Add a deployment for forgejo-ci

Reviewed-on: Fediversity/Fediversity#426
Reviewed-by: Valentin Gagarin <valentin.gagarin@tweag.io>
Co-authored-by: Kiara Grouwstra <kiara@procolix.eu>
Co-committed-by: Kiara Grouwstra <kiara@procolix.eu>

infra/common/nixos/default.nix

@@ -23,4 +23,9 @@ in
   nix.extraOptions = ''
     experimental-features = nix-command flakes
   '';
+
+  boot.loader = {
+    systemd-boot.enable = true;
+    efi.canTouchEfiVariables = true;
+  };
 }

infra/common/proxmox-qemu-vm.nix

@@ -6,11 +6,6 @@
   imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
 
   boot = {
-    loader = {
-      systemd-boot.enable = true;
-      efi.canTouchEfiVariables = true;
-    };
-
     initrd = {
       availableKernelModules = [
         "ata_piix"

infra/flake-part.nix

@@ -167,6 +167,10 @@ in
 {
   _class = "flake";
 
+  # NOTE: `forgejo-ci`, being a physical machine and not a Proxmox VM, gets
+  # custom treatment.
+  imports = [ ./forgejo-ci/flake-part.nix ];
+
   ## - Each normal or test machine gets a NixOS configuration.
   ## - Each normal or test machine gets a VM options entry.
   ## - Each normal machine gets a deployment.

infra/forgejo-ci/configuration.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  inherit (lib) mkDefault mkForce;
+in
+{
+  _class = "nixos";
+
+  imports = [
+    ../common/options.nix
+    ../common/nixos
+    ./forgejo-actions-runner.nix
+  ];
+
+  fediversityVm = {
+    # XXX this needs an SSH config entry to locate and access the machine
+    name = "forgejo-ci";
+    domain = "procolix.com";
+
+    ipv4 = {
+      interface = "enp1s0f0";
+      address = "192.168.201.65";
+      prefixLength = 24;
+      gateway = "192.168.201.1";
+    };
+    ipv6.enable = false;
+  };
+
+  networking = {
+    nftables.enable = mkForce false;
+    hostId = "1d6ea552";
+  };
+
+  hardware.cpu.intel.updateMicrocode = mkDefault config.hardware.enableRedistributableFirmware;
+
+  fileSystems."/" = {
+    device = "rpool/root";
+    fsType = "zfs";
+  };
+
+  fileSystems."/home" = {
+    device = "rpool/home";
+    fsType = "zfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/50B2-DD3F";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+}

infra/forgejo-ci/flake-part.nix

@@ -0,0 +1,58 @@
+{
+  lib,
+  inputs,
+  sources,
+  keys,
+  secrets,
+  ...
+}:
+
+## NOTE: Hackish solution mostly taken from `../common/resource.nix`.
+## Eventually, `forgejo-ci` should move to a datacentre somewhere and this code
+## should be integrated with the code for other machines (in particular VMs).
+
+let
+  inherit (lib) attrValues elem;
+  inherit (lib.attrsets) concatMapAttrs optionalAttrs;
+  inherit (lib.strings) removeSuffix;
+
+  hostPublicKey = keys.systems.forgejo-ci;
+in
+{
+  _class = "flake";
+
+  nixops4Deployments.forgejo-ci =
+    { providers, ... }:
+    {
+      providers.local = inputs.nixops4.modules.nixops4Provider.local;
+
+      resources.forgejo-ci = {
+        type = providers.local.exec;
+        imports = [ inputs.nixops4-nixos.modules.nixops4Resource.nixos ];
+
+        ssh = {
+          host = "forgejo-ci";
+          hostPublicKey = hostPublicKey;
+        };
+
+        nixpkgs = inputs.nixpkgs;
+
+        nixos.module = {
+          imports = with sources; [
+            "${agenix}/modules/age.nix"
+            "${disko}/module.nix"
+            ./configuration.nix
+          ];
+
+          age.secrets = concatMapAttrs (
+            name: secret:
+            optionalAttrs (elem hostPublicKey secret.publicKeys) {
+              ${removeSuffix ".age" name}.file = secrets.rootPath + "/${name}";
+            }
+          ) secrets.mapping;
+
+          users.users.root.openssh.authorizedKeys.keys = attrValues keys.contributors;
+        };
+      };
+    };
+}

infra/forgejo-ci/forgejo-actions-runner.nix

@@ -0,0 +1,47 @@
+{ pkgs, config, ... }:
+
+{
+  _class = "nixos";
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-actions-runner;
+
+    instances.default = {
+      enable = true;
+
+      name = config.networking.fqdn;
+      url = "https://git.fediversity.eu";
+      tokenFile = config.age.secrets.forgejo-runner-token.path;
+
+      settings = {
+        log.level = "info";
+        runner = {
+          file = ".runner";
+          # Take only 1 job at a time to avoid clashing NixOS tests, see #362
+          capacity = 1;
+          timeout = "3h";
+          insecure = false;
+          fetch_timeout = "5s";
+          fetch_interval = "2s";
+        };
+      };
+
+      ## This runner supports Docker (with a default Ubuntu image) and native
+      ## modes. In native mode, it contains a few default packages.
+      labels = [
+        "docker:docker://node:16-bullseye"
+        "native:host"
+      ];
+
+      hostPackages = with pkgs; [
+        bash
+        git
+        nix
+        nodejs
+      ];
+    };
+  };
+
+  ## For the Docker mode of the runner.
+  virtualisation.docker.enable = true;
+}

keys/flake-part.nix

@@ -1 +1,5 @@
-{ _module.args.keys = import ./.; }
+{
+  _class = "flake";
+
+  _module.args.keys = import ./.;
+}

keys/systems/forgejo-ci.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFXQW5fxJoNY9wtTMsNExgbAbvyljIRGBLjY+USh/0A

machines/machines.md

@@ -7,9 +7,10 @@ Currently, this repository keeps track of the following VMs:
 
 Machine | Proxmox | Description
 --------|---------|-------------
-[`fedi200`](./fedi200) | fediversity | Testing machine for Hans
+[`fedi200`](./dev/fedi200) | fediversity | Testing machine for Hans
-[`fedi201`](./fedi201) | fediversity | FediPanel
+[`fedi201`](./dev/fedi201) | fediversity | FediPanel
-[`vm02116`](./vm02116) | procolix | Forgejo
+[`vm02116`](./dev/vm02116) | procolix | Forgejo
-[`vm02187`](./vm02187) | procolix | Wiki
+[`vm02187`](./dev/vm02187) | procolix | Wiki
+| `forgejo-ci` | n/a (physical) | Forgejo actions runner |
 
 This table excludes all machines with names starting with `test`.

machines/machines.md.sh

@@ -32,11 +32,12 @@ for machine in $(echo "$vmOptions" | jq -r 'keys[]'); do
     description=$(echo "$vmOptions" | jq -r ".$machine.description" | head -n 1)
 
     # shellcheck disable=SC2016
-    printf '[`%s`](./%s) | %s | %s\n' "$machine" "$machine" "$proxmox" "$description"
+    printf '[`%s`](./dev/%s) | %s | %s\n' "$machine" "$machine" "$proxmox" "$description"
   fi
 done
 
 cat <<\EOF
+| `forgejo-ci` | n/a (physical) | Forgejo actions runner |
 
 This table excludes all machines with names starting with `test`.
 EOF

secrets/flake-part.nix

@@ -1 +1,5 @@
-{ _module.args.secrets = import ./.; }
+{
+  _class = "flake";
+
+  _module.args.secrets = import ./.;
+}

secrets/secrets.nix

@@ -26,7 +26,7 @@ concatMapAttrs
     {
       forgejo-database-password = [ vm02116 ];
       forgejo-email-password = [ vm02116 ];
-      forgejo-runner-token = [ ];
+      forgejo-runner-token = [ forgejo-ci ];
       panel-secret-key = [ fedi201 ];
       panel-ssh-key = [ fedi201 ];
       wiki-basicauth-htpasswd = [ vm02187 ];