cyplo/dotfiles
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

move ci agents to bolty

Browse source
This commit is contained in:
Cyryl Płotnicki 2022-12-21 14:51:21 +00:00
parent f6b61b09e2
commit 03dfa2faef
4 changed files with 120 additions and 85 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
nixos/boxes/bolty/default.nix
View file

@ -14,6 +14,7 @@
./nix-store-server.nix
./print-server.nix
./restic-server.nix
./woodpecker-agent.nix
];
boot.binfmt.emulatedSystems = ["aarch64-linux"];
programs.ccache.enable = true;

6
nixos/boxes/bolty/nix-store-server.nix
View file

@ -3,13 +3,13 @@
pkgs,
...
}: {
networking.firewall.allowedTCPPorts = [9000 9001];
networking.firewall.allowedTCPPorts = [10000 10001];
services.minio = {
enable = true;
region = "home";
dataDir = ["/var/lib/minio/data"];
configDir = "/var/lib/minio/config";
listenAddress = ":9000";
consoleAddress = ":9001";
listenAddress = ":10000";
consoleAddress = ":10001";
};
}

116
nixos/boxes/bolty/woodpecker-agent.nix Normal file
View file

@ -0,0 +1,116 @@
{
config,
pkgs,
inputs,
lib,
...
}: let
agentPort = 9000;
domain = "ci.cyplo.dev";
uid = 2061;
gid = 3061;
systemUserName = "woodpecker";
systemGroupName = "woodpecker";
podmanGid = 994;
secretSettings = {
owner = systemUserName;
group = systemGroupName;
};
woodpeckerEnvSecretName = "woodpecker-env";
woodpeckerEnvSecretPath = "/run/secrets/${woodpeckerEnvSecretName}";
woodpeckerAgentContainer = {
autoStart = true;
forwardPorts = [
];
bindMounts = {
"${woodpeckerEnvSecretPath}" = {
hostPath = "${woodpeckerEnvSecretPath}";
isReadOnly = true;
};
"/var/run/docker.sock" = {
hostPath = "/var/run/podman/podman.sock";
isReadOnly = false;
};
};
config = {
config,
pkgs,
lib,
...
}: {
system.stateVersion = "22.11";
users = {
mutableUsers = false;
allowNoPasswordLogin = true;
users."${systemUserName}" = {
inherit uid;
isSystemUser = true;
isNormalUser = false;
group = systemGroupName;
};
groups."${systemGroupName}" = {
inherit gid;
members = ["${systemUserName}"];
};
groups."podman" = {
gid = podmanGid;
members = ["${systemUserName}"];
};
};
systemd.services.woodpecker-agent = {
wantedBy = ["multi-user.target"];
environment = {
WOODPECKER_SERVER = "${domain}:${toString agentPort}";
WOODPECKER_MAX_PROCS = "1";
WOODPECKER_DEBUG_PRETTY = "true";
WOODPECKER_LOG_LEVEL = "info";
};
serviceConfig = {
EnvironmentFile = [
woodpeckerEnvSecretPath
];
ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent";
User = systemUserName;
Group = systemGroupName;
};
};
};
};
in {
imports = [../nginx.nix];
users = {
users."${systemUserName}" = {
inherit uid;
isSystemUser = true;
isNormalUser = false;
group = systemGroupName;
extraGroups = ["podman"];
};
groups."${systemGroupName}" = {
inherit gid;
members = ["${systemUserName}"];
};
groups."podman" = {
gid = podmanGid;
members = ["${systemUserName}"];
};
};
sops.secrets."woodpecker-env" =
{
sopsFile = ../vpsfree1/gitea.sops;
format = "binary";
path = woodpeckerEnvSecretPath;
}
// secretSettings;
virtualisation.podman = {
enable = true;
};
containers.woodpecker-agent1 = woodpeckerAgentContainer;
containers.woodpecker-agent2 = woodpeckerAgentContainer;
containers.woodpecker-agent3 = woodpeckerAgentContainer;
containers.woodpecker-agent4 = woodpeckerAgentContainer;
}

82
nixos/boxes/vpsfree1/woodpecker.nix
View file

@ -14,72 +14,6 @@
gid = 3061;
systemUserName = "woodpecker";
systemGroupName = "woodpecker";
podmanGid = 994;
secretSettings = {
owner = systemUserName;
group = systemGroupName;
};
woodpeckerEnvSecretName = "woodpecker-env";
woodpeckerEnvSecretPath = "/run/secrets/${woodpeckerEnvSecretName}";
woodpeckerAgentContainer = {
autoStart = true;
forwardPorts = [
];
bindMounts = {
"${woodpeckerEnvSecretPath}" = {
hostPath = "${woodpeckerEnvSecretPath}";
isReadOnly = true;
};
"/var/run/docker.sock" = {
hostPath = "/var/run/podman/podman.sock";
isReadOnly = false;
};
};
config = {
config,
pkgs,
lib,
...
}: {
system.stateVersion = "22.11";
users = {
mutableUsers = false;
allowNoPasswordLogin = true;
users."${systemUserName}" = {
inherit uid;
isSystemUser = true;
isNormalUser = false;
group = systemGroupName;
};
groups."${systemGroupName}" = {
inherit gid;
members = ["${systemUserName}"];
};
groups."podman" = {
gid = podmanGid;
members = ["${systemUserName}"];
};
};
systemd.services.woodpecker-agent = {
wantedBy = ["multi-user.target"];
environment = {
WOODPECKER_SERVER = "${domain}:${toString agentPort}";
WOODPECKER_MAX_PROCS = "1";
WOODPECKER_DEBUG_PRETTY = "true";
WOODPECKER_LOG_LEVEL = "info";
};
serviceConfig = {
EnvironmentFile = [
woodpeckerEnvSecretPath
];
ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent";
User = systemUserName;
Group = systemGroupName;
};
};
};
};
in {
imports = [../nginx.nix];
@ -95,10 +29,6 @@ in {
inherit gid;
members = ["${systemUserName}"];
};
groups."podman" = {
gid = podmanGid;
members = ["${systemUserName}"];
};
};
services.nginx = {
@ -118,14 +48,6 @@ in {
format = "binary";
};
sops.secrets."woodpecker-env" =
{
sopsFile = ./gitea.sops;
format = "binary";
path = woodpeckerEnvSecretPath;
}
// secretSettings;
virtualisation.podman = {
enable = true;
defaultNetwork.dnsname.enable = true;
@ -149,8 +71,4 @@ in {
];
};
};
containers.woodpecker-agent1 = woodpeckerAgentContainer;
containers.woodpecker-agent2 = woodpeckerAgentContainer;
containers.woodpecker-agent3 = woodpeckerAgentContainer;
containers.woodpecker-agent4 = woodpeckerAgentContainer;
}