asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: run Renovate from asxpi/renovate
Some checks failed
nixos / asxpio-services (push) Failing after 54s
Details

Browse source 
Renovate now runs from its own repository for every repo, with the
shared rules in its preset. Extend that preset here and keep only what
is specific to this repo (the Ansible var manager, the Paper JRE, the
runner and nix notes); drop the workflow that ran it for iac alone.

Assisted-by: Claude:opus-5-5
This commit is contained in:
Sergei Poljanski 2026-11-13 00:00:06 +04:00
commit 71047d179d
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
15 changed files with 705 additions and 284 deletions
Download patch file Download diff file Expand all files Collapse all files

45
nixos/hosts/asxpio-services/runner.nix
View file

@ -1,13 +1,22 @@
# Forgejo Actions runner. It runs as a container and starts job containers
# through Podman's Docker-compatible socket. Its registration lives in
# through the Docker socket. Its registration lives in
# /opt/forgejo-runner/data/.runner and is state, not configuration.
#
# Deploying a change to it restarts the runner under the job that deploys:
# the change lands, that job shows as cancelled, and the next run confirms
# the result.
{ pkgs, ... }:
let
# renovate: datasource=docker depName=code.forgejo.org/forgejo/runner
runnerVersion = "13";
# Image behind the nix-latest label. Jobs mount a nix-store volume over
# /nix, seeded from this image on first use; the image's /bin/sh and
# /etc/nix/nix.conf link into that store, so a volume from another
# version breaks them. Bumping this also switches to a fresh volume.
nixVersion = "2.35.3";
# version breaks them. Bumping this also switches to a fresh volume;
# remove the old one afterwards: docker volume rm nix-store-<old version>
# renovate: datasource=docker depName=nixos/nix
nixVersion = "2.35.6";
settings = {
log = {
@ -65,8 +74,8 @@ let
in
{
virtualisation.oci-containers.containers.forgejo-runner = {
image = "code.forgejo.org/forgejo/runner:11";
user = "0:0"; # needs the container socket
image = "code.forgejo.org/forgejo/runner:${runnerVersion}";
user = "0:0"; # needs the Docker socket
cmd = [
"forgejo-runner"
"daemon"
@ -77,17 +86,29 @@ in
volumes = [
"/opt/forgejo-runner/data:/data"
"${configFile}:/config.yaml:ro"
"/run/podman/podman.sock:/var/run/docker.sock"
"/var/run/docker.sock:/var/run/docker.sock"
];
extraOptions = [ "--network=host" ];
};
systemd.services.podman-forgejo-runner = {
after = [ "podman.socket" ];
requires = [ "podman.socket" ];
# Without its registration the runner only crash-loops
unitConfig.ConditionPathExists = "/opt/forgejo-runner/data/.runner";
};
# Without its registration the runner only crash-loops
systemd.services.docker-forgejo-runner.unitConfig.ConditionPathExists =
"/opt/forgejo-runner/data/.runner";
# CI job containers reach the runner's cache server on the host
networking.firewall.interfaces =
let
highPorts.allowedTCPPortRanges = [
{
from = 1024;
to = 65535;
}
];
in
{
docker0 = highPorts;
"br-+" = highPorts;
};
systemd.tmpfiles.rules = [ "d /opt/forgejo-runner/data 0777 root root -" ];
}