move modules to git

2023-08-19 14:31:22 +02:00
parent edb55af964
commit 993aef1ece
7 changed files with 11 additions and 13 deletions
--- a/hosts/git.cloonar.com/modules/drone/runner.nix
+++ b/hosts/git.cloonar.com/modules/drone/runner.nix
@@ -0,0 +1,48 @@
+{ config, pkgs, ... }:
+
+{
+  virtualisation.docker.enable = true;
+
+  users.users.drone-runner = {
+    isSystemUser = true;
+    group = "drone-runner";
+    home = "/var/lib/drone-runner";
+    createHome = true;
+  };
+  users.groups.drone-runner = { };
+  users.groups.docker.members = [ "drone-runner" ];
+
+  systemd.services.drone-runner = {
+    description = "Drone Runner (CI CD Service)";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    path = [ pkgs.docker ];
+
+    serviceConfig = {
+      # Type = "simple";
+      Name = "drone-runner";
+      User = "drone-runner";
+      Group = "drone-runner";
+      Restart = "always";
+      ExecStartPre= ''
+        -${pkgs.docker}/bin/docker stop %n \
+        -${pkgs.docker}/bin/docker rm %n \
+        ${pkgs.docker}/bin/docker pull drone/drone:1
+      '';
+      ExecStart= ''
+        ${pkgs.docker}/bin/docker run --rm --name %n \
+        --volume=/var/run/docker.sock:/var/run/docker.sock \
+        --env-file=/run/secrets/drone-runner \
+        --env=DRONE_RPC_PROTO=https \
+        --env=DRONE_RPC_HOST=drone.cloonar.com \
+        --env=DRONE_RUNNER_CAPACITY=2 \
+        drone/drone-runner-docker:1
+      '';
+    };
+  };
+
+  sops.secrets.drone-runner = {
+    owner = config.systemd.services.drone-runner.serviceConfig.User;
+    key = "drone";
+  };
+}
--- a/hosts/git.cloonar.com/modules/drone/secrets.yaml
+++ b/hosts/git.cloonar.com/modules/drone/secrets.yaml
@@ -0,0 +1,30 @@
+drone: ENC[AES256_GCM,data:Z1Rjso+5XYfvp2xJDXCQkI88GXl83v2oEkMLmOV/rb0DwRmhxCYzYX6fcdidk271Drf1YaPstVvm2LQB38jlBnJtg98aAGegj2fWfT44IbPIi8qDe93M2gFxFDgosoA2eOS2MjEwyBDp9GEUnKyi2gHR8khnTCvegVIntsusWOW/1tbzymKXavZAJUlX+82d/+6NWUEcnbislxhyph8P1Lgw546q,iv:SllCBHlq8ZCBqOHwMaCUcX6D/VDWsbN7uICZKb/R35w=,tag:mEb4E02VUaYGVjyI30FcXA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age16veg3fmvpfm7a89a9fc8dvvsxmsthlm70nfxqspr6t8vnf9wkcwsvdq38d
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0OW1JN0hjYjh4cDlmLyt6
+            dHRlSjN6Y1JWUFdzNWlZZ3c0Z2F4bXBCa1NFCjM3b3pPZVhtbDdob3lsR2xlMmJI
+            bjRRMHFjQ2kwWWJKT1p5VW5NVGJuZ3MKLS0tICtRcTFoSmxyeUhaaVlxQUxRWkJl
+            SXR2M293UFBxNFovRnlTQ1o4SzloaEEK+onGdd/7aEF71ibLoLXE5/SbJQWsKigh
+            h8BhfT1z9P5UYNoGHVv8Ry6LndyrBLEv+PUBuT0XJpEVPjKLm99KbQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age106n5n3rrrss45eqqzz8pq90la3kqdtnw63uw0sfa2mahk5xpe30sxs5x58
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyL3dDczRNMjNQUWVjelR5
+            TG93QUFjVGtMNFplaTErOTJjT2dHbWtWUVNzCjNTV0tUY2hpcnp1SDZ4UTB2aFNI
+            M2JwSkdNS0RFQVlPRUNzRG41aW5aS3cKLS0tIEJtaTRXdTI3NGJxZENJTk9jT1hi
+            N3RLRjdkMmZkSmZWZGlYbXRRUTJOZFEK2bJo7iyE3A5ds7tW5bAHgyfGqgH4cRjY
+            hLzYp083QYbXKAqP1w8a3JFXofv1RWd7tUb61I6R4Rd6hXZUv1a5Qw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-02-10T12:35:53Z"
+    mac: ENC[AES256_GCM,data:44J9abLbHkvjAtIUqXVZlcEAnizgg5yxKwyaZhnqIzzebWEpzqcKP6b72blaD7/jSdAiUo7bk/m4BxKVGHf9XKGxyLastbgYoFtz40rsKg9LOKpEfO2kl3JV5dj7C1f8IgsHWZ8L3Vb6KFKcrK2bzjZ5K5p22hCze4lQbK7CZTE=,iv:TE+6juCOTjTrx5nQhi8W5gaZkMFYrEDtoPrGdSTJSNE=,tag:AVsCIkzPjtfk3uSlsv6Dlg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
--- a/hosts/git.cloonar.com/modules/drone/server.nix
+++ b/hosts/git.cloonar.com/modules/drone/server.nix
@@ -0,0 +1,63 @@
+{ config, pkgs, ... }:
+
+{
+  virtualisation.docker.enable = true;
+
+  users.users.drone-server = {
+    isSystemUser = true;
+    group = "drone-server";
+    home = "/var/lib/drone-server";
+    createHome = true;
+  };
+  users.groups.drone-server = { };
+  users.groups.docker.members = [ "drone-server" ];
+
+  systemd.services.drone-server = {
+    description = "Drone Server (CI CD Service)";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    path = [ pkgs.docker ];
+
+    serviceConfig = {
+      # Type = "simple";
+      Name = "drone-server";
+      User = "drone-server";
+      Group = "drone-server";
+      Restart = "always";
+      ExecStartPre= ''
+        -${pkgs.docker}/bin/docker stop %n \
+        -${pkgs.docker}/bin/docker rm %n \
+        ${pkgs.docker}/bin/docker pull drone/drone:1
+      '';
+      ExecStart= ''
+        ${pkgs.docker}/bin/docker run --rm --name %n \
+        --env-file=/run/secrets/drone-server \
+        --env=DRONE_AGENTS_ENABLED=true \
+        --env=DRONE_GITEA_SERVER=https://git.cloonar.com \
+        --env=DRONE_GITEA_CLIENT_ID=6a7b8c57-bd71-49c8-b67d-c2de68fda649 \
+        --env=DRONE_GIT_ALWAYS_AUTH=true \
+        --env=DRONE_SERVER_HOST=drone.cloonar.com \
+        --env=DRONE_SERVER_PROTO=https \
+        --env=DRONE_USER_CREATE=username:dominik.polakovics,admin:true \
+        -v /var/lib/drone:/data \
+        --publish=8080:80 \
+        drone/drone:2
+      '';
+    };
+  };
+
+  services.nginx.enable = true;
+  services.nginx.virtualHosts."drone.cloonar.com" = {
+    forceSSL = true;
+    enableACME = true;
+    acmeRoot = null;
+    locations."/" = {
+      proxyPass = "http://localhost:8080";
+    };
+  };
+
+  sops.secrets.drone-server = {
+    owner = config.systemd.services.drone-server.serviceConfig.User;
+    key = "drone";
+  };
+}