87 lines
2.8 KiB
Nix
87 lines
2.8 KiB
Nix
{ config, lib, pkgs, ... }: let
|
|
# Short names to fit Linux interface name limit (15 chars for vm-fj-runner-1)
|
|
runners = ["fj-runner-1" "fj-runner-2"];
|
|
# Offset by 5 to avoid conflicts with Gitea runners (01-02)
|
|
runnerOffset = 5;
|
|
in {
|
|
microvm.vms = lib.mapAttrs (runner: idx: {
|
|
config = {
|
|
microvm = {
|
|
mem = 8096;
|
|
shares = [
|
|
{
|
|
source = "/nix/store";
|
|
mountPoint = "/nix/.ro-store";
|
|
tag = "ro-store";
|
|
proto = "virtiofs";
|
|
}
|
|
{
|
|
source = "/run/secrets";
|
|
mountPoint = "/run/secrets";
|
|
tag = "ro-token";
|
|
proto = "virtiofs";
|
|
}
|
|
];
|
|
volumes = [
|
|
{
|
|
image = "rootfs.img";
|
|
mountPoint = "/";
|
|
size = 51200;
|
|
}
|
|
];
|
|
interfaces = [
|
|
{
|
|
type = "tap";
|
|
id = "vm-${runner}";
|
|
mac = "02:00:00:00:00:0${toString (idx + runnerOffset)}";
|
|
}
|
|
];
|
|
};
|
|
|
|
systemd.network.networks."10-lan" = {
|
|
matchConfig.PermanentMACAddress = "02:00:00:00:00:0${toString (idx + runnerOffset)}";
|
|
address = [ "${config.networkPrefix}.97.5${toString (idx + runnerOffset)}/24" ];
|
|
gateway = [ "${config.networkPrefix}.97.1" ];
|
|
dns = [ "${config.networkPrefix}.97.1" ];
|
|
};
|
|
|
|
networking.hostName = runner;
|
|
|
|
virtualisation.podman.enable = true;
|
|
|
|
services.gitea-actions-runner.instances.${runner} = {
|
|
enable = true;
|
|
url = "https://git.cloonar.com";
|
|
name = runner;
|
|
tokenFile = "/run/secrets/forgejo-runner-token";
|
|
labels = [
|
|
"ubuntu-latest:docker://git.cloonar.com/infrastructure/gitea-runner:1.0.0"
|
|
];
|
|
settings = {
|
|
container = {
|
|
network = "podman";
|
|
};
|
|
cache = {
|
|
enabled = true;
|
|
host = "${config.networkPrefix}.97.5${toString (idx + runnerOffset)}";
|
|
port = 8088;
|
|
};
|
|
};
|
|
};
|
|
|
|
services.openssh.enable = true;
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDN/2SAFm50kraB1fepAizox/QRXxB7WbqVbH+5OPalDT47VIJGNKOKhixQoqhABHxEoLxdf/C83wxlCVlPV9poLfDgVkA3Lyt5r3tSFQ6QjjOJAgchWamMsxxyGBedhKvhiEzcr/Lxytnoz3kjDG8fqQJwEpdqMmJoMUfyL2Rqp16u+FQ7d5aJtwO8EUqovhMaNO7rggjPpV/uMOg+tBxxmscliN7DLuP4EMTA/FwXVzcFNbOx3K9BdpMRAaSJt4SWcJO2cS2KHA5n/H+PQI7nz5KN3Yr/upJN5fROhi/SHvK39QOx12Pv7FCuWlc+oR68vLaoCKYhnkl3DnCfc7A7"
|
|
];
|
|
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ 8088 ];
|
|
};
|
|
|
|
system.stateVersion = "22.05";
|
|
};
|
|
}) (lib.listToAttrs (lib.lists.imap1 (i: v: { name=v; value=i; }) runners));
|
|
|
|
sops.secrets.forgejo-runner-token = {};
|
|
}
|