woodpecker things
This commit is contained in:
		
							parent
							
								
									fc1f99b45f
								
							
						
					
					
						commit
						977c316049
					
				|  | @ -5,6 +5,7 @@ | |||
|     group = "woodpecker-runner"; | ||||
|     home = "/var/lib/woodpecker"; | ||||
|     createHome = true; | ||||
|     extraGroups = [ "docker" ]; | ||||
|   }; | ||||
|   users.groups.woodpecker-runner = { }; | ||||
|   # Allow the exec runner to write to build with nix | ||||
|  | @ -13,56 +14,43 @@ | |||
|   age.secrets.woodpecker-agent-secret.owner = "woodpecker-runner"; | ||||
|   age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age"; | ||||
| 
 | ||||
|   systemd.services.woodpecker-runner-exec = { | ||||
|   systemd.services.woodpecker-agent = { | ||||
|     enable = true; | ||||
|     wantedBy = [ "multi-user.target" ]; | ||||
|     ### MANUALLY RESTART SERVICE IF CHANGED | ||||
|     restartIfChanged = true; | ||||
|     confinement.enable = true; | ||||
|     confinement.packages = [ | ||||
|       pkgs.git | ||||
|       pkgs.gnutar | ||||
|       pkgs.bash | ||||
|       pkgs.nixFlakes | ||||
|       pkgs.gzip | ||||
|     ]; | ||||
|     path = [ | ||||
|       pkgs.git | ||||
|       pkgs.gnutar | ||||
|       pkgs.bash | ||||
|       pkgs.nixFlakes | ||||
|       pkgs.gzip | ||||
|     ]; | ||||
|     # confinement.enable = true; | ||||
|     # confinement.packages = [ | ||||
|     #   pkgs.git | ||||
|     #   pkgs.gnutar | ||||
|     #   pkgs.bash | ||||
|     #   pkgs.nixFlakes | ||||
|     #   pkgs.gzip | ||||
|     # ]; | ||||
|     # path = [ | ||||
|     #   pkgs.git | ||||
|     #   pkgs.gnutar | ||||
|     #   pkgs.bash | ||||
|     #   pkgs.nixFlakes | ||||
|     #   pkgs.gzip | ||||
|     # ]; | ||||
|     serviceConfig = { | ||||
|       Type = "simple"; | ||||
|       Environment = [ | ||||
|         "WOODPECKER_RUNNER_CAPACITY=6" | ||||
|         "WOODPECKER_RUNNER_NAME=woodpecker-agent" | ||||
|         # "WOODPECKER_RUNNER_NAME=woodpecker-agent" | ||||
|         "WOODPECKER_SERVER=https://ci.sealight.xyz/" | ||||
|         "WOODPECKER_HOSTNAME=mossnet" | ||||
|         "WOODPECKER_BACKEND=local" | ||||
|         "NIX_REMOTE=daemon" | ||||
|         "PAGER=cat" | ||||
|       ]; | ||||
|       BindPaths = [ | ||||
|         "/nix/var/nix/daemon-socket/socket" | ||||
|         "/run/nscd/socket" | ||||
|         "/var/lib/woodpecker" | ||||
|         "/var/empty/usr" | ||||
|       ]; | ||||
|       BindReadOnlyPaths = [ | ||||
|         "/etc/passwd:/etc/passwd" | ||||
|         "/etc/group:/etc/group" | ||||
|         "/nix/var/nix/profiles/system/etc/nix:/etc/nix" | ||||
|         "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt" | ||||
|         "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts" | ||||
|         "${builtins.toFile "ssh_config" '' | ||||
|           Host git.sealight.xyz | ||||
|           ForwardAgent yes | ||||
|         ''}:/etc/ssh/ssh_config" | ||||
|         "/etc/machine-id" | ||||
|         "/etc/resolv.conf" | ||||
|         "/nix/" | ||||
|         # "WOODPECKER_HOSTNAME=mossnet" | ||||
|         # "WOODPECKER_BACKEND=local" | ||||
|         # "NIX_REMOTE=daemon" | ||||
|         # "PAGER=cat" | ||||
|         # "WOODPECKER_LOG_LEVEL=debug" | ||||
|       ]; | ||||
|       WorkingDirectory = "/var/lib/woodpecker"; | ||||
|       # Runtime directory and mode | ||||
|       RuntimeDirectory = "woodpecker"; | ||||
|       RuntimeDirectoryMode = "0755"; | ||||
|       # Access write directories | ||||
|       ReadWritePaths = [ "/var/lib/woodpecker" ]; | ||||
|       EnvironmentFile = [ | ||||
|         /run/agenix/woodpecker-agent-secret | ||||
|       ]; | ||||
|  |  | |||
|  | @ -1,4 +1,4 @@ | |||
| { self, ... }: | ||||
| { self, pkgs, config, ... }: | ||||
| { | ||||
|   age.secrets.woodpecker-server-secrets.owner = "woodpecker"; | ||||
|   age.secrets.woodpecker-server-secrets.file = "${self}/secrets/woodpecker-server-secrets.age"; | ||||
|  | @ -10,6 +10,7 @@ | |||
|     description = "woodpecker user"; | ||||
|     home = "/var/lib/woodpecker"; | ||||
|     createHome = true; | ||||
|     isNormalUser = true; | ||||
|   }; | ||||
| 
 | ||||
|   users.groups.woodpecker = { }; | ||||
|  | @ -17,9 +18,11 @@ | |||
|   services.nginx.virtualHosts."ci.sealight.xyz" = { | ||||
|     enableACME = true; | ||||
|     forceSSL = true; | ||||
|     locations."/".proxyPass = "http://localhost:3030/"; | ||||
|     locations."/".proxyPass = "http://localhost:38125"; | ||||
|   }; | ||||
| 
 | ||||
|   networking.firewall.allowedTCPPorts = [ 80 443 22 ]; | ||||
| 
 | ||||
|   services.postgresql = { | ||||
|     ensureDatabases = [ "woodpecker" ]; | ||||
|     ensureUsers = [{ | ||||
|  | @ -33,30 +36,26 @@ | |||
|   systemd.services.woodpecker-server = { | ||||
|     wantedBy = [ "multi-user.target" ]; | ||||
|     serviceConfig = { | ||||
|       WorkingDirectory = "/var/lib/woodpecker"; | ||||
|       EnvironmentFile = [ | ||||
|         /run/agenix/woodpecker-server-secrets | ||||
|         /run/agenix/woodpecker-agent-secret | ||||
|       ]; | ||||
|       Environment = [ | ||||
|         "WOODPECKER_OPEN=true" | ||||
|         "WOODPECKER_OPEN=false" | ||||
|         "WOODPECKER_HOST=https://ci.sealight.xyz" | ||||
|         "WOODPECKER_SERVER_ADDR=:38125" | ||||
| 
 | ||||
|         "WOODPECKER_GITEA=true" | ||||
|         "WOODPECKER_GITEA_URL=https://git.sealight.xyz" | ||||
| 
 | ||||
|         "WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql" | ||||
|         "WOODPECKER_DATABASE_DRIVER=postgres" | ||||
|         "WOODPECKER_SERVER_PORT=:3030" | ||||
|         "WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username | ||||
|         "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt" | ||||
|         "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts" | ||||
|         "${builtins.toFile "ssh_config" '' | ||||
|           Host git.sealight.xyz | ||||
|           ForwardAgent yes | ||||
|         ''}:/etc/ssh/ssh_config" | ||||
|       ]; | ||||
|       ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server"; | ||||
|       User = woodpecker; | ||||
|       Group = woodpecker; | ||||
|       User = "woodpecker"; | ||||
|       Group = "woodpecker"; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|  |  | |||
		Loading…
	
		Reference in a new issue