Compare commits
2 commits
f2efe0226b
...
6d61cd1d08
Author | SHA1 | Date | |
---|---|---|---|
6d61cd1d08 | |||
a4ec703bae |
9 changed files with 93 additions and 64 deletions
|
@ -1,16 +0,0 @@
|
||||||
name: flake check
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
paths:
|
|
||||||
- "**.nix"
|
|
||||||
jobs:
|
|
||||||
check:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v3
|
|
||||||
- name: install nix action
|
|
||||||
uses: https://github.com/DeterminateSystems/nix-installer-action@v5
|
|
||||||
with:
|
|
||||||
github-token: ${{ secrets.GH_TOKEN }}
|
|
||||||
- run: nix flake check
|
|
|
@ -1,31 +0,0 @@
|
||||||
name: deploy systems
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
paths:
|
|
||||||
- "**.lock"
|
|
||||||
jobs:
|
|
||||||
deploy:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v3
|
|
||||||
- name: install nix action
|
|
||||||
uses: https://github.com/DeterminateSystems/nix-installer-action@v5
|
|
||||||
with:
|
|
||||||
github-token: ${{ secrets.GH_TOKEN }}
|
|
||||||
extra-conf: |
|
|
||||||
builders-use-substitutes = true
|
|
||||||
substituters = https://cache.flake.sh/kyasshu https://hyprland.cachix.org https://cache.nixos.org https://nix-gaming.cachix.org https://anyrun.cachix.org https://viperml.cachix.org https://nix-community.cachix.org https://cache.nixos.org/
|
|
||||||
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= kyasshu:g1heIgCgG7M4San6nRsz/omcVQ1GTc7+zKKm3L9Co7o= hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4= anyrun.cachix.org-1:pqBobmOjI7nKlsUMV25u9QHa9btJK65/C8vnO3p346s= viperml.cachix.org-1:qZhKBMTfmcLL+OG6fj/hzsMEedgKvZVFRRAhq7j8Vh8= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
|
|
||||||
- name: write private key
|
|
||||||
run: |
|
|
||||||
mkdir -p .ssh && cd .ssh
|
|
||||||
echo "$SSH_KEY" > forgejo
|
|
||||||
chmod 400 forgejo
|
|
||||||
shell: bash
|
|
||||||
env:
|
|
||||||
SSH_KEY: ${{secrets.SSH_DEPLOY_KEY}}
|
|
||||||
- name: deploy
|
|
||||||
run: |
|
|
||||||
cd .ssh
|
|
||||||
nix run github:serokell/deploy-rs -- --ssh-opts="-i forgejo -o StrictHostKeyChecking=no" --skip-checks --targets .#arashi .#kariru .#sakura .#sora .#yuki .#haru .#kaze
|
|
|
@ -1,16 +0,0 @@
|
||||||
name: fmt check
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
paths:
|
|
||||||
- "**.nix"
|
|
||||||
jobs:
|
|
||||||
check:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v3
|
|
||||||
- name: install nix action
|
|
||||||
uses: https://github.com/DeterminateSystems/nix-installer-action@v5
|
|
||||||
with:
|
|
||||||
github-token: ${{ secrets.GH_TOKEN }}
|
|
||||||
- run: nix run nixpkgs#alejandra -- -c .
|
|
11
.woodpecker/checks.yml
Normal file
11
.woodpecker/checks.yml
Normal file
|
@ -0,0 +1,11 @@
|
||||||
|
steps:
|
||||||
|
check:
|
||||||
|
image: nixos/nix
|
||||||
|
commands:
|
||||||
|
- echo 'experimental-features = flakes nix-command' >> /etc/nix/nix.conf
|
||||||
|
- nix flake check
|
||||||
|
fmt:
|
||||||
|
image: nixos/nix
|
||||||
|
commands:
|
||||||
|
- echo 'experimental-features = flakes nix-command' >> /etc/nix/nix.conf
|
||||||
|
- nix run nixpkgs#alejandra -- -c .
|
0
.woodpecker/deploy.yml
Normal file
0
.woodpecker/deploy.yml
Normal file
0
.woodpecker/flake-lock-update.yml
Normal file
0
.woodpecker/flake-lock-update.yml
Normal file
|
@ -1,5 +1,5 @@
|
||||||
_: {
|
_: {
|
||||||
imports = [
|
imports = [
|
||||||
./forgejo-runners.nix
|
./woodpecker.nix
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
43
hosts/tsuru/services/tailscale.nix
Normal file
43
hosts/tsuru/services/tailscale.nix
Normal file
|
@ -0,0 +1,43 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
sops.secrets.tsauth-tsuru = {
|
||||||
|
sopsFile = ../../../secrets/tailscale/secrets.yaml;
|
||||||
|
};
|
||||||
|
environment.systemPackages = [pkgs.jq pkgs.tailscale];
|
||||||
|
services.tailscale = {
|
||||||
|
useRoutingFeatures = lib.mkDefault "client";
|
||||||
|
};
|
||||||
|
networking.firewall.allowedUDPPorts = [config.services.tailscale.port];
|
||||||
|
networking.firewall.trustedInterfaces = [config.services.tailscale.interfaceName];
|
||||||
|
|
||||||
|
systemd.services.tailscale-autoconnect = {
|
||||||
|
description = "Automatic connection to Tailscale";
|
||||||
|
|
||||||
|
# make sure tailscale is running before trying to connect to tailscale
|
||||||
|
after = ["network-pre.target" "tailscale.service"];
|
||||||
|
wants = ["network-pre.target" "tailscale.service"];
|
||||||
|
wantedBy = ["multi-user.target"];
|
||||||
|
|
||||||
|
# set this service as a oneshot job
|
||||||
|
serviceConfig.Type = "oneshot";
|
||||||
|
|
||||||
|
# have the job run this shell script
|
||||||
|
script = with pkgs; ''
|
||||||
|
# wait for tailscaled to settle
|
||||||
|
sleep 2
|
||||||
|
|
||||||
|
# check if we are already authenticated to tailscale
|
||||||
|
status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
|
||||||
|
if [ $status = "Running" ]; then # if so, then do nothing
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# otherwise authenticate with tailscale
|
||||||
|
${tailscale}/bin/tailscale up -authkey file:${config.sops.secrets.tsauth-tsuru.path} --exit-node=100.104.42.96 --exit-node-allow-lan-access=true --accept-dns=false
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
}
|
38
hosts/tsuru/services/woodpecker.nix
Normal file
38
hosts/tsuru/services/woodpecker.nix
Normal file
|
@ -0,0 +1,38 @@
|
||||||
|
{config, ...}: {
|
||||||
|
sops.secrets.woodpecker-server = {};
|
||||||
|
sops.secrets.woodpecker-agent-secret = {};
|
||||||
|
services.woodpecker-server = {
|
||||||
|
enable = true;
|
||||||
|
environment = {
|
||||||
|
WOODPECKER_SERVER_ADDR = ":8200";
|
||||||
|
WOODPECKER_GRPC_ADDR = ":8300";
|
||||||
|
WOODPECKER_HOST = "https://ci.flake.sh";
|
||||||
|
WOODPECKER_OPEN = "false";
|
||||||
|
WOODPECKER_GITEA = "true";
|
||||||
|
WOODPECKER_GITEA_URL = "https://git.flake.sh";
|
||||||
|
WOODPECKER_ADMIN = "notohh";
|
||||||
|
WOODPECKER_AGENT_SECRET = config.sops.secrets.woodpecker-agent-secret.path;
|
||||||
|
WOODPECKER_LOG_LEVEL = "debug";
|
||||||
|
WOODPECKER_DEBUG_PRETTY = "true";
|
||||||
|
WOODPECKER_KEEPALIVE_MIN_TIME = "10s";
|
||||||
|
};
|
||||||
|
environmentFile = config.sops.secrets.woodpecker-server.path;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.woodpecker-agents.agents.nix = {
|
||||||
|
enable = true;
|
||||||
|
environment = {
|
||||||
|
DOCKER_HOST = "unix:///var/run/docker.sock";
|
||||||
|
WOODPECKER_BACKEND = "docker";
|
||||||
|
WOODPECKER_SERVER = "localhost:8300";
|
||||||
|
WOODPECKER_AGENT_SECRET = config.sops.secrets.woodpecker-agent-secret.path;
|
||||||
|
WOODPECKER_LOG_LEVEL = "debug";
|
||||||
|
WOODPECKER_DEBUG_PRETTY = "true";
|
||||||
|
WOODPECKER_KEEPALIVE_MIN_TIME = "10s";
|
||||||
|
WOODPECKER_HEALTHCHECK = "true";
|
||||||
|
};
|
||||||
|
extraGroups = [
|
||||||
|
"docker"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
Loading…
Reference in a new issue