woodpecker-switch #22
10 changed files with 137 additions and 68 deletions
|
|
@ -1,16 +0,0 @@
|
|||
name: flake check
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- "**.nix"
|
||||
jobs:
|
||||
check:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: install nix action
|
||||
uses: https://github.com/DeterminateSystems/nix-installer-action@v5
|
||||
with:
|
||||
github-token: ${{ secrets.GH_TOKEN }}
|
||||
- run: nix flake check
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
name: deploy systems
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- "**.lock"
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: install nix action
|
||||
uses: https://github.com/DeterminateSystems/nix-installer-action@v5
|
||||
with:
|
||||
github-token: ${{ secrets.GH_TOKEN }}
|
||||
extra-conf: |
|
||||
builders-use-substitutes = true
|
||||
substituters = https://cache.flake.sh/kyasshu https://hyprland.cachix.org https://cache.nixos.org https://nix-gaming.cachix.org https://anyrun.cachix.org https://viperml.cachix.org https://nix-community.cachix.org https://cache.nixos.org/
|
||||
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= kyasshu:g1heIgCgG7M4San6nRsz/omcVQ1GTc7+zKKm3L9Co7o= hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4= anyrun.cachix.org-1:pqBobmOjI7nKlsUMV25u9QHa9btJK65/C8vnO3p346s= viperml.cachix.org-1:qZhKBMTfmcLL+OG6fj/hzsMEedgKvZVFRRAhq7j8Vh8= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
|
||||
- name: write private key
|
||||
run: |
|
||||
mkdir -p .ssh && cd .ssh
|
||||
echo "$SSH_KEY" > forgejo
|
||||
chmod 400 forgejo
|
||||
shell: bash
|
||||
env:
|
||||
SSH_KEY: ${{secrets.SSH_DEPLOY_KEY}}
|
||||
- name: deploy
|
||||
run: |
|
||||
cd .ssh
|
||||
nix run github:serokell/deploy-rs -- --ssh-opts="-i forgejo -o StrictHostKeyChecking=no" --skip-checks --targets .#arashi .#kariru .#sakura .#sora .#yuki .#haru .#kaze
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
name: fmt check
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- "**.nix"
|
||||
jobs:
|
||||
check:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: install nix action
|
||||
uses: https://github.com/DeterminateSystems/nix-installer-action@v5
|
||||
with:
|
||||
github-token: ${{ secrets.GH_TOKEN }}
|
||||
- run: nix run nixpkgs#alejandra -- -c .
|
||||
47
.woodpecker/flake-lock-update.yml
Normal file
47
.woodpecker/flake-lock-update.yml
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
clone:
|
||||
git:
|
||||
image: woodpeckerci/plugin-git
|
||||
settings:
|
||||
branch: flake-lock-update
|
||||
when:
|
||||
- event: cron
|
||||
cron: flake-lock-update
|
||||
|
||||
steps:
|
||||
update:
|
||||
image: nixos/nix
|
||||
commands: |
|
||||
echo 'experimental-features = flakes nix-command' >> /etc/nix/nix.conf
|
||||
echo "access-tokens = github.com=$${GH_PAT}" >> /etc/nix/nix.conf
|
||||
nix flake update
|
||||
secrets: [ gh_pat ]
|
||||
push-changes:
|
||||
image: appleboy/drone-git-push
|
||||
settings:
|
||||
remote: ssh://forgejo@git.flake.sh:2222/notohh/snowflake.git
|
||||
branch: flake-lock-update
|
||||
local_ref: flake-lock-update
|
||||
ssh_key:
|
||||
from_secret: forgejo_ssh_key
|
||||
commit: true
|
||||
commit_message: "flake.lock: update"
|
||||
author_name: "WoodpeckerCI"
|
||||
author_email: "woodpecker@flake.sh"
|
||||
make-pr:
|
||||
image: johnwalkerx/gitea-pull-request-create-plugin:latest
|
||||
pull: true
|
||||
settings:
|
||||
gitea_address: https://git.flake.sh/
|
||||
gitea_token:
|
||||
from_secret: forgejo_token
|
||||
owner: ${CI_REPO_OWNER}
|
||||
repo: ${CI_REPO_NAME}
|
||||
branch: flake-lock-update
|
||||
base_branch: main
|
||||
pr_title: "flake.lock: update"
|
||||
pr_body: PR automatically created by Woodpecker CI
|
||||
skip_on_missing_branch: false
|
||||
close_pr_if_empty: true
|
||||
delete_branch_if_pr_empty: true
|
||||
merge_when_checks_succeed: false
|
||||
delete_branch_after_merge: true
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
_: {
|
||||
imports = [
|
||||
./forgejo-runners.nix
|
||||
./woodpecker.nix
|
||||
];
|
||||
}
|
||||
|
|
|
|||
43
hosts/tsuru/services/tailscale.nix
Normal file
43
hosts/tsuru/services/tailscale.nix
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
sops.secrets.tsauth-tsuru = {
|
||||
sopsFile = ../../../secrets/tailscale/secrets.yaml;
|
||||
};
|
||||
environment.systemPackages = [pkgs.jq pkgs.tailscale];
|
||||
services.tailscale = {
|
||||
useRoutingFeatures = lib.mkDefault "client";
|
||||
};
|
||||
networking.firewall.allowedUDPPorts = [config.services.tailscale.port];
|
||||
networking.firewall.trustedInterfaces = [config.services.tailscale.interfaceName];
|
||||
|
||||
systemd.services.tailscale-autoconnect = {
|
||||
description = "Automatic connection to Tailscale";
|
||||
|
||||
# make sure tailscale is running before trying to connect to tailscale
|
||||
after = ["network-pre.target" "tailscale.service"];
|
||||
wants = ["network-pre.target" "tailscale.service"];
|
||||
wantedBy = ["multi-user.target"];
|
||||
|
||||
# set this service as a oneshot job
|
||||
serviceConfig.Type = "oneshot";
|
||||
|
||||
# have the job run this shell script
|
||||
script = with pkgs; ''
|
||||
# wait for tailscaled to settle
|
||||
sleep 2
|
||||
|
||||
# check if we are already authenticated to tailscale
|
||||
status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
|
||||
if [ $status = "Running" ]; then # if so, then do nothing
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# otherwise authenticate with tailscale
|
||||
${tailscale}/bin/tailscale up -authkey file:${config.sops.secrets.tsauth-tsuru.path} --exit-node=100.104.42.96 --exit-node-allow-lan-access=true --accept-dns=false
|
||||
'';
|
||||
};
|
||||
}
|
||||
38
hosts/tsuru/services/woodpecker.nix
Normal file
38
hosts/tsuru/services/woodpecker.nix
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
{config, ...}: {
|
||||
sops.secrets.woodpecker-server = {};
|
||||
sops.secrets.woodpecker-agent-secret = {};
|
||||
services.woodpecker-server = {
|
||||
enable = true;
|
||||
environment = {
|
||||
WOODPECKER_SERVER_ADDR = ":8200";
|
||||
WOODPECKER_GRPC_ADDR = ":8300";
|
||||
WOODPECKER_HOST = "https://ci.flake.sh";
|
||||
WOODPECKER_OPEN = "false";
|
||||
WOODPECKER_GITEA = "true";
|
||||
WOODPECKER_GITEA_URL = "https://git.flake.sh";
|
||||
WOODPECKER_ADMIN = "notohh";
|
||||
WOODPECKER_AGENT_SECRET = config.sops.secrets.woodpecker-agent-secret.path;
|
||||
WOODPECKER_LOG_LEVEL = "debug";
|
||||
WOODPECKER_DEBUG_PRETTY = "true";
|
||||
WOODPECKER_KEEPALIVE_MIN_TIME = "10s";
|
||||
};
|
||||
environmentFile = config.sops.secrets.woodpecker-server.path;
|
||||
};
|
||||
|
||||
services.woodpecker-agents.agents.nix = {
|
||||
enable = true;
|
||||
environment = {
|
||||
DOCKER_HOST = "unix:///var/run/docker.sock";
|
||||
WOODPECKER_BACKEND = "docker";
|
||||
WOODPECKER_SERVER = "localhost:8300";
|
||||
WOODPECKER_AGENT_SECRET = config.sops.secrets.woodpecker-agent-secret.path;
|
||||
WOODPECKER_LOG_LEVEL = "debug";
|
||||
WOODPECKER_DEBUG_PRETTY = "true";
|
||||
WOODPECKER_KEEPALIVE_MIN_TIME = "10s";
|
||||
WOODPECKER_HEALTHCHECK = "true";
|
||||
};
|
||||
extraGroups = [
|
||||
"docker"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
@ -14,6 +14,7 @@
|
|||
allowUnfree = true;
|
||||
permittedInsecurePackages = [
|
||||
"electron-24.8.6"
|
||||
"electron-25.9.0"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -8,6 +8,8 @@ searxng-secret: ENC[AES256_GCM,data:SSvspQVRp79zJq0hzaqzuJIWFtVUoaqHGH9PXUViiXb9
|
|||
smtp2go-pwd: ENC[AES256_GCM,data:03OCDnG73T8B2Q3TJLt1kg==,iv:QFI34ZoM88AuGvOwVmxsplkNKWFgwqBn1AFdHNREses=,tag:9YABs0nAh7Cx2vybuIW9sA==,type:str]
|
||||
minio: ENC[AES256_GCM,data:ePCaN1wRnZheBsjEcAPizfGtZskS9rPxfP1kvvQvR+i3TGfwvAx2V96k59pt5GIqvxADi/lBuc4Er1EWQkMrhxMJlN4QmgU9LFOF,iv:81GUSVYe4LL/pI4Wy0CHSYwZvWNzWRBHR+KrCPEN430=,tag:9VFazb1U1XCpImZsNKpJyw==,type:str]
|
||||
attic: ENC[AES256_GCM,data:/zVpQw2yYqWWLhZnFCB17YZqcZs2Fn0L37aW1vK2Gj9npsHcOqV3d3Q7SkXSd+DIh68ECEWVoEovWgflm12fwUwXcU2yWofdfgIkO1DS9+9YRtPFPDIKwSE8YQS2V0r0IjV7KFppCrUSLZ2ehMGL/qzvQNdzVla0UsUKgqS0NjY29gcxdO4N5eJlBS/7KM297ulqu3InFdBI0rnO6t2iv37xBv5SEajPOWnaLpTYsm/aIwupJmCjwHb3WFv1NkyC+QAgCgUzNiufVwuVRrLT0fF+p1qDGjYG7Q+dwd+2K8k+MqeJNLw=,iv:k1Dg7/o2zulAX0K7IpRuwkWu+dxWRQ9H1p88MBmOapo=,tag:aDIx4hmWGiFgaEhz2Gz9lw==,type:str]
|
||||
woodpecker-server: ENC[AES256_GCM,data:rI6Su65xSXGwy+wI9koVi1oL4RCSr5VEf8txJohzaPQRlyg03wZZzLCe1SSzEFsivYlL5B2XKAuVdYrkW5n5/XUENwxgPwrv7Vm3ufRfItj6+44VjV1mK8STmGnzkqglY7j71uX/+aVeqQwDM8uwWHCiT89kNTSd5ebrWzjIQ01DZ/ojPRZOZBLRE0rafA==,iv:1CuaRP0d9t8WkvMbUhDTi0hn+MqVL428Bu3r/fobK40=,tag:8KlR5EWU+cdDV5oLB8hHpA==,type:str]
|
||||
woodpecker-agent-secret: ENC[AES256_GCM,data:DQoIOciEqDcaUYTTYFeIocmUUFB+ASstMA0ver4QiM/1n8G3udFL0OR6QRO1wx3bAlPCD4rrfiw1vYgAFj8xFg==,iv:X4goTnTQof1+OHj8nq6VAyCe+M7p2hLa4nDvm/hXw7U=,tag:3KbuBYTqU2hD3GB3r1siZw==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
|
|
@ -23,8 +25,8 @@ sops:
|
|||
YWNQcURKMSs2U0pOa3E0cTdCZ3RnalkKGayA7DBUQS+kn+6OYVBc6oTunF0qeZdt
|
||||
5b9DLHgh0HRWFm09XGSOog8K315d93Wzblw1My1/dXeEQX/ryinqUQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-01-16T06:46:14Z"
|
||||
mac: ENC[AES256_GCM,data:QIKiP/3+VNhKe9Pz2F9EhEQJX7DbYaDFtzufMjY3wT03IaniZSO847FNB5z8y3gygc0cqTv4p2UYeia02Y5hzwaNQR1ulclTeqPDiXGxceE5Y7POuHoZUWe8s4c97poucZSv4THcMMrE4eo8epO/vEaWD48TCB5S1yG1qVBOT7M=,iv:b+EmOWw23/XVcVD6i+cExSlQ02BNmdfk23nmOYose9g=,tag:PcZLi48S6UPiON9vrSQDGA==,type:str]
|
||||
lastmodified: "2024-01-23T20:24:07Z"
|
||||
mac: ENC[AES256_GCM,data:8Lj/939tJY4vOOuTN6OVN3VqTdKWCYmveibtbYIgdVSm8omNIoEWwZzmfZtKQ+GBIhV9TiI6ZbiBAq+6HaRB1FvnsuPK3o/UCXoOb8s+MKQsKRqHB0gWO75/Zuh3WX2+3SMSe3cq30jMiWj2ChSvqOsimzqdyiM3JJwn5dgZRbo=,iv:T7QJgPcrT80LpvrMllpHgC6/hRxb2h377GTcyjhknbY=,tag:tumGwP/iAvkMnnHc+o5+Pw==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
tsauth-sora: ENC[AES256_GCM,data:GAgCIpYMS5e4t2RW4t6w9jI2mfJQdBq2eRBDAKt6HJ/JaZyv983bx5xojTStqOWYUIKaFZ5IL30=,iv:AQTKdSPr2G9tow/hbgFKSrh/i4D9JaFrc7/JFOvP1Bo=,tag:4ss1dNK0Z//JIWnds/hMKQ==,type:str]
|
||||
tsauth-sakura: ENC[AES256_GCM,data:35SN+Tu9pGXYu/i/VbBFHMwJmAttjLrE5JrcQXUuwqkUbv/jnFuELtwC6jsO9hSllD6vGJJsYoJ3,iv:C3Tl2T6SOrUEdUAFs3Ly8/RPaqj0SKOPwFppeGZf3XI=,tag:o3vtwxMvHUpXpKbXtSqhzQ==,type:str]
|
||||
tsauth-kaze: ENC[AES256_GCM,data:a7kV+lYKjnnHsQipDVnaHtoslvqXpcaawSe0lYXlJiGnTjpXR6SRpq2XgsO6+6g/xi8NZeLUK4U=,iv:yAjGPZrm80u0JpwwWLPLXUxV0uLX1C+t0osUZ/em23o=,tag:7Q6Awv5VKJe9i5uWDeBR7g==,type:str]
|
||||
tsauth-tsuru: ENC[AES256_GCM,data:xwKUF50aAFzgqgHB0dpnIW0893eBM5izRTbkoinfBYPpM53f5LGyt3nhIkPErVNV2XLg1WcLmxN8,iv:Os1yh1q1/00FLU46jekyvxR0qGdICyqoZKOZMU0hP40=,tag:/kbVkz/Fl0pmTe4Fq8m97w==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
|
|
@ -16,8 +17,8 @@ sops:
|
|||
S2doM1FiZkRFT0dCckx4Tzd1b2pZRHMKEIsD+AjBcHOFSQiXrCuLv+IBcF+4vUYB
|
||||
YeHe81lcjqWO2TEcP1fdBh0JWUtDVXQbZiBDxs5Vlz35x/OnA9fwPQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-01-05T00:34:38Z"
|
||||
mac: ENC[AES256_GCM,data:8kxJBDvDVaiB+wTRLXFDNnhzGdWzHS2ntdVxysejN+ghYRqP5qToe6zd9dudOjzOzS15jpLG/MP7Rg5OXRjB656gd+DjkoQzHj5us/EtokOiDW6O8W058nNefQEyrBVtzHBwvphhg8Sh5E7VLWy6QYz3O35//wDXdUH+yX2RYIU=,iv:XQ4WdqdFC0pPR6RG4vOdzBRt8sYoqUJARwHPohLccGE=,tag:cRBJA6S0jJQalOeqzIPo8Q==,type:str]
|
||||
lastmodified: "2024-01-23T20:10:50Z"
|
||||
mac: ENC[AES256_GCM,data:adm9m5psXB31LtpT6IENVds0Ydh5BcojSzOWUerxbzmitJbuzwf4pnZBKtCaEOtekFYO4tY0n6X0XHR/bhzFC2Nw4rXDCju07srrImbYwmSq8TL5XzueirzPk5anwvOehs+MuI6Sp9HWgGKv6K+5TuaGZYFLSRXLw9VQb+YmkvU=,iv:KFqbx2jrFQpva5699bHKPcdsbEaZv8PZOPKAR//Iujs=,tag:Q6qmyUm6X56GXDLHnJyD5w==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
||||
|
|
|
|||
Loading…
Reference in a new issue