all repos — nixfiles @ 83346e95f857eb39cfde59376fce636b49b98e28

System and user configuration, managed by nix and home-manager

linde: re-add forgejo-actions-runner This reverts commit 5f1889d23096eca0609a560fe7e3663d4e735ec7.

Alin
commit

83346e95f857eb39cfde59376fce636b49b98e28

parent

9f7db5188aa3b1e2da30488dbc9f426c91607a2f

1 file changed, 36 insertions(+), 0 deletions(-)

changed files
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -52,6 +52,7 @@ powerdns.file = ../../secrets/powerdns.age;
     redis-website.file = ../../secrets/redis-website.age;
     cifs-jellyfin.file = ../../secrets/cifs-jellyfin.age;
     cifs-paperless.file = ../../secrets/cifs-paperless.age;
+    codeberg-runner.file = ../../secrets/codeberg-runner.age;
     ntfy.file = ../../secrets/ntfy.age;
     pocket-id.file = ../../secrets/pocket-id.age;
     readeck.file = ../../secrets/readeck.age;

@@ -254,6 +255,7 @@ 6922
       ];
       trustedInterfaces = [
         "tailscale0"
+        "podman0"
       ];
     };
     resolvconf = {

@@ -360,6 +362,7 @@ extraGroups = [
       "wheel"
       "caddy"
       "docker"
+      "podman"
       "laminar"
     ];
     isNormalUser = true;

@@ -1101,6 +1104,34 @@ homeMode = "770";
   };
   users.groups.laminar.members = [ "caddy" ];
 
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.codeberg = {
+      name = "linde";
+      enable = true;
+      url = "https://codeberg.org";
+      tokenFile = config.age.secrets.codeberg-runner.path;
+      labels = [
+        "docker:docker://node:24-alpine"
+        "alpine-latest:docker://node:24-alpine"
+        "nixos:host"
+      ];
+
+      hostPackages = with pkgs; [
+        bash
+        coreutils
+        curl
+        gawk
+        gitMinimal
+        gnused
+        nix
+        nodejs
+        wget
+      ];
+    };
+  };
+  virtualisation.podman.enable = true;
+
   services.ntfy-sh = {
     enable = true;
     settings = {

@@ -1118,6 +1149,11 @@ virtualisation.containers = {
     enable = true;
     policy = {
       default = [ { type = "insecureAcceptAnything"; } ];
+    };
+  };
+  virtualisation.podman = {
+    autoPrune = {
+      enable = true;
     };
   };