Sergei Poljanski
71047d179d
Some checks failed
nixos / asxpio-services (push) Failing after 54s
Renovate now runs from its own repository for every repo, with the shared rules in its preset. Extend that preset here and keep only what is specific to this repo (the Ansible var manager, the Paper JRE, the runner and nix notes); drop the workflow that ran it for iac alone. Assisted-by: Claude:opus-5-5
114 lines
3.5 KiB
Nix
114 lines
3.5 KiB
Nix
# Forgejo Actions runner. It runs as a container and starts job containers
|
|
# through the Docker socket. Its registration lives in
|
|
# /opt/forgejo-runner/data/.runner and is state, not configuration.
|
|
#
|
|
# Deploying a change to it restarts the runner under the job that deploys:
|
|
# the change lands, that job shows as cancelled, and the next run confirms
|
|
# the result.
|
|
{ pkgs, ... }:
|
|
let
|
|
# renovate: datasource=docker depName=code.forgejo.org/forgejo/runner
|
|
runnerVersion = "13";
|
|
|
|
# Image behind the nix-latest label. Jobs mount a nix-store volume over
|
|
# /nix, seeded from this image on first use; the image's /bin/sh and
|
|
# /etc/nix/nix.conf link into that store, so a volume from another
|
|
# version breaks them. Bumping this also switches to a fresh volume;
|
|
# remove the old one afterwards: docker volume rm nix-store-<old version>
|
|
# renovate: datasource=docker depName=nixos/nix
|
|
nixVersion = "2.35.6";
|
|
|
|
settings = {
|
|
log = {
|
|
level = "info";
|
|
job_level = "info";
|
|
};
|
|
runner = {
|
|
file = "/data/.runner";
|
|
capacity = 4;
|
|
envs = { };
|
|
env_file = ".env";
|
|
timeout = "3h";
|
|
shutdown_timeout = "3h";
|
|
insecure = false;
|
|
fetch_timeout = "5s";
|
|
fetch_interval = "2s";
|
|
report_interval = "1s";
|
|
labels = [
|
|
"ubuntu-latest:docker://node:20-bookworm"
|
|
"ubuntu-22.04:docker://node:20-bookworm"
|
|
"ubuntu-24.04:docker://node:22-bookworm"
|
|
"debian-latest:docker://debian:bookworm"
|
|
"debian-12:docker://debian:bookworm"
|
|
"debian-11:docker://debian:bullseye"
|
|
"arch-latest:docker://archlinux:latest"
|
|
"nginx-latest:docker://nginx:latest"
|
|
"nginx-alpine:docker://nginx:alpine"
|
|
"node-20:docker://node:20"
|
|
"node-22:docker://node:22"
|
|
"python-3.11:docker://python:3.11"
|
|
"python-3.12:docker://python:3.12"
|
|
"alpine-latest:docker://alpine:latest"
|
|
"nix-latest:docker://nixos/nix:${nixVersion}"
|
|
];
|
|
};
|
|
cache = {
|
|
enabled = true;
|
|
port = 0;
|
|
dir = "";
|
|
};
|
|
container = {
|
|
# "" so each workflow gets a bridge network; services (Postgres) need it
|
|
network = "";
|
|
enable_ipv6 = false;
|
|
privileged = false;
|
|
options = "-v nix-store-${nixVersion}:/nix";
|
|
valid_volumes = [ "**" ];
|
|
docker_host = "automount";
|
|
force_pull = false;
|
|
force_rebuild = false;
|
|
};
|
|
};
|
|
|
|
configFile = (pkgs.formats.yaml { }).generate "forgejo-runner.yaml" settings;
|
|
in
|
|
{
|
|
virtualisation.oci-containers.containers.forgejo-runner = {
|
|
image = "code.forgejo.org/forgejo/runner:${runnerVersion}";
|
|
user = "0:0"; # needs the Docker socket
|
|
cmd = [
|
|
"forgejo-runner"
|
|
"daemon"
|
|
"--config"
|
|
"/config.yaml"
|
|
];
|
|
environment.CONFIG_FILE = "/config.yaml";
|
|
volumes = [
|
|
"/opt/forgejo-runner/data:/data"
|
|
"${configFile}:/config.yaml:ro"
|
|
"/var/run/docker.sock:/var/run/docker.sock"
|
|
];
|
|
extraOptions = [ "--network=host" ];
|
|
};
|
|
|
|
# Without its registration the runner only crash-loops
|
|
systemd.services.docker-forgejo-runner.unitConfig.ConditionPathExists =
|
|
"/opt/forgejo-runner/data/.runner";
|
|
|
|
# CI job containers reach the runner's cache server on the host
|
|
networking.firewall.interfaces =
|
|
let
|
|
highPorts.allowedTCPPortRanges = [
|
|
{
|
|
from = 1024;
|
|
to = 65535;
|
|
}
|
|
];
|
|
in
|
|
{
|
|
docker0 = highPorts;
|
|
"br-+" = highPorts;
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [ "d /opt/forgejo-runner/data 0777 root root -" ];
|
|
}
|