Add dry-build action

Flake lock file updates:

• Updated input 'disko':
    'github:nix-community/disko/d57058eb09dd5ec00c746df34fe0a603ea744370' (2024-05-02)
  → 'github:nix-community/disko/e1b3ae2b4ebc3c7b83154b9361e3d154e64e362d' (2024-05-06)
• Updated input 'nixos-hardware':
    'github:NixOS/nixos-hardware/753176b57b3fcddb140c1c012868e62c025120bd' (2024-05-05)
  → 'github:NixOS/nixos-hardware/e148ccbecbd2fe4dc4768fba67f6db828466ad06' (2024-05-06)
• Updated input 'nixpkgs-unstable':
    'github:NixOS/nixpkgs/e9be42459999a253a9f92559b1f5b72e1b44c13d' (2024-05-03)
  → 'github:NixOS/nixpkgs/25865a40d14b3f9cf19f19b924e2ab4069b09588' (2024-05-05)
• Updated input 'secrets':
    'git+ssh://git@git.vimium.com/jordan/nix-secrets.git?ref=refs/heads/master&rev=f350d35d7651c415fa4c0d6a7cff378ba5650f93' (2024-04-01)
  → 'git+ssh://git@git.vimium.com/jordan/nix-secrets.git?ref=refs/heads/master&rev=b4a1c8968a1cb3688c12caddecd99432494df95b' (2024-05-06)

.gitea/workflows/dry-build.yml

@@ -0,0 +1,15 @@
+name: Dry build
+on:
+  push:
+    branches: ['master']
+jobs:
+  build-amd64-linux:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: master
+      - name: Dry build flake
+        run: |
+          echo "Dry building ${{ gitea.ref }}"
+          nixos-rebuild dry-build --flake .

flake.lock

@@ -109,11 +109,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1714612856,
-        "narHash": "sha256-W7+rtMzRmdovzndN2NYUv5xzkbMudtQ3jbyFuGk0O1E=",
+        "lastModified": 1714959124,
+        "narHash": "sha256-oYmauPDpSgWjY9hvzwd815igGfP8Ds5Bk6bTo5JrBRk=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "d57058eb09dd5ec00c746df34fe0a603ea744370",
+        "rev": "e1b3ae2b4ebc3c7b83154b9361e3d154e64e362d",
         "type": "github"
       },
       "original": {
@@ -305,11 +305,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1714885415,
-        "narHash": "sha256-LG+2IVqVi1fy724rSDAkgqae+f47fGGko4cJhtkN8PE=",
+        "lastModified": 1714984131,
+        "narHash": "sha256-kjIvFbbKb6RGIJyOgcF+BBWHNzhNSNqRTxX/SkrkRno=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "753176b57b3fcddb140c1c012868e62c025120bd",
+        "rev": "e148ccbecbd2fe4dc4768fba67f6db828466ad06",
         "type": "github"
       },
       "original": {
@@ -408,11 +408,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1714763106,
-        "narHash": "sha256-DrDHo74uTycfpAF+/qxZAMlP/Cpe04BVioJb6fdI0YY=",
+        "lastModified": 1714906307,
+        "narHash": "sha256-UlRZtrCnhPFSJlDQE7M0eyhgvuuHBTe1eJ9N9AQlJQ0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e9be42459999a253a9f92559b1f5b72e1b44c13d",
+        "rev": "25865a40d14b3f9cf19f19b924e2ab4069b09588",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1712006510,
-        "narHash": "sha256-JQ3ZcSwIB6d3gDcx/nZCUlSfZGwaI55WNmD9mK2uTPA=",
+        "lastModified": 1715007828,
+        "narHash": "sha256-3791/+OWOMFAY3OFOsOwaFmpo2iIv9iHUhEb63oUL2M=",
         "ref": "refs/heads/master",
-        "rev": "f350d35d7651c415fa4c0d6a7cff378ba5650f93",
-        "revCount": 17,
+        "rev": "b4a1c8968a1cb3688c12caddecd99432494df95b",
+        "revCount": 18,
         "type": "git",
         "url": "ssh://git@git.vimium.com/jordan/nix-secrets.git"
       },

hosts/odyssey/default.nix

@@ -93,6 +93,7 @@
         ];
         repoPath = "ssh://iqwu22oq@iqwu22oq.repo.borgbase.com/./repo";
       };
+      gitea-runner.enable = true;
     };
     shell = {
       git.enable = true;

modules/default.nix

@@ -36,6 +36,7 @@
     ./services/borgmatic
     ./services/coturn
     ./services/gitea
+    ./services/gitea-runner
     ./services/headscale
     ./services/mail
     ./services/matrix-synapse

modules/services/gitea-runner/default.nix

@@ -0,0 +1,226 @@
+{ pkgs, config, lib, inputs, ... }:
+
+# Based on: https://git.clan.lol/clan/clan-infra/src/branch/main/modules/web01/gitea/actions-runner.nix
+
+with lib;
+
+let
+  cfg = config.modules.services.gitea-runner;
+  hostname = config.networking.hostName;
+  giteaUrl = "https://git.vimium.com";
+
+  storeDepsBins = with pkgs; [
+    coreutils
+    findutils
+    gnugrep
+    gawk
+    git
+    nix
+    nix-update
+    bash
+    jq
+    nodejs
+  ];
+
+  storeDeps = pkgs.runCommand "store-deps" { } ''
+    mkdir -p $out/bin
+    for dir in ${toString storeDepsBins}; do
+      for bin in "$dir"/bin/*; do
+        ln -s "$bin" "$out/bin/$(basename "$bin")"
+      done
+    done
+
+    # Add SSL CA certs
+    mkdir -p $out/etc/ssl/certs
+    cp -a "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" $out/etc/ssl/certs/ca-bundle.crt
+  '';
+in
+{
+  options.modules.services.gitea-runner = {
+    enable = mkOption {
+      default = false;
+      example = true;
+      description = mdDoc "Enable a runner for Gitea Actions on this host";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    modules.podman.enable = true;
+
+    systemd.services = {
+      gitea-runner-nix-image = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "podman.service" ];
+        requires = [ "podman.service" ];
+        path = [ config.virtualisation.podman.package pkgs.gnutar pkgs.shadow pkgs.getent ];
+        script = ''
+          set -eux -o pipefail
+          mkdir -p etc/nix
+
+          # Create an unpriveleged user that we can use also without the run-as-user.sh script
+          touch etc/passwd etc/group
+          groupid=$(cut -d: -f3 < <(getent group nix-ci-user))
+          userid=$(cut -d: -f3 < <(getent passwd nix-ci-user))
+          groupadd --prefix $(pwd) --gid "$groupid" nix-ci-user
+          emptypassword='$6$1ero.LwbisiU.h3D$GGmnmECbPotJoPQ5eoSTD6tTjKnSWZcjHoVTkxFLZP17W9hRi/XkmCiAMOfWruUwy8gMjINrBMNODc7cYEo4K.'
+          useradd --prefix $(pwd) -p "$emptypassword" -m -d /tmp -u "$userid" -g "$groupid" -G nix-ci-user nix-ci-user
+
+          cat <<NIX_CONFIG > etc/nix/nix.conf
+          accept-flake-config = true
+          experimental-features = nix-command flakes
+          NIX_CONFIG
+
+          cat <<NSSWITCH > etc/nsswitch.conf
+          passwd:    files mymachines systemd
+          group:     files mymachines systemd
+          shadow:    files
+
+          hosts:     files mymachines dns myhostname
+          networks:  files
+
+          ethers:    files
+          services:  files
+          protocols: files
+          rpc:       files
+          NSSWITCH
+
+          # list the content as it will be imported into the container
+          tar -cv . | tar -tvf -
+          tar -cv . | podman import - gitea-runner-nix
+        '';
+        serviceConfig = {
+          RuntimeDirectory = "gitea-runner-nix-image";
+          WorkingDirectory = "/run/gitea-runner-nix-image";
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+      };
+
+      gitea-runner-nix = {
+        after = [ "gitea-runner-nix-image.service" ];
+        requires = [ "gitea-runner-nix-image.service" ];
+
+        serviceConfig = {
+          # Hardening (may overlap with DynamicUser=)
+          # The following options are only for optimizing output of systemd-analyze
+          AmbientCapabilities = "";
+          CapabilityBoundingSet = "";
+          # ProtectClock= adds DeviceAllow=char-rtc r
+          DeviceAllow = "";
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          UMask = "0066";
+          ProtectProc = "invisible";
+          SystemCallFilter = [
+            "~@clock"
+            "~@cpu-emulation"
+            "~@module"
+            "~@mount"
+            "~@obsolete"
+            "~@raw-io"
+            "~@reboot"
+            "~@swap"
+            # needed by go?
+            #"~@resources"
+            "~@privileged"
+            "~capset"
+            "~setdomainname"
+            "~sethostname"
+          ];
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK" ];
+
+          # Needs network access
+          PrivateNetwork = false;
+          # Cannot be true due to Node
+          MemoryDenyWriteExecute = false;
+
+          # The more restrictive "pid" option makes `nix` commands in CI emit
+          # "GC Warning: Couldn't read /proc/stat"
+          # You may want to set this to "pid" if not using `nix` commands
+          ProcSubset = "all";
+          # Coverage programs for compiled code such as `cargo-tarpaulin` disable
+          # ASLR (address space layout randomization) which requires the
+          # `personality` syscall
+          # You may want to set this to `true` if not using coverage tooling on
+          # compiled code
+          LockPersonality = false;
+
+          # Note that this has some interactions with the User setting; so you may
+          # want to consult the systemd docs if using both.
+          DynamicUser = true;
+        };
+      };
+    };
+
+    users.users.nix-ci-user = {
+      group = "nix-ci-user";
+      description = "Used for running nix-based CI jobs";
+      home = "/var/empty";
+      isSystemUser = true;
+    };
+    users.groups.nix-ci-user = { };
+
+    age.secrets."files/services/gitea-runner/${hostname}-token" = {
+      file = "${inputs.secrets}/files/services/gitea-runner/${hostname}-token.age";
+      group = "podman";
+    };
+
+    services.gitea-actions-runner.instances = {
+      act = {
+        enable = true;
+        url = giteaUrl;
+        name = "act-runner-${hostname}";
+
+        tokenFile = config.age.secrets."files/services/gitea-runner/${hostname}-token".path;
+        settings = {
+          cache.enabled = true;
+          runner.capacity = 4;
+        };
+
+        labels = [
+          "debian-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+          "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+        ];
+      };
+      nix = {
+        enable = true;
+        url = giteaUrl;
+        name = "nix-runner-${hostname}";
+
+        tokenFile = config.age.secrets."files/services/gitea-runner/${hostname}-token".path;
+        settings = {
+          cache.enabled = true;
+          container = {
+            options = "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nix-ci-user";
+            network = "host";
+            valid_volumes = [
+              "/nix"
+              "${storeDeps}/bin"
+              "${storeDeps}/etc/ssl"
+            ];
+          };
+          runner.capacity = 4;
+        };
+
+        labels = [
+          "nix:docker://gitea-runner-nix"
+        ];
+      };
+    };
+  };
+}