From b0a415a7eec8b45938305ca219a07cc258b27a01 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Mon, 5 Oct 2026 11:47:10 +0200 Subject: [PATCH 1/2] Add Github Actions support to the build machine. --- flake.lock | 40 +++++++++++++++- flake.nix | 12 ++++- .../secrets-config/sops-build-machine.nix | 21 ++++----- .../modules/system/build_machine.nix | 47 +++++++++++++++++++ .../secrets/build_machine/secrets.yaml | 15 +++--- 5 files changed, 113 insertions(+), 22 deletions(-) diff --git a/flake.lock b/flake.lock index e432da3..c118d73 100644 --- a/flake.lock +++ b/flake.lock @@ -68,10 +68,48 @@ "type": "github" } }, + "nixpkgs_26_05": { + "locked": { + "lastModified": 1791143449, + "narHash": "sha256-9+n3ReS2y9xS199LoJjKUWHwZrISGHWgkD/LUZTDZyA=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "0d9e9b832d03ac387417e16ce1febf73b2e631e1", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-26.05", + "repo": "nixpkgs", + "type": "github" + } + }, "root": { "inputs": { "nix-minecraft": "nix-minecraft", - "nixpkgs": "nixpkgs_2" + "nixpkgs": "nixpkgs_2", + "nixpkgs_26_05": "nixpkgs_26_05", + "sops-nix": "sops-nix" + } + }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs_26_05" + ] + }, + "locked": { + "lastModified": 1791103873, + "narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "dcd241ba97088c22569d1573286e1b9daad340c0", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" } }, "systems": { diff --git a/flake.nix b/flake.nix index 1ee1ae0..23cb1b3 100644 --- a/flake.nix +++ b/flake.nix @@ -3,12 +3,17 @@ inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; + nixpkgs_26_05.url = "github:NixOS/nixpkgs/nixos-26.05"; + sops-nix.url = "github:Mic92/sops-nix"; + sops-nix.inputs.nixpkgs.follows = "nixpkgs_26_05"; nix-minecraft.url = "github:Infinidoge/nix-minecraft"; }; outputs = inputs @ { self, nixpkgs, + nixpkgs_26_05, + sops-nix, nix-minecraft, ... }: let @@ -55,9 +60,12 @@ modules = [./nix-system-configs/modules/system/traefik.nix]; }; - "nixos-build-machine" = nixpkgs.lib.nixosSystem { + "nixos-build-machine" = nixpkgs_26_05.lib.nixosSystem { inherit system; - modules = [./nix-system-configs/modules/system/build_machine.nix]; + modules = [ + sops-nix.nixosModules.sops + ./nix-system-configs/modules/system/build_machine.nix + ]; }; "nixos-logs" = nixpkgs.lib.nixosSystem { diff --git a/nix-system-configs/modules/secrets-config/sops-build-machine.nix b/nix-system-configs/modules/secrets-config/sops-build-machine.nix index 75b9931..4953eea 100644 --- a/nix-system-configs/modules/secrets-config/sops-build-machine.nix +++ b/nix-system-configs/modules/secrets-config/sops-build-machine.nix @@ -4,18 +4,7 @@ lib, ... }: { - imports = let - # replace this with an actual commit id or tag - commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c"; - in [ - "${builtins.fetchTarball { - url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz"; - # replace this with an actual hash - sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY="; - }}/modules/sops" - ]; - - # This will add secrets.yml to the nix store + # This will add secrets.yml to the Nix store # You can avoid this by adding a string to the full path instead, i.e. # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml; @@ -34,4 +23,12 @@ owner = "root"; mode = "0400"; }; + + sops.secrets."github_runner_token" = { + format = "yaml"; + sopsFile = ../../secrets/build_machine/secrets.yaml; + owner = "root"; + mode = "0400"; + restartUnits = ["github-runner-build-machine.service"]; + }; } diff --git a/nix-system-configs/modules/system/build_machine.nix b/nix-system-configs/modules/system/build_machine.nix index c957e74..54c61a6 100644 --- a/nix-system-configs/modules/system/build_machine.nix +++ b/nix-system-configs/modules/system/build_machine.nix @@ -191,6 +191,7 @@ in { } ]; networking.defaultGateway = "10.1.1.1"; + networking.resolvconf.enable = false; environment.etc."resolv.conf".text = '' nameserver 10.1.1.2 ''; @@ -218,6 +219,52 @@ in { }; }; + users.groups.github-runner = {}; + users.users.github-runner = { + isSystemUser = true; + group = "github-runner"; + home = "/var/lib/github-runner"; + createHome = true; + }; + + services.github-runners.build-machine = { + enable = true; + user = "github-runner"; + group = "github-runner"; + name = "nixos-build-machine"; + url = "https://github.com/bitcoin-dev-tools"; + tokenFile = "/run/github-runner-token"; + ephemeral = true; + replace = true; + extraLabels = ["nixos" "build-machine"]; + }; + + systemd.services.github-runner-build-machine = { + requires = ["sops-nix.service"]; + after = ["sops-nix.service"]; + serviceConfig.ExecStartPre = lib.mkBefore [ + "+${pkgs.writeShellScript "prepare-github-runner-token" '' + set -eu + token="$(<${config.sops.secrets.github_runner_token.path})" + case "$token" in + TOKEN=*) token="''${token#TOKEN=}" ;; + *) + echo "GitHub runner token secret must use TOKEN= format" >&2 + exit 1 + ;; + esac + if [ -z "$token" ] || [[ "$token" == *$'\n'* ]]; then + echo "GitHub runner token secret must contain one non-empty token" >&2 + exit 1 + fi + token_file=/run/github-runner-token + printf '%s' "$token" > "$token_file.tmp" + chmod 0400 "$token_file.tmp" + mv -f "$token_file.tmp" "$token_file" + ''}" + ]; + }; + # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It‘s perfectly fine and recommended to leave diff --git a/nix-system-configs/secrets/build_machine/secrets.yaml b/nix-system-configs/secrets/build_machine/secrets.yaml index 019b967..8ee6ccd 100644 --- a/nix-system-configs/secrets/build_machine/secrets.yaml +++ b/nix-system-configs/secrets/build_machine/secrets.yaml @@ -1,8 +1,8 @@ runner_token: ENC[AES256_GCM,data:SEN4lL2cxkM/cExdasB2zIV3EDJcBIZOAr1ab6aLagPVReZ8UTaFKgMctnLIkA==,iv:EMUQW8ufCnbCeN3PmSoxBsHLukwS4yNSA3xor89uNxE=,tag:V8RDaeGMI4ReZrGTw9V2Qw==,type:str] +github_runner_token: ENC[AES256_GCM,data:zu1nICWyNdZF5om9Mi3sRbaeBWPfB/J52sSTDeSii5sVVZg=,iv:CZE/TXVX3NfYfj9xCTTHkiqTN50sEISRhypGAPQdzEg=,tag:uqq9IYbYuKIcLPm4BMkT6A==,type:str] sops: age: - - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WEE5MUJiK0tUSmZMMXVq LzdON0trT0NYbXZXdkluak9xQVlHM0F2OVI4CnFmaEpEdEVMalgxQjJMalp3Mjl3 @@ -10,8 +10,8 @@ sops: TFZpeGwrM2V3aWRybGE2WVNQRW5QV0kKdJb7svK5k5rYMtfiTsJy5QE3+1MP04jz zadKKK+kDaK+h4AmkFGLRoKLpJoEU2nEUo2FD4LxiGOOvSXmeOUxbw== -----END AGE ENCRYPTED FILE----- - - recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca - enc: | + recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUEdoMkVyMjVsOG1LYkRW M08xemlxRHU4THRidWZXZFhEdXFBV05YUFZRCjlpeERUbWVjY0cxMlk5elk1VHFn @@ -19,7 +19,8 @@ sops: U3hva2JqWUdjR2JzTmpFanppUk5MTmsKwD8rlnddUQkgtuZLTgpmS4jGRmgNReUN mEx0pxnWIIrLUGRgwE3WDbBVRTqVo1ai6BZY3FzBCnXU6zbNwYhqIg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-12T17:12:42Z" - mac: ENC[AES256_GCM,data:Z888IrMcNO0VwoliGoLS8SsZPffXvH2yY6w9y3i7laepvrq2dW2a3fx+urwzgYfpJBLMJQNJ10SauBINlgIYp5KYf1dMRSsLBbwIsJi90lmqmRSNmNdQmkJdwi4MhmQxbZmHpwrxwFrx9EAkWdWXKlMBCkO2WJxNVQdYVty2bNs=,iv:FssN2HByfcbgFY5NKEyadyrrdidFx5iHaEXX2rDLYvw=,tag:bRGpOVzv26kjOswlQC7aoA==,type:str] + recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca + lastmodified: "2026-10-05T09:26:20Z" + mac: ENC[AES256_GCM,data:oM69M815SR0TDzUOrMbXanXd5vikDgADhFmXvY6VrhWSoRwweApiLsKjT1IxdH3yQCQVLdsGIhU8/0+Ke3ZZ64TBYYi8cBp+7Uua4UHqCz1ouwXVSO7/aVOQciySMxV2+fftZu0tUn8rdvAdpdPrucadgYLGmF9vJM4hSo7xy+4=,iv:Y19E6AftjLw3FRmxC2LykwSgVnv6UOK6K+3UyVaBTZg=,tag:D7AFDR5+hxm4YSFydLetVg==,type:str] unencrypted_suffix: _unencrypted - version: 3.11.0 + version: 3.13.3 From 44532cc3a36bf5ca92e22585eebcebe3a0fc304e Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Mon, 5 Oct 2026 12:04:28 +0200 Subject: [PATCH 2/2] Normalise snake cases as dashes. --- nix-system-configs/modules/scripts/pull.zsh | 15 +++++++++------ nix-system-configs/modules/scripts/push.zsh | 14 ++++++++------ 2 files changed, 17 insertions(+), 12 deletions(-) diff --git a/nix-system-configs/modules/scripts/pull.zsh b/nix-system-configs/modules/scripts/pull.zsh index 72f5051..37e7ff6 100755 --- a/nix-system-configs/modules/scripts/pull.zsh +++ b/nix-system-configs/modules/scripts/pull.zsh @@ -210,12 +210,15 @@ fi # Step 4: Rebuild system using local flake # Compute repository root (three levels up from this script: .../nix-system-configs/modules/scripts -> repo root) FLAKE_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)" -# Normalize selected system name to flake nixosConfigurations naming convention (prefix with 'nixos-' if missing) -if [[ "${selected_system}" == nixos-* ]]; then - flake_name="${selected_system}" -else - flake_name="nixos-${selected_system}" -fi +# Map repository configuration filenames to flake nixosConfigurations names. +# Normalise the snake-cases as dashes. +case "${selected_system}" in + blank_system_USE_THIS_AS_COPY) flake_name="nixos-blank" ;; + gramethus) flake_name="nixos-logs" ;; + wireguard_server) flake_name="nixos-local-wireguard-server" ;; + nixos-*) flake_name="${selected_system}" ;; + *) flake_name="nixos-${selected_system//_/-}" ;; +esac # If the selected system is the database module, use the standard non-flake rebuild if [[ "${selected_system}" == "database" ]]; then diff --git a/nix-system-configs/modules/scripts/push.zsh b/nix-system-configs/modules/scripts/push.zsh index 522c724..becbf48 100755 --- a/nix-system-configs/modules/scripts/push.zsh +++ b/nix-system-configs/modules/scripts/push.zsh @@ -102,12 +102,14 @@ echo "" # Step 1: Rebuild system print_info "Rebuilding NixOS system..." -# Normalize selected system name to flake nixosConfigurations naming convention (prefix with 'nixos-' if missing) -if [[ "${selected_system}" == nixos-* ]]; then - flake_name="${selected_system}" -else - flake_name="nixos-${selected_system}" -fi +# Map repository configuration filenames to flake nixosConfigurations names. +case "${selected_system}" in + blank_system_USE_THIS_AS_COPY) flake_name="nixos-blank" ;; + gramethus) flake_name="nixos-logs" ;; + wireguard_server) flake_name="nixos-local-wireguard-server" ;; + nixos-*) flake_name="${selected_system}" ;; + *) flake_name="nixos-${selected_system//_/-}" ;; +esac echo "" if sudo NIX_CONFIG='experimental-features = nix-command flakes' nixos-rebuild switch --upgrade-all --flake "${PWD}#${flake_name}"; then