summaryrefslogtreecommitdiffstats
path: root/krebs
diff options
context:
space:
mode:
Diffstat (limited to 'krebs')
-rw-r--r--krebs/2configs/shack/gitlab-runner.nix62
1 files changed, 43 insertions, 19 deletions
diff --git a/krebs/2configs/shack/gitlab-runner.nix b/krebs/2configs/shack/gitlab-runner.nix
index bd391851a..ecb064579 100644
--- a/krebs/2configs/shack/gitlab-runner.nix
+++ b/krebs/2configs/shack/gitlab-runner.nix
@@ -1,24 +1,48 @@
-{ pkgs, ... }:
-let
- runner-src = builtins.fetchTarball {
- url = "https://gitlab.com/arianvp/nixos-gitlab-runner/-/archive/master/nixos-gitlab-runner-master.tar.gz";
- sha256 = "1s0fy5ny2ygcfvx35xws8xz5ih4z4kdfqlq3r6byxpylw7r52fyi";
- };
-in
+{ pkgs,lib, ... }:
{
- imports = [
- "${runner-src}/gitlab-runner.nix"
- ];
- services.gitlab-runner2 = {
+ services.gitlab-runner = {
enable = true;
- ## registrationConfigurationFile contains:
- # CI_SERVER_URL=<CI server URL>
- # REGISTRATION_TOKEN=<registration secret>
- # RUNNER_TAG_LIST=nix,shacklan
- # RUNNER_NAME=stockholm-runner-$name
- registrationConfigFile = <secrets/shackspace-gitlab-ci>;
- #gracefulTermination = true;
+ services= {
+ # runner for building in docker via host's nix-daemon
+ # nix store will be readable in runner, might be insecure
+ nix = with lib;{
+ # File should contain at least these two variables:
+ # `CI_SERVER_URL`
+ # `REGISTRATION_TOKEN`
+ registrationConfigFile = toString <secrets/shackspace-gitlab-ci>;
+ dockerImage = "alpine";
+ dockerVolumes = [
+ "/nix/store:/nix/store:ro"
+ "/nix/var/nix/db:/nix/var/nix/db:ro"
+ "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+ ];
+ dockerDisableCache = true;
+ preBuildScript = pkgs.writeScript "setup-container" ''
+ mkdir -p -m 0755 /nix/var/log/nix/drvs
+ mkdir -p -m 0755 /nix/var/nix/gcroots
+ mkdir -p -m 0755 /nix/var/nix/profiles
+ mkdir -p -m 0755 /nix/var/nix/temproots
+ mkdir -p -m 0755 /nix/var/nix/userpool
+ mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+ mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+ mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+ mkdir -p -m 0700 "$HOME/.nix-defexpr"
+ . ${pkgs.nix}/etc/profile.d/nix.sh
+ ${pkgs.nix}/bin/nix-env -i ${concatStringsSep " " (with pkgs; [ nix cacert git openssh ])}
+ ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
+ ${pkgs.nix}/bin/nix-channel --update nixpkgs
+ '';
+ environmentVariables = {
+ ENV = "/etc/profile";
+ USER = "root";
+ NIX_REMOTE = "daemon";
+ PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+ NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
+ };
+ tagList = [ "nix" "shacklan" ];
+ };
+ };
};
- systemd.services.gitlab-runner2.restartIfChanged = false;
+ systemd.services.gitlab-runner.restartIfChanged = false;
systemd.services.docker.restartIfChanged = false;
}