Merge branch 'master' into frcc-kvm

containers/server-n0/git.nix

@@ -8,6 +8,9 @@ let
   inherit (dsl) mkContainer mkVm;
   inherit (hostInfo.paths) data secrets;
 
+  pubSshPort = 23;
+  intSshPort = 23 + 8000;
+
   ciRunnerData = "${data}/web/git-ci-runner";
   ciRunnerSecrets = "${secrets}/ci-runner";
 in
@@ -17,8 +20,8 @@ in
     net.access = [ { to = "@internet"; } ];
     net.forward.tcp = [
       {
-        host = 23;
-        container = 8023;
+        host = pubSshPort;
+        container = intSshPort;
       }
     ];
     svc.autoStart = true;
@@ -38,7 +41,8 @@ in
             ROOT_URL = "https://git.floweytf.com/";
             START_SSH_SERVER = true;
             BUILTIN_SSH_SERVER_USER = "git";
-            SSH_PORT = 8023;
+            SSH_PORT = pubSshPort;
+            SSH_LISTEN_PORT = intSshPort;
           };
           service.DISABLE_REGISTRATION = true;
         };
@@ -53,6 +57,7 @@ in
 
   ci-runner = mkVm {
     name = "ci-runner";
+    includedInTests = false;
     net.access = [
       {
         to = "git";
@@ -62,7 +67,7 @@ in
     ];
     svc.autoStart = true;
     resources.cpu = 4;
-    resources.mem = "8G";
+    resources.mem = "32G";
     resources.fs = [
       {
         proto = "virtiofs";
@@ -80,7 +85,7 @@ in
         proto = "virtiofs";
         tag = "runner-state";
         source = "${ciRunnerData}/runner-state";
-        mountPoint = "/var/lib/gitea-runner";
+        mountPoint = "/var/lib/private/gitea-runner";
       }
       {
         proto = "virtiofs";
@@ -100,20 +105,24 @@ in
       let
         runnerInstanceName = "ci-runner";
 
+        ciJobContents = with pkgs; [
+          bashInteractive
+          coreutils
+          gitMinimal
+          nixVersions.latest
+          nodejs
+          cacert
+          (writeTextDir "etc/nix/nix.conf" "experimental-features = nix-command flakes\n")
+        ];
+
         ciJobImage = pkgs.dockerTools.buildLayeredImage {
           name = "ci-job-image";
           tag = "latest";
-          contents = with pkgs; [
-            bashInteractive
-            coreutils
-            gitMinimal
-            nixVersions.latest
-            nodejs
-            cacert
-          ];
+          contents = ciJobContents;
           config = {
             Cmd = [ "/bin/sh" ];
             Env = [
+              "PATH=${lib.makeBinPath ciJobContents}"
               "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
               "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
               "NIX_REMOTE=daemon"
@@ -125,6 +134,10 @@ in
         boot.kernelModules = [ "kvm-intel" ];
         boot.extraModprobeConfig = "options kvm_intel nested=1";
 
+        # volume-mounted into CI containers; must be in VM's store so
+        # image symlinks (/bin/node etc.) resolve through the mount
+        system.extraDependencies = ciJobContents;
+
         microvm.writableStoreOverlay = "/nix/.rw-store";
 
         nix.settings = {
@@ -142,7 +155,15 @@ in
         };
         # nix.optimise.automatic = true; - doesn't work with microvm.writableStoreOverlay
 
+        services.journald.extraConfig = "ForwardToConsole=yes";
+
+        virtualisation.containerd.enable = true;
+        virtualisation.containerd.settings.plugins."io.containerd.snapshotter.v1.overlayfs".mount_options = [ "userxattr" ];
+
         virtualisation.docker.enable = true;
+        virtualisation.docker.extraOptions = "--containerd /run/containerd/containerd.sock";
+        systemd.services.docker.wants = [ "containerd.service" ];
+        systemd.services.docker.after = [ "containerd.service" ];
 
         systemd.services.load-ci-job-image = {
           description = "Load the CI job Docker image";