helm/hosts/profiles/woodpecker-agent/default.nix
2022-12-10 01:48:26 +10:00

66 lines
1.8 KiB
Nix

{
users.users.woodpecker-runner = {
isSystemUser = true;
group = "woodpecker-runner";
};
users.groups.woodpecker-runner = { };
# Allow the exec runner to write to build with nix
nix.allowedUsers = [ "woodpecker-runner" ];
systemd.services.woodpecker-runner-exec = {
enable = true;
wantedBy = [ "multi-user.target" ];
### MANUALLY RESTART SERVICE IF CHANGED
restartIfChanged = true;
confinement.enable = true;
confinement.packages = [
pkgs.git
pkgs.gnutar
pkgs.bash
pkgs.nixFlakes
pkgs.gzip
];
path = [
pkgs.git
pkgs.gnutar
pkgs.bash
pkgs.nixFlakes
pkgs.gzip
];
serviceConfig = {
Environment = [
"WOODPECKER_RUNNER_CAPACITY=2"
"WOODPECKER_RUNNER_NAME=woodpecker-agent"
"NIX_REMOTE=daemon"
"PAGER=cat"
];
BindPaths = [
"/nix/var/nix/daemon-socket/socket"
"/run/nscd/socket"
# "/var/lib/woodpecker"
];
BindReadOnlyPaths = [
"/etc/passwd:/etc/passwd"
"/etc/group:/etc/group"
"/nix/var/nix/profiles/system/etc/nix:/etc/nix"
"${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
"${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
"${builtins.toFile "ssh_config" ''
Host git.sealight.xyz
ForwardAgent yes
''}:/etc/ssh/ssh_config"
"/etc/machine-id"
"/etc/resolv.conf"
"/nix/"
];
EnvironmentFile = [
# /run/agenix/woodpecker-agent-secret
];
ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent";
User = "woodpecker-runner";
Group = "woodpecker-runner";
};
};
}