diff --git a/hosts/profiles/woodpecker-agent/default.nix b/hosts/profiles/woodpecker-agent/default.nix index 139067b4..e316a7dc 100644 --- a/hosts/profiles/woodpecker-agent/default.nix +++ b/hosts/profiles/woodpecker-agent/default.nix @@ -5,6 +5,7 @@ group = "woodpecker-runner"; home = "/var/lib/woodpecker"; createHome = true; + extraGroups = [ "docker" ]; }; users.groups.woodpecker-runner = { }; # Allow the exec runner to write to build with nix @@ -13,56 +14,43 @@ age.secrets.woodpecker-agent-secret.owner = "woodpecker-runner"; age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age"; - systemd.services.woodpecker-runner-exec = { + systemd.services.woodpecker-agent = { enable = true; - wantedBy = [ "multi-user.target" ]; ### MANUALLY RESTART SERVICE IF CHANGED restartIfChanged = true; - confinement.enable = true; - confinement.packages = [ - pkgs.git - pkgs.gnutar - pkgs.bash - pkgs.nixFlakes - pkgs.gzip - ]; - path = [ - pkgs.git - pkgs.gnutar - pkgs.bash - pkgs.nixFlakes - pkgs.gzip - ]; + # confinement.enable = true; + # confinement.packages = [ + # pkgs.git + # pkgs.gnutar + # pkgs.bash + # pkgs.nixFlakes + # pkgs.gzip + # ]; + # path = [ + # pkgs.git + # pkgs.gnutar + # pkgs.bash + # pkgs.nixFlakes + # pkgs.gzip + # ]; serviceConfig = { + Type = "simple"; Environment = [ "WOODPECKER_RUNNER_CAPACITY=6" - "WOODPECKER_RUNNER_NAME=woodpecker-agent" + # "WOODPECKER_RUNNER_NAME=woodpecker-agent" "WOODPECKER_SERVER=https://ci.sealight.xyz/" - "WOODPECKER_HOSTNAME=mossnet" - "WOODPECKER_BACKEND=local" - "NIX_REMOTE=daemon" - "PAGER=cat" - ]; - BindPaths = [ - "/nix/var/nix/daemon-socket/socket" - "/run/nscd/socket" - "/var/lib/woodpecker" - "/var/empty/usr" - ]; - BindReadOnlyPaths = [ - "/etc/passwd:/etc/passwd" - "/etc/group:/etc/group" - "/nix/var/nix/profiles/system/etc/nix:/etc/nix" - "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt" - "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts" - "${builtins.toFile "ssh_config" '' - Host git.sealight.xyz - ForwardAgent yes - ''}:/etc/ssh/ssh_config" - "/etc/machine-id" - "/etc/resolv.conf" - "/nix/" + # "WOODPECKER_HOSTNAME=mossnet" + # "WOODPECKER_BACKEND=local" + # "NIX_REMOTE=daemon" + # "PAGER=cat" + # "WOODPECKER_LOG_LEVEL=debug" ]; + WorkingDirectory = "/var/lib/woodpecker"; + # Runtime directory and mode + RuntimeDirectory = "woodpecker"; + RuntimeDirectoryMode = "0755"; + # Access write directories + ReadWritePaths = [ "/var/lib/woodpecker" ]; EnvironmentFile = [ /run/agenix/woodpecker-agent-secret ]; diff --git a/hosts/profiles/woodpecker-server/default.nix b/hosts/profiles/woodpecker-server/default.nix index f14e2ed8..fd07c6e9 100644 --- a/hosts/profiles/woodpecker-server/default.nix +++ b/hosts/profiles/woodpecker-server/default.nix @@ -1,4 +1,4 @@ -{ self, ... }: +{ self, pkgs, config, ... }: { age.secrets.woodpecker-server-secrets.owner = "woodpecker"; age.secrets.woodpecker-server-secrets.file = "${self}/secrets/woodpecker-server-secrets.age"; @@ -10,6 +10,7 @@ description = "woodpecker user"; home = "/var/lib/woodpecker"; createHome = true; + isNormalUser = true; }; users.groups.woodpecker = { }; @@ -17,9 +18,11 @@ services.nginx.virtualHosts."ci.sealight.xyz" = { enableACME = true; forceSSL = true; - locations."/".proxyPass = "http://localhost:3030/"; + locations."/".proxyPass = "http://localhost:38125"; }; + networking.firewall.allowedTCPPorts = [ 80 443 22 ]; + services.postgresql = { ensureDatabases = [ "woodpecker" ]; ensureUsers = [{ @@ -33,30 +36,26 @@ systemd.services.woodpecker-server = { wantedBy = [ "multi-user.target" ]; serviceConfig = { + WorkingDirectory = "/var/lib/woodpecker"; EnvironmentFile = [ /run/agenix/woodpecker-server-secrets /run/agenix/woodpecker-agent-secret ]; Environment = [ - "WOODPECKER_OPEN=true" + "WOODPECKER_OPEN=false" + "WOODPECKER_HOST=https://ci.sealight.xyz" + "WOODPECKER_SERVER_ADDR=:38125" "WOODPECKER_GITEA=true" "WOODPECKER_GITEA_URL=https://git.sealight.xyz" "WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql" "WOODPECKER_DATABASE_DRIVER=postgres" - "WOODPECKER_SERVER_PORT=:3030" "WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username - "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt" - "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts" - "${builtins.toFile "ssh_config" '' - Host git.sealight.xyz - ForwardAgent yes - ''}:/etc/ssh/ssh_config" ]; ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server"; - User = woodpecker; - Group = woodpecker; + User = "woodpecker"; + Group = "woodpecker"; }; };