Koen/nix-config
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Foregejo containers fully operational

Browse source
This commit is contained in:
KoenDR06 2025-12-25 13:11:54 +01:00
parent 2de1a62d2f
commit f1b3559434
4 changed files with 55 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

31
modules/base/secrets.nix
View file

@ -6,7 +6,7 @@
}: let
inherit (lib) mkEnableOption mkIf;
cfg = config.horseman.base.secrets;
secretFile = path: ../../secrets/${path};
secretFile = path: ../../secrets/${path}.age;
username = config.horseman.username;
in {
options = {
@ -19,38 +19,45 @@ in {
environment.systemPackages = [pkgs.ragenix];
age.secrets = {
wifi.file = secretFile "wifi.age";
wifi.file = secretFile "wifi";
personalSSHpub = {
file = secretFile "ssh/id_personal.pub.age";
file = secretFile "ssh/id_personal.pub";
owner = username;
group = "users";
path = "/home/horseman/.ssh/id_ed25519.pub";
path = "/home/${username}/.ssh/id_ed25519.pub";
};
personalSSH = {
file = secretFile "ssh/id_personal.age";
file = secretFile "ssh/id_personal";
owner = username;
group = "users";
path = "/home/horseman/.ssh/id_ed25519";
path = "/home/${username}/.ssh/id_ed25519";
};
githubSSHpub = {
file = secretFile "ssh/id_github.pub.age";
file = secretFile "ssh/id_github.pub";
owner = username;
group = "users";
path = "/home/horseman/.ssh/id_github.pub";
path = "/home/${username}/.ssh/id_github.pub";
};
githubSSH = {
file = secretFile "ssh/id_github.age";
file = secretFile "ssh/id_github";
owner = username;
group = "users";
path = "/home/horseman/.ssh/id_github";
path = "/home/${username}/.ssh/id_github";
};
sshConfig = {
file = secretFile "ssh/config.age";
file = secretFile "ssh/config";
owner = username;
group = "users";
path = "/home/horseman/.ssh/config";
path = "/home/${username}/.ssh/config";
};
forgejo-secret = {
file = secretFile "containers/forgejo-secret";
path = "/run/forgejo-secrets/secret";
symlink = false;
mode = "444";
};
};
};

23
modules/containers/forgejo.nix
View file

@ -13,10 +13,8 @@
HTTP_PORT = 3000;
SSH_PORT = 34916;
INSTANCE_URL = "http://local.git.server:3000";
SECRET = "7c31591e8b67225a116d4a4519ea8e507e08f71f"; # TODO REMOVE
DATA_DIR = "/home/${username}/backups/volumes/forgejo";
DATA_DIR = "/home/${username}/backups/volumes/forgejo";
BACKUP_FILE = "/home/${username}/backups/forgejo.tar";
in {
options = {
horseman.containers.forgejo = {
@ -27,7 +25,6 @@ in {
config = mkIf cfg.enable {
networking.extraHosts = "192.168.100.3 local.git.server";
systemd.timers."backup-forgejo" = {
wantedBy = ["timers.target"];
timerConfig = {
@ -36,7 +33,7 @@ in {
};
};
environment.systemPackages = [ pkgs.gnutar ];
environment.systemPackages = [pkgs.gnutar];
systemd.services."backup-forgejo" = {
script = ''
${pkgs.gnutar} -cf ${BACKUP_FILE} ${DATA_DIR}
@ -52,6 +49,13 @@ in {
hostAddress = "172.16.0.2";
localAddress = "192.168.100.2";
bindMounts = {
"/var/lib/secrets" = {
hostPath = "/run/forgejo-secrets";
isReadOnly = true;
};
};
config = {
config,
pkgs,
@ -76,7 +80,7 @@ in {
systemd.services.startup = {
script = ''
cd ${config.users.users.runner.home}
${pkgs.forgejo-runner}/bin/forgejo-runner create-runner-file --instance http://192.168.100.3:3000 --secret ${SECRET} --name runner
${pkgs.forgejo-runner}/bin/forgejo-runner create-runner-file --instance http://192.168.100.3:3000 --secret $(cat /var/lib/secrets/secret) --name runner
sleep 10
${pkgs.forgejo-runner}/bin/forgejo-runner daemon --config ${configFile}
'';
@ -99,6 +103,11 @@ in {
hostPath = DATA_DIR;
isReadOnly = false;
};
"/var/lib/secrets" = {
hostPath = "/run/forgejo-secrets";
isReadOnly = true;
};
};
config = {
@ -130,7 +139,7 @@ in {
systemd.services.startup = {
script = ''
cd ${config.users.users.forgejo.home}
${pkgs.forgejo}/bin/forgejo forgejo-cli actions register --name runner --secret ${SECRET} --config ${config.services.forgejo.stateDir}/custom/conf/app.ini
${pkgs.forgejo}/bin/forgejo forgejo-cli actions register --name runner --secret $(cat /var/lib/secrets/secret) --config ${config.services.forgejo.stateDir}/custom/conf/app.ini
'';
serviceConfig.User = "forgejo";
wantedBy = ["multi-user.target"];