{ pkgs, config, self, ... }: { users.users.woodpecker-runner = { isSystemUser = true; group = "woodpecker-runner"; home = "/var/lib/woodpecker"; createHome = true; extraGroups = [ "docker" ]; }; users.groups.woodpecker-runner = { }; # Allow the exec runner to write to build with nix nix.settings.allowed-users = [ "woodpecker-runner" ]; virtualisation.docker.enable = true; age.secrets.woodpecker-agent-secret.owner = "woodpecker-runner"; age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age"; systemd.services.woodpecker-agent = { enable = true; ### MANUALLY RESTART SERVICE IF CHANGED restartIfChanged = true; # confinement.enable = true; # confinement.packages = [ # pkgs.git # pkgs.gnutar # pkgs.bash # pkgs.nixFlakes # pkgs.gzip # ]; # path = [ # pkgs.git # pkgs.gnutar # pkgs.bash # pkgs.nixFlakes # pkgs.gzip # ]; serviceConfig = { Type = "simple"; Environment = [ "WOODPECKER_RUNNER_CAPACITY=6" "WOODPECKER_RUNNER_NAME=woodpecker-agent" "WOODPECKER_SERVER=ci.sealight.xyz:9000" "WOODPECKER_HOSTNAME=mossnet" "WOODPECKER_BACKEND=docker" "NIX_REMOTE=daemon" "PAGER=cat" # "WOODPECKER_PROTO=https" # "WOODPECKER_LOG_LEVEL=debug" ]; WorkingDirectory = "/var/lib/woodpecker"; # Runtime directory and mode RuntimeDirectory = "woodpecker"; RuntimeDirectoryMode = "0755"; # Access write directories ReadWritePaths = [ "/var/lib/woodpecker" ]; EnvironmentFile = [ /run/agenix/woodpecker-agent-secret ]; ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent"; User = "woodpecker-runner"; Group = "woodpecker-runner"; }; }; }