{ users.users.woodpecker-runner = { isSystemUser = true; group = "woodpecker-runner"; }; users.groups.woodpecker-runner = { }; # Allow the exec runner to write to build with nix nix.allowedUsers = [ "woodpecker-runner" ]; systemd.services.woodpecker-runner-exec = { enable = true; wantedBy = [ "multi-user.target" ]; ### MANUALLY RESTART SERVICE IF CHANGED restartIfChanged = true; confinement.enable = true; confinement.packages = [ pkgs.git pkgs.gnutar pkgs.bash pkgs.nixFlakes pkgs.gzip ]; path = [ pkgs.git pkgs.gnutar pkgs.bash pkgs.nixFlakes pkgs.gzip ]; serviceConfig = { Environment = [ "WOODPECKER_RUNNER_CAPACITY=2" "WOODPECKER_RUNNER_NAME=woodpecker-agent" "NIX_REMOTE=daemon" "PAGER=cat" ]; BindPaths = [ "/nix/var/nix/daemon-socket/socket" "/run/nscd/socket" # "/var/lib/woodpecker" ]; BindReadOnlyPaths = [ "/etc/passwd:/etc/passwd" "/etc/group:/etc/group" "/nix/var/nix/profiles/system/etc/nix:/etc/nix" "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt" "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts" "${builtins.toFile "ssh_config" '' Host git.sealight.xyz ForwardAgent yes ''}:/etc/ssh/ssh_config" "/etc/machine-id" "/etc/resolv.conf" "/nix/" ]; EnvironmentFile = [ # /run/agenix/woodpecker-agent-secret ]; ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent"; User = "woodpecker-runner"; Group = "woodpecker-runner"; }; }; }