Dmitry
9148838e12
Add the docker group to the runner services and allow passwordless nixos-rebuild for the gitea-runner user.
102 lines
2.6 KiB
Nix
102 lines
2.6 KiB
Nix
{ ... }:
|
|
|
|
{
|
|
imports = [
|
|
../../modules/base.nix
|
|
../../modules/docker.nix
|
|
../../modules/libvirtd.nix
|
|
./firewall.nix
|
|
./hardware.nix
|
|
];
|
|
|
|
networking = {
|
|
hostName = "mini-pc";
|
|
useDHCP = false;
|
|
};
|
|
|
|
systemd.network = {
|
|
enable = true;
|
|
wait-online.anyInterface = true;
|
|
networks."10-lan" = {
|
|
matchConfig.Name = "en*";
|
|
networkConfig = {
|
|
Address = "192.168.1.10/24";
|
|
Gateway = "192.168.1.1";
|
|
DNS = [
|
|
"192.168.1.1"
|
|
"1.1.1.1"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
services.resolved.enable = false;
|
|
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
services.zerotierone = {
|
|
enable = true;
|
|
joinNetworks = [
|
|
"743993800fa5a34c"
|
|
];
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /opt/data/adguard 0755 ada users - -"
|
|
"d /opt/data/adguard/work 0755 ada users - -"
|
|
"d /opt/data/caddy 0755 ada users - -"
|
|
"d /opt/data/gitea-runner 0755 ada users - -"
|
|
"d /opt/data/uptime-kuma 0755 ada users - -"
|
|
"d /opt/data/vaultwarden 0755 ada users - -"
|
|
"d /opt/data/zerotier 0755 ada users - -"
|
|
"d /opt/configs/adguard 0755 ada users - -"
|
|
"d /opt/configs/caddy 0755 ada users - -"
|
|
"d /opt/configs/caddy/lego 0755 ada users - -"
|
|
];
|
|
|
|
programs.bash.interactiveShellInit = ''
|
|
proxy_on() {
|
|
export http_proxy=http://192.168.1.10:10172
|
|
export https_proxy=http://192.168.1.10:10172
|
|
export HTTP_PROXY=http://192.168.1.10:10172
|
|
export HTTPS_PROXY=http://192.168.1.10:10172
|
|
export all_proxy=socks5://192.168.1.10:10171
|
|
export ALL_PROXY=socks5://192.168.1.10:10171
|
|
export ftp_proxy=http://192.168.1.10:10172
|
|
export FTP_PROXY=http://192.168.1.10:10172
|
|
export no_proxy=localhost,127.0.0.0/8,::1,192.168.1.0/24
|
|
export NO_PROXY=localhost,127.0.0.0/8,::1,192.168.1.0/24
|
|
}
|
|
proxy_off() {
|
|
unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY
|
|
unset all_proxy ALL_PROXY ftp_proxy FTP_PROXY
|
|
unset no_proxy NO_PROXY
|
|
}
|
|
'';
|
|
|
|
services.gitea-actions-runner.instances."mini-pc" = {
|
|
enable = true;
|
|
name = "mini-pc";
|
|
url = "https://git.ada-dev.ru";
|
|
tokenFile = "/etc/gitea-runner/mini-pc.token";
|
|
labels = [ "mini-pc" "mini-pc-nixos" ];
|
|
};
|
|
|
|
systemd.services."gitea-runner-mini-pc".serviceConfig.SupplementaryGroups = [ "docker" ];
|
|
|
|
security.sudo.extraRules = [
|
|
{
|
|
users = [ "gitea-runner" ];
|
|
commands = [
|
|
{
|
|
command = "/run/current-system/sw/bin/nixos-rebuild";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
system.stateVersion = "25.11";
|
|
}
|