root/the_prg_server_configuration
1
0
Fork 0
mirror of https://codeberg.org/polyteknisk-radiogruppe/the_prg_server_configuration.git synced 2026-10-21 03:15:46 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add Github Actions support to the build machine.

Browse source
This commit is contained in:
Root User 2026-10-05 11:47:10 +02:00
parent 4732cc0722
commit b0a415a7ee
Signed by: root
GPG key ID: 087F0A95E5766D72
5 changed files with 113 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

21
nix-system-configs/modules/secrets-config/sops-build-machine.nix
View file

@ -4,18 +4,7 @@
lib,
...
}: {
imports = let
# replace this with an actual commit id or tag
commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
in [
"${builtins.fetchTarball {
url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
# replace this with an actual hash
sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
}}/modules/sops"
];
# This will add secrets.yml to the nix store
# This will add secrets.yml to the Nix store
# You can avoid this by adding a string to the full path instead, i.e.
# sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml;
@ -34,4 +23,12 @@
owner = "root";
mode = "0400";
};
sops.secrets."github_runner_token" = {
format = "yaml";
sopsFile = ../../secrets/build_machine/secrets.yaml;
owner = "root";
mode = "0400";
restartUnits = ["github-runner-build-machine.service"];
};
}

47
nix-system-configs/modules/system/build_machine.nix
View file

@ -191,6 +191,7 @@ in {
}
];
networking.defaultGateway = "10.1.1.1";
networking.resolvconf.enable = false;
environment.etc."resolv.conf".text = ''
nameserver 10.1.1.2
'';
@ -218,6 +219,52 @@ in {
};
};
users.groups.github-runner = {};
users.users.github-runner = {
isSystemUser = true;
group = "github-runner";
home = "/var/lib/github-runner";
createHome = true;
};
services.github-runners.build-machine = {
enable = true;
user = "github-runner";
group = "github-runner";
name = "nixos-build-machine";
url = "https://github.com/bitcoin-dev-tools";
tokenFile = "/run/github-runner-token";
ephemeral = true;
replace = true;
extraLabels = ["nixos" "build-machine"];
};
systemd.services.github-runner-build-machine = {
requires = ["sops-nix.service"];
after = ["sops-nix.service"];
serviceConfig.ExecStartPre = lib.mkBefore [
"+${pkgs.writeShellScript "prepare-github-runner-token" ''
set -eu
token="$(<${config.sops.secrets.github_runner_token.path})"
case "$token" in
TOKEN=*) token="''${token#TOKEN=}" ;;
*)
echo "GitHub runner token secret must use TOKEN=<token> format" >&2
exit 1
;;
esac
if [ -z "$token" ] || [[ "$token" == *$'\n'* ]]; then
echo "GitHub runner token secret must contain one non-empty token" >&2
exit 1
fi
token_file=/run/github-runner-token
printf '%s' "$token" > "$token_file.tmp"
chmod 0400 "$token_file.tmp"
mv -f "$token_file.tmp" "$token_file"
''}"
];
};
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave