linde: re-add forgejo-actions-runner This reverts commit 5f1889d23096eca0609a560fe7e3663d4e735ec7.
3 files changed, 44 insertions(+), 0 deletions(-)
A secrets/codeberg-runner.age
@@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 cvV2sw rGBNdOoTbOSxRpl9zfjWCxJphuUG9j1QN5XghTWAug4 +UKyZSUnLVJEZQXEsVUBbww07w0SjEjPJXkkkJhqBydk +-> piv-p256 VBDKjg AuWZE9ThK4J+FxrB5qmgwiCU0Ypg/bWJn4iUxo9H8OCH +gegngm3vPbpbqe9cdJ0sSSujJweSk3KYlU0ucB20xaA +--- QaJ6iRKBRv6xI4I5sBCSTlxmenSYbDQFnzialrqRTvs +©Ñ»ê,¿3ÑxQ‰ÔÖ””S]¤°Ñ7éwì Ž tKÿÜÕ(ñçRÀí÷€ôh‘ùº3—_øñ+nÖ#ãvjç«›XKWk?®d4=*]Á¥Ô
M secrets/secrets.nix → secrets/secrets.nix
@@ -29,6 +29,7 @@ cifs-jellyfin = [ linde ]; ntfy = [ linde ]; readeck = [ linde ]; open-webui = [ linde ]; + codeberg-runner = [ linde ]; dyndns = [ nano ]; syncthing = [ nano ];
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -52,6 +52,7 @@ powerdns.file = ../../secrets/powerdns.age; redis-website.file = ../../secrets/redis-website.age; cifs-jellyfin.file = ../../secrets/cifs-jellyfin.age; cifs-paperless.file = ../../secrets/cifs-paperless.age; + codeberg-runner.file = ../../secrets/codeberg-runner.age; ntfy.file = ../../secrets/ntfy.age; pocket-id.file = ../../secrets/pocket-id.age; readeck.file = ../../secrets/readeck.age;@@ -254,6 +255,7 @@ 6922 ]; trustedInterfaces = [ "tailscale0" + "podman0" ]; }; resolvconf = {@@ -360,6 +362,7 @@ extraGroups = [ "wheel" "caddy" "docker" + "podman" "laminar" ]; isNormalUser = true;@@ -1101,6 +1104,34 @@ homeMode = "770"; }; users.groups.laminar.members = [ "caddy" ]; + services.gitea-actions-runner = { + package = pkgs.forgejo-runner; + instances.codeberg = { + name = "linde"; + enable = true; + url = "https://codeberg.org"; + tokenFile = config.age.secrets.codeberg-runner.path; + labels = [ + "docker:docker://node:24-alpine" + "alpine-latest:docker://node:24-alpine" + "nixos:host" + ]; + + hostPackages = with pkgs; [ + bash + coreutils + curl + gawk + gitMinimal + gnused + nix + nodejs + wget + ]; + }; + }; + virtualisation.podman.enable = true; + services.ntfy-sh = { enable = true; settings = {@@ -1118,6 +1149,11 @@ virtualisation.containers = { enable = true; policy = { default = [ { type = "insecureAcceptAnything"; } ]; + }; + }; + virtualisation.podman = { + autoPrune = { + enable = true; }; };