abstract out host details

- allow disabling IPv4 or v6 (both enabled by default)
- allow specifying interface (defaults to eth0)

infra/common/nixos/hardware.nix

@@ -1,64 +1,86 @@
-{ modulesPath, ... }:
+{ config, lib, ... }:
 
+let
+  inherit (lib) mkIf mkMerge;
+
+in
 {
   _class = "nixos";
 
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  config = mkMerge [
+    {
+      boot.loader = {
+        systemd-boot.enable = true;
+        efi.canTouchEfiVariables = true;
+      };
+    }
 
-  boot = {
-    loader = {
-      systemd-boot.enable = true;
-      efi.canTouchEfiVariables = true;
-    };
+    (mkIf config.fediversityVm.isQemuVm {
 
-    initrd = {
-      availableKernelModules = [
-        "ata_piix"
-        "uhci_hcd"
-        "virtio_pci"
-        "virtio_scsi"
-        "sd_mod"
-        "sr_mod"
-      ];
-      kernelModules = [ "dm-snapshot" ];
-    };
-  };
+      boot.initrd = {
+        availableKernelModules = [
+          "ata_piix"
+          "uhci_hcd"
+          "sd_mod"
+          "sr_mod"
 
-  disko.devices.disk.main = {
-    device = "/dev/sda";
-    type = "disk";
+          # from `/profiles/qemu-guest.nix`
+          "virtio_net"
+          "virtio_pci"
+          "virtio_mmio"
+          "virtio_blk"
+          "virtio_scsi"
+          "9p"
+          "9pnet_virtio"
+        ];
+        kernelModules = [
+          "dm-snapshot"
 
-    content = {
-      type = "gpt";
+          # from `/profiles/qemu-guest.nix`
+          "virtio_balloon"
+          "virtio_console"
+          "virtio_rng"
+          "virtio_gpu"
+        ];
+      };
 
-      partitions = {
-        MBR = {
-          priority = 0;
-          size = "1M";
-          type = "EF02";
-        };
+      disko.devices.disk.main = {
+        device = "/dev/sda";
+        type = "disk";
 
-        ESP = {
-          priority = 1;
-          size = "500M";
-          type = "EF00";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot";
-          };
-        };
+        content = {
+          type = "gpt";
 
-        root = {
-          priority = 2;
-          size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/";
+          partitions = {
+            MBR = {
+              priority = 0;
+              size = "1M";
+              type = "EF02";
+            };
+
+            ESP = {
+              priority = 1;
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+
+            root = {
+              priority = 2;
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/";
+              };
+            };
           };
         };
       };
-    };
-  };
+    })
+  ];
 }

infra/common/nixos/networking.nix

@@ -1,7 +1,7 @@
 { config, lib, ... }:
 
 let
-  inherit (lib) mkDefault;
+  inherit (lib) mkDefault mkIf mkMerge;
 
 in
 {
@@ -13,53 +13,49 @@ in
       settings.PasswordAuthentication = false;
     };
 
-    networking = {
-      hostName = config.fediversityVm.name;
-      domain = config.fediversityVm.domain;
+    networking = mkMerge [
+      {
+        hostName = config.fediversityVm.name;
+        domain = config.fediversityVm.domain;
 
-      ## REVIEW: Do we actually need that, considering that we have static IPs?
-      useDHCP = mkDefault true;
+        ## REVIEW: Do we actually need that, considering that we have static IPs?
+        useDHCP = mkDefault true;
 
-      interfaces = {
-        eth0 = {
-          ipv4 = {
-            addresses = [
-              {
-                inherit (config.fediversityVm.ipv4) address prefixLength;
-              }
-            ];
-          };
-          ipv6 = {
-            addresses = [
-              {
-                inherit (config.fediversityVm.ipv6) address prefixLength;
-              }
-            ];
-          };
+        nameservers = [
+          "95.215.185.6"
+          "95.215.185.7"
+          "2a00:51c0::5fd7:b906"
+          "2a00:51c0::5fd7:b907"
+        ];
+
+        firewall.enable = false;
+        nftables = {
+          enable = true;
+          rulesetFile = ./nftables-ruleset.nft;
         };
-      };
+      }
 
-      defaultGateway = {
-        address = config.fediversityVm.ipv4.gateway;
-        interface = "eth0";
-      };
-      defaultGateway6 = {
-        address = config.fediversityVm.ipv6.gateway;
-        interface = "eth0";
-      };
+      ## IPv4
+      (mkIf config.fediversityVm.ipv4.enable {
+        interfaces.${config.fediversityVm.ipv4.interface}.ipv4.addresses = [
+          { inherit (config.fediversityVm.ipv4) address prefixLength; }
+        ];
+        defaultGateway = {
+          address = config.fediversityVm.ipv4.gateway;
+          interface = config.fediversityVm.ipv4.interface;
+        };
+      })
 
-      nameservers = [
-        "95.215.185.6"
-        "95.215.185.7"
-        "2a00:51c0::5fd7:b906"
-        "2a00:51c0::5fd7:b907"
-      ];
-
-      firewall.enable = false;
-      nftables = {
-        enable = true;
-        rulesetFile = ./nftables-ruleset.nft;
-      };
-    };
+      ## IPv6
+      (mkIf config.fediversityVm.ipv6.enable {
+        interfaces.${config.fediversityVm.ipv6.interface}.ipv6.addresses = [
+          { inherit (config.fediversityVm.ipv6) address prefixLength; }
+        ];
+        defaultGateway6 = {
+          address = config.fediversityVm.ipv6.gateway;
+          interface = config.fediversityVm.ipv6.interface;
+        };
+      })
+    ];
   };
 }

infra/common/options.nix

@@ -91,6 +91,17 @@ in
     };
 
     ipv4 = {
+      enable = mkOption {
+        default = true;
+      };
+
+      interface = mkOption {
+        description = ''
+          The interface that carries the machine's IPv4 network.
+        '';
+        default = "eth0";
+      };
+
       address = mkOption {
         description = ''
           The IP address of the machine, version 4. It will be injected as a
@@ -116,6 +127,17 @@ in
     };
 
     ipv6 = {
+      enable = mkOption {
+        default = true;
+      };
+
+      interface = mkOption {
+        description = ''
+          The interface that carries the machine's IPv6 network.
+        '';
+        default = "eth0";
+      };
+
       address = mkOption {
         description = ''
           The IP address of the machine, version 6. It will be injected as a
@@ -155,5 +177,13 @@ in
         this for testing machines, as it is a security hole for so many reasons.
       '';
     };
+
+    isQemuVm = mkOption {
+      description = ''
+        Whether the machine is a QEMU VM. This will import all the necessary
+        things.
+      '';
+      default = true;
+    };
   };
 }

infra/common/resource.nix

@@ -36,8 +36,8 @@ in
   ## should go into the `./nixos` subdirectory.
   nixos.module = {
     imports = [
-      (import "${agenix}/modules/age.nix")
-      (import "${disko}/module.nix")
+      "${agenix}/modules/age.nix"
+      "${disko}/module.nix"
       ./options.nix
       ./nixos
     ];

infra/flake-part.nix

@@ -157,6 +157,10 @@ in
 {
   _class = "flake";
 
+  # NOTE: `forgejo-ci`, being a physical machine and not a Proxmox VM, gets
+  # custom treatment.
+  imports = [ ./forgejo-ci/flake-part.nix ];
+
   ## - Each normal or test machine gets a NixOS configuration.
   ## - Each normal or test machine gets a VM options entry.
   ## - Each normal machine gets a deployment.

infra/forgejo-ci/configuration.nix

@@ -0,0 +1,76 @@
+{ config, lib, ... }:
+
+let
+  inherit (lib) mkDefault mkForce;
+
+in
+{
+  imports = [
+    ../common/options.nix
+    ../common/nixos
+    ./forgejo-actions-runner.nix
+  ];
+
+  fediversityVm = {
+    name = "forgejo-ci";
+    domain = "procolix.com";
+
+    ipv4 = {
+      interface = "enp1s0f0";
+      address = "192.168.201.65";
+      prefixLength = 24;
+      gateway = "192.168.201.1";
+    };
+    ipv6.enable = false;
+
+    # Most Procolix machines are QEMU VMs so the options are tailored to them by
+    # default. `forgejo-ci` is not, so we need to explicitly disable them.
+    isQemuVm = false;
+  };
+
+  networking = {
+    nftables.enable = mkForce false;
+    hostId = "1d6ea552";
+  };
+
+  hardware.cpu.intel.updateMicrocode = mkDefault config.hardware.enableRedistributableFirmware;
+
+  boot = {
+    ## In an initial version, we used `mkForce` to remove QEMU VM-specific
+    ## kernel modules. This is a terrible idea as it will also remove other
+    ## kernel modules, for instance the ones added for ZFS.
+    initrd = {
+      availableKernelModules = [
+        "ahci"
+        "xhci_pci"
+        "ehci_pci"
+        "nvme"
+        "megaraid_sas"
+        "usbhid"
+        "usb_storage"
+        "sd_mod"
+      ];
+      kernelModules = [ ];
+    };
+    kernelModules = [ "kvm-intel" ];
+  };
+
+  fileSystems."/" = {
+    device = "rpool/root";
+    fsType = "zfs";
+  };
+
+  fileSystems."/home" = {
+    device = "rpool/home";
+    fsType = "zfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/50B2-DD3F";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+}

infra/forgejo-ci/flake-part.nix

@@ -0,0 +1,54 @@
+{ lib, inputs, ... }:
+
+## NOTE: Hackish solution mostly taken from `../common/resource.nix`.
+## Eventually, `forgejo-ci` should move to a datacentre somewhere and this code
+## should be integrated with the code for other machines (in particular VMs).
+
+let
+  inherit (lib) attrValues elem;
+  inherit (lib.attrsets) concatMapAttrs optionalAttrs;
+  inherit (lib.strings) removeSuffix;
+
+  secretsPrefix = ../../secrets;
+  secrets = import (secretsPrefix + "/secrets.nix");
+  keys = import ../../keys;
+  hostPublicKey = keys.systems.forgejo-ci;
+
+  sources = import ../../npins;
+in
+{
+  nixops4Deployments.forgejo-ci =
+    { providers, ... }:
+    {
+      providers.local = inputs.nixops4.modules.nixops4Provider.local;
+
+      resources.forgejo-ci = {
+        type = providers.local.exec;
+        imports = [ inputs.nixops4-nixos.modules.nixops4Resource.nixos ];
+
+        ssh = {
+          host = "forgejo-ci";
+          hostPublicKey = hostPublicKey;
+        };
+
+        nixpkgs = inputs.nixpkgs;
+
+        nixos.module = {
+          imports = with sources; [
+            "${agenix}/modules/age.nix"
+            "${disko}/module.nix"
+            ./configuration.nix
+          ];
+
+          age.secrets = concatMapAttrs (
+            name: secret:
+            optionalAttrs (elem hostPublicKey secret.publicKeys) ({
+              ${removeSuffix ".age" name}.file = secretsPrefix + "/${name}";
+            })
+          ) secrets;
+
+          users.users.root.openssh.authorizedKeys.keys = attrValues keys.contributors;
+        };
+      };
+    };
+}

infra/forgejo-ci/forgejo-actions-runner.nix

@@ -0,0 +1,44 @@
+{ pkgs, config, ... }:
+
+{
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-actions-runner;
+
+    instances.default = {
+      enable = true;
+
+      name = config.networking.fqdn;
+      url = "https://git.fediversity.eu";
+      tokenFile = config.age.secrets.forgejo-runner-token.path;
+
+      settings = {
+        log.level = "info";
+        runner = {
+          file = ".runner";
+          capacity = 1;
+          timeout = "3h";
+          insecure = false;
+          fetch_timeout = "5s";
+          fetch_interval = "2s";
+        };
+      };
+
+      ## This runner supports Docker (with a default Ubuntu image) and native
+      ## modes. In native mode, it contains a few default packages.
+      labels = [
+        "docker:docker://node:16-bullseye"
+        "native:host"
+      ];
+
+      hostPackages = with pkgs; [
+        bash
+        git
+        nix
+        nodejs
+      ];
+    };
+  };
+
+  ## For the Docker mode of the runner.
+  virtualisation.docker.enable = true;
+}

keys/systems/forgejo-ci.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFXQW5fxJoNY9wtTMsNExgbAbvyljIRGBLjY+USh/0A

machines/dev/fedi201/fedipanel.nix

@@ -4,12 +4,14 @@
 }:
 let
   name = "panel";
+  sources = import ../../../npins;
 in
 {
   _class = "nixos";
 
   imports = [
     (import ../../../panel { }).module
+    (import "${sources.home-manager}/nixos")
   ];
 
   security.acme = {

machines/machines.md

@@ -7,9 +7,10 @@ Currently, this repository keeps track of the following VMs:
 
 Machine | Proxmox | Description
 --------|---------|-------------
-[`fedi200`](./fedi200) | fediversity | Testing machine for Hans
-[`fedi201`](./fedi201) | fediversity | FediPanel
-[`vm02116`](./vm02116) | procolix | Forgejo
-[`vm02187`](./vm02187) | procolix | Wiki
+[`fedi200`](./dev/fedi200) | fediversity | Testing machine for Hans
+[`fedi201`](./dev/fedi201) | fediversity | FediPanel
+[`vm02116`](./dev/vm02116) | procolix | Forgejo
+[`vm02187`](./dev/vm02187) | procolix | Wiki
+| `forgejo-ci` | n/a (physical) | Forgejo actions runner |
 
 This table excludes all machines with names starting with `test`.

machines/machines.md.sh

@@ -32,11 +32,12 @@ for machine in $(echo "$vmOptions" | jq -r 'keys[]'); do
     description=$(echo "$vmOptions" | jq -r ".$machine.description" | head -n 1)
 
     # shellcheck disable=SC2016
-    printf '[`%s`](./%s) | %s | %s\n' "$machine" "$machine" "$proxmox" "$description"
+    printf '[`%s`](./dev/%s) | %s | %s\n' "$machine" "$machine" "$proxmox" "$description"
   fi
 done
 
 cat <<\EOF
+| `forgejo-ci` | n/a (physical) | Forgejo actions runner |
 
 This table excludes all machines with names starting with `test`.
 EOF

npins/sources.json

@@ -96,6 +96,19 @@
       "url": "https://github.com/hercules-ci/gitignore.nix/archive/637db329424fd7e46cf4185293b9cc8c88c95394.tar.gz",
       "hash": "02wxkdpbhlm3yk5mhkhsp3kwakc16xpmsf2baw57nz1dg459qv8w"
     },
+    "home-manager": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "nix-community",
+        "repo": "home-manager"
+      },
+      "branch": "master",
+      "submodules": false,
+      "revision": "863842639722dd12ae9e37ca83bcb61a63b36f6c",
+      "url": "https://github.com/nix-community/home-manager/archive/863842639722dd12ae9e37ca83bcb61a63b36f6c.tar.gz",
+      "hash": "0rw9n8d4v87pzlmw7ws15f0sldb51fd9528skpbzmrzl4pinsgij"
+    },
     "htmx": {
       "type": "GitRelease",
       "repository": {

panel/nix/configuration.nix

@@ -2,6 +2,7 @@
   config,
   pkgs,
   lib,
+  inputs,
   ...
 }:
 let
@@ -147,6 +148,19 @@ in
         NixOps4 from the package's npins-based code, we will have to do with
         this workaround.
       '';
+      default =
+        let
+          sources = import ../../npins;
+          inherit (import sources.flake-inputs) import-flake load-flake;
+          inherit
+            (import-flake {
+              src = ../../.;
+            })
+            inputs
+            ;
+          inherit (inputs) nixops4;
+        in
+        (load-flake nixops4).packages.${pkgs.system}.default;
     };
 
     deployment = {

secrets/secrets.nix

@@ -26,7 +26,7 @@ concatMapAttrs
     {
       forgejo-database-password = [ vm02116 ];
       forgejo-email-password = [ vm02116 ];
-      forgejo-runner-token = [ ];
+      forgejo-runner-token = [ forgejo-ci ];
       panel-secret-key = [ fedi201 ];
       panel-ssh-key = [ fedi201 ];
       wiki-basicauth-htpasswd = [ vm02187 ];