initial commit

2026-08-31 08:41:45 -05:00
commit 76fa38e34c
54 changed files with 6747 additions and 0 deletions
@@ -0,0 +1,178 @@
+{
+  name,
+  hostInfo,
+  dsl,
+  ...
+}:
+let
+  inherit (dsl) mkContainer mkVm;
+  inherit (hostInfo.paths) data secrets;
+
+  ciRunnerData = "${data}/web/git-ci-runner";
+  ciRunnerSecrets = "${secrets}/ci-runner";
+in
+{
+  ${name} = mkContainer {
+    inherit name;
+    net.access = [ { to = "@internet"; } ];
+    net.forward.tcp = [
+      {
+        host = 23;
+        container = 8023;
+      }
+    ];
+    svc.autoStart = true;
+    resources.fs."/var/lib/gitea" = {
+      hostPath = "${data}/web/git";
+      isReadOnly = false;
+    };
+    containerConfig = _: {
+      services.gitea = {
+        enable = true;
+        stateDir = "/var/lib/gitea";
+        settings = {
+          server = {
+            HTTP_ADDR = "0.0.0.0";
+            HTTP_PORT = 3000;
+            DOMAIN = "git.floweytf.com";
+            ROOT_URL = "https://git.floweytf.com/";
+            START_SSH_SERVER = true;
+            BUILTIN_SSH_SERVER_USER = "git";
+            SSH_PORT = 8023;
+          };
+          service.DISABLE_REGISTRATION = true;
+        };
+      };
+      users.users.gitea.uid = 1000;
+      users.groups.gitea.gid = 1000;
+      time.timeZone = "UTC";
+      systemd.services.gitea.serviceConfig.FailureAction = "exit-force";
+    };
+    net.expose.tcp = [ 3000 ];
+  };
+
+  ci-runner = mkVm {
+    name = "ci-runner";
+    net.access = [
+      {
+        to = "git";
+        tcp = [ 3000 ];
+      }
+      { to = "@internet"; }
+    ];
+    svc.autoStart = true;
+    resources.cpu = 4;
+    resources.mem = "8G";
+    resources.fs = [
+      {
+        proto = "virtiofs";
+        tag = "nix-rw-store";
+        source = "${ciRunnerData}/nix-rw-store";
+        mountPoint = "/nix/.rw-store";
+      }
+      {
+        proto = "virtiofs";
+        tag = "docker-data";
+        source = "${ciRunnerData}/docker";
+        mountPoint = "/var/lib/docker";
+      }
+      {
+        proto = "virtiofs";
+        tag = "runner-state";
+        source = "${ciRunnerData}/runner-state";
+        mountPoint = "/var/lib/gitea-runner";
+      }
+      {
+        proto = "virtiofs";
+        tag = "runner-token";
+        source = ciRunnerSecrets;
+        mountPoint = "/run/ci-runner-secrets";
+        readOnly = true;
+      }
+    ];
+    guestConfig =
+      {
+        pkgs,
+        utils,
+        lib,
+        ...
+      }:
+      let
+        runnerInstanceName = "ci-runner";
+
+        ciJobImage = pkgs.dockerTools.buildLayeredImage {
+          name = "ci-job-image";
+          tag = "latest";
+          contents = with pkgs; [
+            bashInteractive
+            coreutils
+            gitMinimal
+            nixVersions.latest
+            nodejs
+            cacert
+          ];
+          config = {
+            Cmd = [ "/bin/sh" ];
+            Env = [
+              "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+              "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+              "NIX_REMOTE=daemon"
+            ];
+          };
+        };
+      in
+      {
+        boot.kernelModules = [ "kvm-intel" ];
+        boot.extraModprobeConfig = "options kvm_intel nested=1";
+
+        microvm.writableStoreOverlay = "/nix/.rw-store";
+
+        nix.settings = {
+          experimental-features = [
+            "nix-command"
+            "flakes"
+          ];
+          max-jobs = "auto";
+        };
+
+        nix.gc = {
+          automatic = true;
+          dates = "daily";
+          options = "--delete-older-than 14d";
+        };
+        # nix.optimise.automatic = true; - doesn't work with microvm.writableStoreOverlay
+
+        virtualisation.docker.enable = true;
+
+        systemd.services.load-ci-job-image = {
+          description = "Load the CI job Docker image";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "docker.service" ];
+          requires = [ "docker.service" ];
+          before = [ "gitea-runner-${utils.escapeSystemdPath runnerInstanceName}.service" ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = "${lib.getExe' pkgs.docker "docker"} load -i ${ciJobImage}";
+          };
+        };
+
+        services.gitea-actions-runner.instances.${runnerInstanceName} = {
+          enable = true;
+          name = runnerInstanceName;
+          url = "http://git:3000/";
+          tokenFile = "/run/ci-runner-secrets/token";
+          labels = [
+            "nix:docker://ci-job-image:latest"
+          ];
+          settings.container = {
+            options = "--device=/dev/kvm --volume=/nix/store:/nix/store:ro --volume=/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket";
+            valid_volumes = [
+              "/nix/store"
+              "/nix/var/nix/daemon-socket"
+            ];
+          };
+        };
+      };
+  };
+}