runners

containers/gh-runner.nix → containers/gh-runner-grw.nix

@@ -1,7 +1,17 @@
 { config, lib, pkgs, boot, networking, containers, ... }:
 
 {
-  systemd.services."container@gh-runner".unitConfig = {
+
+  users.users."gh-runner-grw" = {
+    isSystemUser = true;
+    group = "gh-runner-grw";
+    extraGroups = [ "docker" ];
+  };
+  users.groups."gh-runner-grw" = { };
+
+  nix.settings.trusted-users = [ "gh-runner-grw" ];
+
+  systemd.services."container@gh-runner-grw".unitConfig = {
     ConditionPathExists = "/run/gh-runner-georgewhewell-nixos-host.secret";
   };
 
@@ -13,10 +23,10 @@
       permissions = "0777";
     };
 
-  containers.gh-runner = {
+  containers.gh-runner-grw = {
     autoStart = true;
     privateNetwork = true;
-    hostBridge = "br0.lan";
+    hostBridge = "br0";
 
     bindMounts = {
       "/run/gh-runner-georgewhewell-nixos-host.secret" = {
@@ -28,10 +38,19 @@
     config = {
       imports = [ ../profiles/container.nix ];
 
+      users.users."gh-runner-grw" = {
+        isSystemUser = true;
+        group = "gh-runner-grw";
+        extraGroups = [ "docker" ];
+      };
+      users.groups."gh-runner-grw" = { };
+
       services.github-runners."georgewhewell-nixos-host" = {
         enable = true;
         url = "https://github.com/georgewhewell/nixos-host";
         tokenFile = "/run/gh-runner-georgewhewell-nixos-host.secret";
+        user = "gh-runner-grw";
+        group = "gh-runner-grw";
       };
 
       networking.hostName = "gh-runner-georgewhewell-nixos-host";

containers/gh-runner-hellas.nix

@@ -0,0 +1,95 @@
+{ config, lib, pkgs, ... }:
+
+
+{
+
+  users.users."gh-runner-hellas" = {
+    isSystemUser = true;
+    group = "gh-runner-hellas";
+    extraGroups = [ "docker" ];
+  };
+  users.groups."gh-runner-hellas" = { };
+
+  nix.settings.trusted-users = [ "gh-runner-hellas" ];
+
+  systemd.services."container@gh-runner-hellas".unitConfig = {
+    ConditionPathExists = "/run/gh-runner-hellas-a.secret";
+  };
+
+  deployment.keys."gh-runner-hellas-a.secret" =
+    {
+      keyCommand = [ "pass" "gh-runner/hellas-ai-a" ];
+      destDir = "/run";
+      uploadAt = "pre-activation";
+      permissions = "0777";
+    };
+
+  deployment.keys."gh-runner-hellas-b.secret" =
+    {
+      keyCommand = [ "pass" "gh-runner/hellas-ai-b" ];
+      destDir = "/run";
+      uploadAt = "pre-activation";
+      permissions = "0777";
+    };
+
+  deployment.keys."gh-runner-hellas-c.secret" =
+    {
+      keyCommand = [ "pass" "gh-runner/hellas-ai-c" ];
+      destDir = "/run";
+      uploadAt = "pre-activation";
+      permissions = "0777";
+    };
+
+  containers.gh-runner-hellas = {
+    autoStart = true;
+    privateNetwork = true;
+    hostBridge = "br0";
+
+    bindMounts = {
+      "/run/gh-runner-hellas-a.secret".hostPath = "/run/gh-runner-hellas-a.secret";
+      "/run/gh-runner-hellas-b.secret".hostPath = "/run/gh-runner-hellas-b.secret";
+      "/run/gh-runner-hellas-c.secret".hostPath = "/run/gh-runner-hellas-c.secret";
+    };
+
+    config =
+      let
+        user = "gh-runner-hellas";
+        extraPackages = with pkgs; [ docker ];
+      in
+      {
+        imports = [ ../profiles/container.nix ];
+
+        virtualisation.docker.enable = true;
+
+        users.users."gh-runner-hellas" = {
+          isSystemUser = true;
+          group = "gh-runner-hellas";
+          extraGroups = [ "docker" ];
+        };
+        users.groups."gh-runner-hellas" = { };
+
+        services.github-runners."hellas-a" = {
+          enable = true;
+          url = "https://github.com/hellas-ai";
+          tokenFile = "/run/gh-runner-hellas-a.secret";
+          inherit extraPackages user;
+        };
+
+        services.github-runners."hellas-b" = {
+          enable = true;
+          url = "https://github.com/hellas-ai";
+          tokenFile = "/run/gh-runner-hellas-b.secret";
+          inherit extraPackages user;
+        };
+
+        services.github-runners."hellas-c" = {
+          enable = true;
+          url = "https://github.com/hellas-ai";
+          tokenFile = "/run/gh-runner-hellas-c.secret";
+          inherit extraPackages user;
+        };
+
+        networking.hostName = "gh-runner-hellas";
+      };
+  };
+}