From 53d578402d3707c96548b36ae03b41a3ad0095db Mon Sep 17 00:00:00 2001 From: Floweynt <50057682+Floweynt@users.noreply.github.com> Date: Thu, 10 Sep 2026 17:53:34 -0500 Subject: [PATCH] format --- containers/common/overseer.nix | 2 +- containers/server-n0/git.nix | 345 +++++++++++++++++---------------- containers/server-n0/nginx.nix | 2 +- dsl.nix | 5 +- flake.nix | 9 +- hosts/example.nix | 2 +- 6 files changed, 185 insertions(+), 180 deletions(-) diff --git a/containers/common/overseer.nix b/containers/common/overseer.nix index 5ace706..426200b 100644 --- a/containers/common/overseer.nix +++ b/containers/common/overseer.nix @@ -381,6 +381,6 @@ let }; }; }; - hostAddr = c.hostAddr; + inherit (c) hostAddr; in c diff --git a/containers/server-n0/git.nix b/containers/server-n0/git.nix index 8e20493..07786df 100644 --- a/containers/server-n0/git.nix +++ b/containers/server-n0/git.nix @@ -55,177 +55,180 @@ in net.expose.tcp = [ 3000 ]; }; - ci-runner = mkVm { - name = "ci-runner"; - includedInTests = false; - net.access = [ - { - to = "git"; - tcp = [ 3000 ]; - } - { to = "@internet"; } - ]; - svc.autoStart = true; - resources.cpu = 4; - resources.mem = "32G"; - resources.fs = [ - { - proto = "virtiofs"; - tag = "nix-rw-store"; - source = "${ciRunnerData}/nix-rw-store"; - mountPoint = "/nix/.rw-store"; - } - { - proto = "virtiofs"; - tag = "nix-db"; - source = "${ciRunnerData}/nix-db"; - mountPoint = "/nix/var/nix/db"; - } - { - proto = "virtiofs"; - tag = "docker-data"; - source = "${ciRunnerData}/docker"; - mountPoint = "/var/lib/docker"; - } - { - proto = "virtiofs"; - tag = "runner-state"; - source = "${ciRunnerData}/runner-state"; - mountPoint = "/var/lib/private/gitea-runner"; - } - { - proto = "virtiofs"; - tag = "runner-token"; - source = ciRunnerSecrets; - mountPoint = "/run/ci-runner-secrets"; - readOnly = true; - } - { - proto = "virtiofs"; - tag = "tmp"; - source = "/tmp"; - mountPoint = "/tmp"; - } - ]; - guestConfig = - { - pkgs, - utils, - lib, - ... - }: - let - runnerInstanceName = "ci-runner"; - - ciJobContents = with pkgs; [ - bashInteractive - coreutils - gitMinimal - nixVersions.latest - nodejs - cacert - (writeTextDir "etc/nix/nix.conf" "experimental-features = nix-command flakes\n") - ]; - - ciJobImage = pkgs.dockerTools.buildLayeredImage { - name = "ci-job-image"; - tag = "latest"; - contents = ciJobContents; - config = { - Cmd = [ "/bin/sh" ]; - Env = [ - "PATH=${lib.makeBinPath ciJobContents}" - "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" - "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" - "NIX_REMOTE=daemon" - ]; - }; - }; - in - { - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModprobeConfig = "options kvm_intel nested=1"; - - # volume-mounted into CI containers; must be in VM's store so - # image symlinks (/bin/node etc.) resolve through the mount - system.extraDependencies = ciJobContents; - - microvm.writableStoreOverlay = "/nix/.rw-store"; - - nix.settings = { - experimental-features = [ - "nix-command" - "flakes" - ]; - max-jobs = "auto"; - substituters = [ "https://microvm.cachix.org" ]; - trusted-public-keys = [ "microvm.cachix.org-1:oXnBc6hRE3eX5rSYdRyMYXnfzcCxC7yKPTbZXALsqys=" ]; - }; - - nix.gc = { - automatic = true; - dates = "daily"; - options = "--delete-older-than 14d"; - }; - # nix.optimise.automatic = true; - doesn't work with microvm.writableStoreOverlay - - services.openssh = { - enable = true; - settings = { - PermitRootLogin = "yes"; - PermitEmptyPasswords = "yes"; - }; - }; - users.users.root.initialHashedPassword = ""; - services.journald.extraConfig = "ForwardToConsole=yes"; - - virtualisation.containerd.enable = true; - virtualisation.containerd.settings.plugins."io.containerd.snapshotter.v1.overlayfs".mount_options = [ "userxattr" ]; - - virtualisation.docker.enable = true; - virtualisation.docker.extraOptions = "--containerd /run/containerd/containerd.sock"; - virtualisation.docker.daemon.settings.exec-opts = [ "native.cgroupdriver=cgroupfs" ]; - systemd.services.docker.wants = [ "containerd.service" ]; - systemd.services.docker.after = [ "containerd.service" ]; - - systemd.services.load-ci-job-image = { - description = "Load the CI job Docker image"; - wantedBy = [ "multi-user.target" ]; - after = [ "docker.service" ]; - requires = [ "docker.service" ]; - before = [ "gitea-runner-${utils.escapeSystemdPath runnerInstanceName}.service" ]; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - ExecStart = "${lib.getExe' pkgs.docker "docker"} load -i ${ciJobImage}"; - }; - }; - - services.gitea-actions-runner.instances.${runnerInstanceName} = { - enable = true; - name = runnerInstanceName; - url = "http://git:3000/"; - tokenFile = "/run/ci-runner-secrets/token"; - labels = [ - "nix:docker://ci-job-image:latest" - ]; - settings.container = { - options = "--device=/dev/kvm --volume=/nix/store:/nix/store:ro --volume=/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket"; - valid_volumes = [ - "/nix/store" - "/nix/var/nix/daemon-socket" - ]; - }; - }; - }; - } // { - hostConfig = { - systemd.tmpfiles.rules = [ - "d ${ciRunnerData}/nix-rw-store 0755 server server -" - "d ${ciRunnerData}/nix-db 0755 server server -" - "d ${ciRunnerData}/docker 0755 server server -" - "d ${ciRunnerData}/runner-state 0755 server server -" + ci-runner = + mkVm { + name = "ci-runner"; + includedInTests = false; + net.access = [ + { + to = "git"; + tcp = [ 3000 ]; + } + { to = "@internet"; } ]; + svc.autoStart = true; + resources.cpu = 4; + resources.mem = "32G"; + resources.fs = [ + { + proto = "virtiofs"; + tag = "nix-rw-store"; + source = "${ciRunnerData}/nix-rw-store"; + mountPoint = "/nix/.rw-store"; + } + { + proto = "virtiofs"; + tag = "nix-db"; + source = "${ciRunnerData}/nix-db"; + mountPoint = "/nix/var/nix/db"; + } + { + proto = "virtiofs"; + tag = "docker-data"; + source = "${ciRunnerData}/docker"; + mountPoint = "/var/lib/docker"; + } + { + proto = "virtiofs"; + tag = "runner-state"; + source = "${ciRunnerData}/runner-state"; + mountPoint = "/var/lib/private/gitea-runner"; + } + { + proto = "virtiofs"; + tag = "runner-token"; + source = ciRunnerSecrets; + mountPoint = "/run/ci-runner-secrets"; + readOnly = true; + } + { + proto = "virtiofs"; + tag = "tmp"; + source = "/tmp"; + mountPoint = "/tmp"; + } + ]; + guestConfig = + { + pkgs, + utils, + lib, + ... + }: + let + runnerInstanceName = "ci-runner"; + + ciJobContents = with pkgs; [ + bashInteractive + coreutils + gitMinimal + nixVersions.latest + nodejs + cacert + (writeTextDir "etc/nix/nix.conf" "experimental-features = nix-command flakes\n") + ]; + + ciJobImage = pkgs.dockerTools.buildLayeredImage { + name = "ci-job-image"; + tag = "latest"; + contents = ciJobContents; + config = { + Cmd = [ "/bin/sh" ]; + Env = [ + "PATH=${lib.makeBinPath ciJobContents}" + "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" + "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" + "NIX_REMOTE=daemon" + ]; + }; + }; + in + { + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModprobeConfig = "options kvm_intel nested=1"; + + # volume-mounted into CI containers; must be in VM's store so + # image symlinks (/bin/node etc.) resolve through the mount + system.extraDependencies = ciJobContents; + + microvm.writableStoreOverlay = "/nix/.rw-store"; + + nix.settings = { + experimental-features = [ + "nix-command" + "flakes" + ]; + max-jobs = "auto"; + substituters = [ "https://microvm.cachix.org" ]; + trusted-public-keys = [ "microvm.cachix.org-1:oXnBc6hRE3eX5rSYdRyMYXnfzcCxC7yKPTbZXALsqys=" ]; + }; + + nix.gc = { + automatic = true; + dates = "daily"; + options = "--delete-older-than 14d"; + }; + # nix.optimise.automatic = true; - doesn't work with microvm.writableStoreOverlay + + services.openssh = { + enable = true; + settings = { + PermitRootLogin = "yes"; + PermitEmptyPasswords = "yes"; + }; + }; + users.users.root.initialHashedPassword = ""; + services.journald.extraConfig = "ForwardToConsole=yes"; + + virtualisation.containerd.enable = true; + virtualisation.containerd.settings.plugins."io.containerd.snapshotter.v1.overlayfs".mount_options = + [ "userxattr" ]; + + virtualisation.docker.enable = true; + virtualisation.docker.extraOptions = "--containerd /run/containerd/containerd.sock"; + virtualisation.docker.daemon.settings.exec-opts = [ "native.cgroupdriver=cgroupfs" ]; + systemd.services.docker.wants = [ "containerd.service" ]; + systemd.services.docker.after = [ "containerd.service" ]; + + systemd.services.load-ci-job-image = { + description = "Load the CI job Docker image"; + wantedBy = [ "multi-user.target" ]; + after = [ "docker.service" ]; + requires = [ "docker.service" ]; + before = [ "gitea-runner-${utils.escapeSystemdPath runnerInstanceName}.service" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + ExecStart = "${lib.getExe' pkgs.docker "docker"} load -i ${ciJobImage}"; + }; + }; + + services.gitea-actions-runner.instances.${runnerInstanceName} = { + enable = true; + name = runnerInstanceName; + url = "http://git:3000/"; + tokenFile = "/run/ci-runner-secrets/token"; + labels = [ + "nix:docker://ci-job-image:latest" + ]; + settings.container = { + options = "--device=/dev/kvm --volume=/nix/store:/nix/store:ro --volume=/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket"; + valid_volumes = [ + "/nix/store" + "/nix/var/nix/daemon-socket" + ]; + }; + }; + }; + } + // { + hostConfig = { + systemd.tmpfiles.rules = [ + "d ${ciRunnerData}/nix-rw-store 0755 server server -" + "d ${ciRunnerData}/nix-db 0755 server server -" + "d ${ciRunnerData}/docker 0755 server server -" + "d ${ciRunnerData}/runner-state 0755 server server -" + ]; + }; }; - }; } diff --git a/containers/server-n0/nginx.nix b/containers/server-n0/nginx.nix index 52aa5c8..3c7b71d 100644 --- a/containers/server-n0/nginx.nix +++ b/containers/server-n0/nginx.nix @@ -210,6 +210,6 @@ let }; inherit (setup) containerConfig; }; - hostAddr = c.hostAddr; + inherit (c) hostAddr; in c diff --git a/dsl.nix b/dsl.nix index 8266855..1da09a6 100644 --- a/dsl.nix +++ b/dsl.nix @@ -554,7 +554,10 @@ rec { Gateway = hostAddr; }; networkConfig.DNS = [ hostAddr ]; - networkConfig.Domains = [ "~." "containers" ]; + networkConfig.Domains = [ + "~." + "containers" + ]; linkConfig.RequiredForOnline = if allowInternet then "routable" else "degraded"; }; networking.enableIPv6 = false; diff --git a/flake.nix b/flake.nix index 1e458ea..4eff366 100644 --- a/flake.nix +++ b/flake.nix @@ -129,11 +129,10 @@ { nixosConfigurations = lib.mapAttrs (_: host: host.hostCfg) allHosts; - inspect = lib.mapAttrs - (name: host: - pkgs.writeText "inspect-${name}.json" - (builtins.toJSON (introspect.hostReport { inherit host; }))) - allHosts; + inspect = lib.mapAttrs ( + name: host: + pkgs.writeText "inspect-${name}.json" (builtins.toJSON (introspect.hostReport { inherit host; })) + ) allHosts; packages.${system} = customPkgs // { inherit ci; diff --git a/hosts/example.nix b/hosts/example.nix index 194a503..609d641 100644 --- a/hosts/example.nix +++ b/hosts/example.nix @@ -1,7 +1,7 @@ _: { # New host: copy this file to hosts/.nix. Replace fileSystems/boot # below with the real hardware (see hosts/server-n0.nix for a bigger - # example). Add a containers// directory for its containers. + # example). Add a containers// directory for its containers. module = { lib, hostInfo, ... }: