root/the_prg_server_configuration
1
0
Fork 0
mirror of https://codeberg.org/polyteknisk-radiogruppe/the_prg_server_configuration.git synced 2026-10-21 03:15:46 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add Github Actions support to the build machine.

Browse source
This commit is contained in:
Root User 2026-10-05 11:47:10 +02:00
parent 4732cc0722
commit b0a415a7ee
Signed by: root
GPG key ID: 087F0A95E5766D72
5 changed files with 113 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

47
nix-system-configs/modules/system/build_machine.nix
View file

@ -191,6 +191,7 @@ in {
}
];
networking.defaultGateway = "10.1.1.1";
networking.resolvconf.enable = false;
environment.etc."resolv.conf".text = ''
nameserver 10.1.1.2
'';
@ -218,6 +219,52 @@ in {
};
};
users.groups.github-runner = {};
users.users.github-runner = {
isSystemUser = true;
group = "github-runner";
home = "/var/lib/github-runner";
createHome = true;
};
services.github-runners.build-machine = {
enable = true;
user = "github-runner";
group = "github-runner";
name = "nixos-build-machine";
url = "https://github.com/bitcoin-dev-tools";
tokenFile = "/run/github-runner-token";
ephemeral = true;
replace = true;
extraLabels = ["nixos" "build-machine"];
};
systemd.services.github-runner-build-machine = {
requires = ["sops-nix.service"];
after = ["sops-nix.service"];
serviceConfig.ExecStartPre = lib.mkBefore [
"+${pkgs.writeShellScript "prepare-github-runner-token" ''
set -eu
token="$(<${config.sops.secrets.github_runner_token.path})"
case "$token" in
TOKEN=*) token="''${token#TOKEN=}" ;;
*)
echo "GitHub runner token secret must use TOKEN=<token> format" >&2
exit 1
;;
esac
if [ -z "$token" ] || [[ "$token" == *$'\n'* ]]; then
echo "GitHub runner token secret must contain one non-empty token" >&2
exit 1
fi
token_file=/run/github-runner-token
printf '%s' "$token" > "$token_file.tmp"
chmod 0400 "$token_file.tmp"
mv -f "$token_file.tmp" "$token_file"
''}"
];
};
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave