.forgejo/workflows/check.yml

@@ -0,0 +1,16 @@
+name: flake check
+
+on:
+  push:
+    paths:
+      - "**.nix"
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: install nix action
+        uses: https://github.com/DeterminateSystems/nix-installer-action@v5
+        with:
+          github-token: ${{ secrets.GH_TOKEN }}
+      - run: nix flake check

.forgejo/workflows/deployment/deploy-systems.yml

@@ -0,0 +1,31 @@
+name: deploy systems
+
+on:
+  push:
+    paths:
+      - "**.lock"
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: install nix action
+        uses: https://github.com/DeterminateSystems/nix-installer-action@v5
+        with:
+          github-token: ${{ secrets.GH_TOKEN }}
+          extra-conf: |
+            builders-use-substitutes = true
+            substituters = https://cache.flake.sh/kyasshu https://hyprland.cachix.org https://cache.nixos.org https://nix-gaming.cachix.org https://anyrun.cachix.org https://viperml.cachix.org https://nix-community.cachix.org https://cache.nixos.org/
+            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= kyasshu:g1heIgCgG7M4San6nRsz/omcVQ1GTc7+zKKm3L9Co7o= hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4= anyrun.cachix.org-1:pqBobmOjI7nKlsUMV25u9QHa9btJK65/C8vnO3p346s= viperml.cachix.org-1:qZhKBMTfmcLL+OG6fj/hzsMEedgKvZVFRRAhq7j8Vh8= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
+      - name: write private key
+        run: |
+          mkdir -p .ssh && cd .ssh
+          echo "$SSH_KEY" > forgejo
+          chmod 400 forgejo
+        shell: bash
+        env:
+          SSH_KEY: ${{secrets.SSH_DEPLOY_KEY}}
+      - name: deploy
+        run: |
+          cd .ssh
+          nix run github:serokell/deploy-rs -- --ssh-opts="-i forgejo -o StrictHostKeyChecking=no" --skip-checks --targets .#arashi .#kariru .#sakura .#sora .#yuki .#haru .#kaze

.forgejo/workflows/fmt.yml

@@ -0,0 +1,16 @@
+name: fmt check
+
+on:
+  push:
+    paths:
+      - "**.nix"
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: install nix action
+        uses: https://github.com/DeterminateSystems/nix-installer-action@v5
+        with:
+          github-token: ${{ secrets.GH_TOKEN }}
+      - run: nix run nixpkgs#alejandra -- -c .

.woodpecker/checks.yml

@@ -1,11 +0,0 @@
-steps:
-  check:
-    image: nixos/nix
-    commands:
-      - echo 'experimental-features = flakes nix-command' >> /etc/nix/nix.conf
-      - nix flake check
-  fmt:
-    image: nixos/nix
-    commands:
-      - echo 'experimental-features = flakes nix-command' >> /etc/nix/nix.conf
-      - nix run nixpkgs#alejandra -- -c .

hosts/tsuru/services/default.nix

@@ -1,5 +1,5 @@
 _: {
   imports = [
-    ./woodpecker.nix
+    ./forgejo-runners.nix
   ];
 }

hosts/tsuru/services/tailscale.nix

@@ -1,43 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  sops.secrets.tsauth-tsuru = {
-    sopsFile = ../../../secrets/tailscale/secrets.yaml;
-  };
-  environment.systemPackages = [pkgs.jq pkgs.tailscale];
-  services.tailscale = {
-    useRoutingFeatures = lib.mkDefault "client";
-  };
-  networking.firewall.allowedUDPPorts = [config.services.tailscale.port];
-  networking.firewall.trustedInterfaces = [config.services.tailscale.interfaceName];
-
-  systemd.services.tailscale-autoconnect = {
-    description = "Automatic connection to Tailscale";
-
-    # make sure tailscale is running before trying to connect to tailscale
-    after = ["network-pre.target" "tailscale.service"];
-    wants = ["network-pre.target" "tailscale.service"];
-    wantedBy = ["multi-user.target"];
-
-    # set this service as a oneshot job
-    serviceConfig.Type = "oneshot";
-
-    # have the job run this shell script
-    script = with pkgs; ''
-      # wait for tailscaled to settle
-      sleep 2
-
-      # check if we are already authenticated to tailscale
-      status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
-      if [ $status = "Running" ]; then # if so, then do nothing
-        exit 0
-      fi
-
-      # otherwise authenticate with tailscale
-      ${tailscale}/bin/tailscale up -authkey file:${config.sops.secrets.tsauth-tsuru.path} --exit-node=100.104.42.96 --exit-node-allow-lan-access=true --accept-dns=false
-    '';
-  };
-}

hosts/tsuru/services/woodpecker.nix

@@ -1,38 +0,0 @@
-{config, ...}: {
-  sops.secrets.woodpecker-server = {};
-  sops.secrets.woodpecker-agent-secret = {};
-  services.woodpecker-server = {
-    enable = true;
-    environment = {
-      WOODPECKER_SERVER_ADDR = ":8200";
-      WOODPECKER_GRPC_ADDR = ":8300";
-      WOODPECKER_HOST = "https://ci.flake.sh";
-      WOODPECKER_OPEN = "false";
-      WOODPECKER_GITEA = "true";
-      WOODPECKER_GITEA_URL = "https://git.flake.sh";
-      WOODPECKER_ADMIN = "notohh";
-      WOODPECKER_AGENT_SECRET = config.sops.secrets.woodpecker-agent-secret.path;
-      WOODPECKER_LOG_LEVEL = "debug";
-      WOODPECKER_DEBUG_PRETTY = "true";
-      WOODPECKER_KEEPALIVE_MIN_TIME = "10s";
-    };
-    environmentFile = config.sops.secrets.woodpecker-server.path;
-  };
-
-  services.woodpecker-agents.agents.nix = {
-    enable = true;
-    environment = {
-      DOCKER_HOST = "unix:///var/run/docker.sock";
-      WOODPECKER_BACKEND = "docker";
-      WOODPECKER_SERVER = "localhost:8300";
-      WOODPECKER_AGENT_SECRET = config.sops.secrets.woodpecker-agent-secret.path;
-      WOODPECKER_LOG_LEVEL = "debug";
-      WOODPECKER_DEBUG_PRETTY = "true";
-      WOODPECKER_KEEPALIVE_MIN_TIME = "10s";
-      WOODPECKER_HEALTHCHECK = "true";
-    };
-    extraGroups = [
-      "docker"
-    ];
-  };
-}