default.nix

@@ -6,6 +6,7 @@
     ../profiles/server
     ../profiles/metrics
     ../profiles/gitea
+    ../profiles/woodpecker-server
     ../profiles/rss-bridge
     ../profiles/mount-mossnet
     ../profiles/freshrss

hosts/profiles/woodpecker-agent/default.nix

@@ -3,6 +3,8 @@
   users.users.woodpecker-runner = {
     isSystemUser = true;
     group = "woodpecker-runner";
+    home = "/var/lib/woodpecker";
+    createHome = true;
   };
   users.groups.woodpecker-runner = { };
   # Allow the exec runner to write to build with nix
@@ -33,15 +35,19 @@
     ];
     serviceConfig = {
       Environment = [
-        "WOODPECKER_RUNNER_CAPACITY=2"
+        "WOODPECKER_RUNNER_CAPACITY=6"
         "WOODPECKER_RUNNER_NAME=woodpecker-agent"
+        "WOODPECKER_SERVER=https://ci.sealight.xyz/"
+        "WOODPECKER_HOSTNAME=mossnet"
+        "WOODPECKER_BACKEND=local"
         "NIX_REMOTE=daemon"
         "PAGER=cat"
       ];
       BindPaths = [
         "/nix/var/nix/daemon-socket/socket"
         "/run/nscd/socket"
-        # "/var/lib/woodpecker"
+        "/var/lib/woodpecker"
+        "/var/empty/usr"
       ];
       BindReadOnlyPaths = [
         "/etc/passwd:/etc/passwd"

hosts/profiles/woodpecker-server/default.nix

@@ -1,6 +1,12 @@
+{ self, ... }:
 {
+  age.secrets.woodpecker-server-secrets.owner = "woodpecker";
+  age.secrets.woodpecker-server-secrets.file = "${self}/secrets/woodpecker-server-secrets.age";
+
+  age.secrets.woodpecker-agent-secret.owner = "woodpecker";
+  age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age";
   users.users.woodpecker = {
-    group = woodpecker;
+    group = "woodpecker";
     description = "woodpecker user";
     home = "/var/lib/woodpecker";
     createHome = true;
@@ -28,12 +34,11 @@
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {
       EnvironmentFile = [
-        # GITEA_CLIENT_SECRET etc
-        # /run/agenix/woodpecker
+        /run/agenix/woodpecker-server-secrets
+        /run/agenix/woodpecker-agent-secret
       ];
       Environment = [
         "WOODPECKER_OPEN=true"
-        "WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}"
 
         "WOODPECKER_GITEA=true"
         "WOODPECKER_GITEA_URL=https://git.sealight.xyz"
@@ -42,6 +47,12 @@
         "WOODPECKER_DATABASE_DRIVER=postgres"
         "WOODPECKER_SERVER_PORT=:3030"
         "WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username
+        "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
+        "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
+        "${builtins.toFile "ssh_config" ''
+          Host git.sealight.xyz
+          ForwardAgent yes
+        ''}:/etc/ssh/ssh_config"
       ];
       ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server";
       User = woodpecker;

secrets/secrets.nix

@@ -26,7 +26,6 @@ in
 
   "wallabag.age".publicKeys = [ mossnet ];
   "woodpecker-agent-secret.age".publicKeys = [ mossnet helix ];
-  "woodpecker-client-id.age".publicKeys = [ helix ];
-  "woodpecker-client-secret.age".publicKeys = [ helix ];
+  "woodpecker-server-secrets.age".publicKeys = [ helix ];
   "gitea-dbpass.age".publicKeys = [ helix ];
 }