From d0248da4b973987de0426d50ed69e5972354eec7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cyryl=20P=C5=82otnicki?= <cyplo@cyplo.dev>
Date: Sat, 12 Aug 2023 14:43:42 +0100
Subject: [PATCH] control dns settings for ci

---
 nixos/boxes/bolty/gitea-runner-config | 87 +++++++++++++++++++++++++++
 nixos/boxes/bolty/gitea-runner.nix    |  7 ++-
 2 files changed, 91 insertions(+), 3 deletions(-)
 create mode 100644 nixos/boxes/bolty/gitea-runner-config

diff --git a/nixos/boxes/bolty/gitea-runner-config b/nixos/boxes/bolty/gitea-runner-config
new file mode 100644
index 00000000..87abe2c2
--- /dev/null
+++ b/nixos/boxes/bolty/gitea-runner-config
@@ -0,0 +1,87 @@
+# Example configuration file, it's safe to copy this as the default config file without any modification.
+
+# You don't have to copy this file to your instance,
+# just run `./act_runner generate-config > config.yaml` to generate a config file.
+
+log:
+  # The level of logging, can be trace, debug, info, warn, error, fatal
+  level: info
+
+runner:
+  # Where to store the registration result.
+  file: .runner
+  # Execute how many tasks concurrently at the same time.
+  capacity: 2
+  # Extra environment variables to run jobs.
+  envs:
+    A_TEST_ENV_NAME_1: a_test_env_value_1
+    A_TEST_ENV_NAME_2: a_test_env_value_2
+  # Extra environment variables to run jobs from a file.
+  # It will be ignored if it's empty or the file doesn't exist.
+  env_file: .env
+  # The timeout for a job to be finished.
+  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+  # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+  timeout: 1h
+  # Whether skip verifying the TLS certificate of the Gitea instance.
+  insecure: false
+  # The timeout for fetching the job from the Gitea instance.
+  fetch_timeout: 5s
+  # The interval for fetching the job from the Gitea instance.
+  fetch_interval: 2s
+  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+  # Like: ["macos-arm64:host", "ubuntu-latest:docker://node:16-bullseye", "ubuntu-22.04:docker://node:16-bullseye"]
+  # If it's empty when registering, it will ask for inputting labels.
+  # If it's empty when execute `deamon`, will use labels in `.runner` file.
+  labels: []
+
+cache:
+  # Enable cache server to use actions/cache.
+  enabled: true
+  # The directory to store the cache data.
+  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+  dir: ""
+  # The host of the cache server.
+  # It's not for the address to listen, but the address to connect from job containers.
+  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+  host: ""
+  # The port of the cache server.
+  # 0 means to use a random available port.
+  port: 0
+  # The external cache server URL. Valid only when enable is true.
+  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+  # The URL should generally end with "/".
+  external_server: ""
+
+container:
+  # Specifies the network to which the container will connect.
+  # Could be host, bridge or the name of a custom network.
+  # If it's empty, act_runner will create a network automatically.
+  network: ""
+  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+  privileged: false
+  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+  options: --dns=9.9.9.9
+  # The parent directory of a job's working directory.
+  # If it's empty, /workspace will be used.
+  workdir_parent:
+  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+  # valid_volumes:
+  #   - data
+  #   - /src/*.json
+  # If you want to allow any volume, please use the following configuration:
+  # valid_volumes:
+  #   - '**'
+  valid_volumes: []
+  # overrides the docker client host with the specified one.
+  # If it's empty, act_runner will find an available docker host automatically.
+  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+  docker_host: ""
+
+host:
+  # The parent directory of a job's working directory.
+  # If it's empty, $HOME/.cache/act/ will be used.
+  workdir_parent:
diff --git a/nixos/boxes/bolty/gitea-runner.nix b/nixos/boxes/bolty/gitea-runner.nix
index 72a3ce1e..684b3303 100644
--- a/nixos/boxes/bolty/gitea-runner.nix
+++ b/nixos/boxes/bolty/gitea-runner.nix
@@ -8,12 +8,11 @@ in
     sopsFile = ./gitea-runner-token.sops;
     format = "binary";
   };
-  virtualisation.podman = {
+  virtualisation.docker = {
     enable = true;
     autoPrune.enable = true;
-    defaultNetwork.settings = { 
+    daemon.settings = { 
       dns = ["9.9.9.9"];  
-      dns_enabled = false;
     };
   };
   disabledModules = [ "services/continuous-integration/gitea-actions-runner.nix" ];
@@ -45,4 +44,6 @@ in
       ];
     };
   };
+  environment.etc."gitea-actions-runner/config".text = (builtins.readFile ./gitea-runner-config);
+  systemd.services.gitea-runner-bolty1.serviceConfig.ExecStart = lib.mkForce "${package}/bin/act_runner -c /etc/gitea-actions-runner/config daemon";
 }