fix: git is important enough that it should have its own folder
This commit is contained in:
parent
86e0c091fb
commit
98136e802b
GPG key ID:
54E2C71918E93B74
4 changed files with 10 additions and 10 deletions
252
applications/git/gitlab.nix
Normal file
252
applications/git/gitlab.nix
Normal file
|
|
@ -0,0 +1,252 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
name = "gitlab";
|
||||
cfg = config.services.skynet."${name}";
|
||||
|
||||
domain_base = "${cfg.domain.base}.${cfg.domain.tld}";
|
||||
domain_full = "${cfg.domain.sub}.${domain_base}";
|
||||
in {
|
||||
imports = [
|
||||
];
|
||||
|
||||
options.services.skynet."${name}" = {
|
||||
enable = mkEnableOption "Skynet Gitlab";
|
||||
|
||||
domain = {
|
||||
tld = mkOption {
|
||||
type = types.str;
|
||||
default = "ie";
|
||||
};
|
||||
|
||||
base = mkOption {
|
||||
type = types.str;
|
||||
default = "skynet";
|
||||
};
|
||||
|
||||
sub = mkOption {
|
||||
type = types.str;
|
||||
default = name;
|
||||
};
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
# changes teh ssh user
|
||||
default = "git";
|
||||
};
|
||||
|
||||
ldap = {
|
||||
base = mkOption {
|
||||
type = types.str;
|
||||
default = "dc=skynet,dc=ie";
|
||||
description = lib.mdDoc "The base address in the ldap server";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# delete all data
|
||||
# rm -rf /run/gitlab && rm -rf /var/gitlab && rm -rf /var/lib/postgresql && rm -rf /run/gitlab && rm -rf /var/lib/redis-gitlab
|
||||
# find all data
|
||||
# grep -r --exclude-dir={docker,containers,log,sys,nix,proc} gitlab /
|
||||
|
||||
age.secrets.gitlab_pw = {
|
||||
file = ../../secrets/gitlab/pw.age;
|
||||
owner = cfg.user;
|
||||
group = cfg.user;
|
||||
};
|
||||
age.secrets.gitlab_secrets_db = {
|
||||
file = ../../secrets/gitlab/secrets_db.age;
|
||||
owner = cfg.user;
|
||||
group = cfg.user;
|
||||
};
|
||||
age.secrets.gitlab_secrets_secret = {
|
||||
file = ../../secrets/gitlab/secrets_secret.age;
|
||||
owner = cfg.user;
|
||||
group = cfg.user;
|
||||
};
|
||||
age.secrets.gitlab_secrets_otp = {
|
||||
file = ../../secrets/gitlab/secrets_otp.age;
|
||||
owner = cfg.user;
|
||||
group = cfg.user;
|
||||
};
|
||||
age.secrets.gitlab_secrets_jws = {
|
||||
file = ../../secrets/gitlab/secrets_jws.age;
|
||||
owner = cfg.user;
|
||||
group = cfg.user;
|
||||
};
|
||||
age.secrets.gitlab_db_pw = {
|
||||
file = ../../secrets/gitlab/db_pw.age;
|
||||
owner = cfg.user;
|
||||
group = cfg.user;
|
||||
};
|
||||
|
||||
services.skynet.acme.domains = [
|
||||
"${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}"
|
||||
# Lets Encrypt seems to have a 4 levels limit for certs
|
||||
"*.pages.${cfg.domain.base}.${cfg.domain.tld}"
|
||||
];
|
||||
|
||||
# using https://nixos.org/manual/nixos/stable/index.html#module-services-gitlab as a guide
|
||||
services.skynet.dns.records = [
|
||||
{
|
||||
record = cfg.domain.sub;
|
||||
r_type = "A";
|
||||
value = config.services.skynet.host.ip;
|
||||
}
|
||||
# for gitlab pages
|
||||
{
|
||||
record = "*.pages.${cfg.domain.base}.${cfg.domain.tld}.";
|
||||
r_type = "A";
|
||||
value = config.services.skynet.host.ip;
|
||||
}
|
||||
|
||||
# for email
|
||||
{
|
||||
record = "${cfg.domain.sub}";
|
||||
r_type = "MX";
|
||||
value = ''10 ${domain_full}.'';
|
||||
}
|
||||
{
|
||||
record = config.services.skynet.host.ip;
|
||||
r_type = "PTR";
|
||||
value = "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}.";
|
||||
}
|
||||
{
|
||||
record = "${domain_full}.";
|
||||
r_type = "TXT";
|
||||
value = ''"v=spf1 a:gitlab.skynet.ie -all"'';
|
||||
}
|
||||
{
|
||||
record = "_dmarc.${domain_full}.";
|
||||
r_type = "TXT";
|
||||
value = ''"v=DMARC1; p=none"'';
|
||||
}
|
||||
];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
# for git
|
||||
2222
|
||||
];
|
||||
|
||||
services.openssh.ports = [22 2222];
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
# main site
|
||||
"${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "skynet";
|
||||
locations."/" = {
|
||||
proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
extraConfig = ''
|
||||
client_max_body_size 1000M;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# pages
|
||||
"*.pages.${cfg.domain.base}.${cfg.domain.tld}" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "skynet";
|
||||
locations."/".proxyPass = "http://127.0.0.1:8091";
|
||||
};
|
||||
};
|
||||
|
||||
# set a valid HELO address
|
||||
services.postfix = {
|
||||
hostname = lib.mkForce domain_full;
|
||||
origin = lib.mkForce domain_full;
|
||||
domain = lib.mkForce domain_base;
|
||||
};
|
||||
|
||||
services.gitlab = {
|
||||
enable = true;
|
||||
|
||||
databasePasswordFile = config.age.secrets.gitlab_db_pw.path;
|
||||
initialRootPasswordFile = config.age.secrets.gitlab_pw.path;
|
||||
https = true;
|
||||
host = "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}";
|
||||
port = 443;
|
||||
user = cfg.user;
|
||||
group = cfg.user;
|
||||
databaseUsername = cfg.user;
|
||||
|
||||
pages = {
|
||||
# TODO: https://docs.gitlab.com/ee/administration/pages/index.html#add-the-domain-to-the-public-suffix-list
|
||||
enable = true;
|
||||
settings = {
|
||||
# these are just examples, not to use
|
||||
#artifacts-server = "http(s)://<services.gitlab.host>/api/v4"
|
||||
#gitlab-server = "http(s)://<services.gitlab.host>"
|
||||
pages-domain = "pages.${cfg.domain.base}.${cfg.domain.tld}";
|
||||
|
||||
listen-http = [
|
||||
"127.0.0.1:8091"
|
||||
];
|
||||
|
||||
/*
|
||||
auth-client-id = "generated-id-xxxxxxx";
|
||||
auth-client-secret = { _secret = "/var/keys/auth-client-secret"; };
|
||||
auth-redirect-uri = "https://projects.example.com/auth";
|
||||
auth-secret = { _secret = "/var/keys/auth-secret"; };
|
||||
auth-server = "https://gitlab.example.com";
|
||||
*/
|
||||
};
|
||||
};
|
||||
|
||||
# use the local email client
|
||||
smtp.enable = true;
|
||||
|
||||
secrets = {
|
||||
dbFile = config.age.secrets.gitlab_secrets_db.path;
|
||||
secretFile = config.age.secrets.gitlab_secrets_secret.path;
|
||||
otpFile = config.age.secrets.gitlab_secrets_otp.path;
|
||||
jwsFile = config.age.secrets.gitlab_secrets_jws.path;
|
||||
};
|
||||
extraConfig = {
|
||||
gitlab_shell = {
|
||||
ssh_port = 2222;
|
||||
};
|
||||
|
||||
ldap = {
|
||||
enabled = true;
|
||||
servers = {
|
||||
main = {
|
||||
label = "Skynet";
|
||||
host = "account.skynet.ie";
|
||||
port = 636;
|
||||
uid = "uid";
|
||||
encryption = "simple_tls";
|
||||
active_directory = false;
|
||||
base = "ou=users,${cfg.ldap.base}";
|
||||
user_filter = "(memberOf=cn=skynet-users,ou=groups,${cfg.ldap.base}))";
|
||||
|
||||
attributes = {
|
||||
username = "uid";
|
||||
email = "skMail";
|
||||
name = "cn";
|
||||
};
|
||||
|
||||
group_base = "ou=groups,${cfg.ldap.base}";
|
||||
admin_group = "skynet-admins";
|
||||
|
||||
sync_ssh_keys = "sshPublicKey";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
pages = {
|
||||
# default for pages is set to 8090 but that leaves an "ugly" port in the url,
|
||||
# override it here to make it look good
|
||||
port = 80;
|
||||
#external_http = ["${config.services.skynet.host.ip}:80"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
123
applications/git/gitlab_runner.nix
Normal file
123
applications/git/gitlab_runner.nix
Normal file
|
|
@ -0,0 +1,123 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
name = "gitlab_runner";
|
||||
cfg = config.services.skynet."${name}";
|
||||
in {
|
||||
imports = [
|
||||
];
|
||||
|
||||
options.services.skynet."${name}" = {
|
||||
enable = mkEnableOption "Skynet Gitlab Runner";
|
||||
|
||||
runner = {
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
|
||||
gitlab = mkOption {
|
||||
default = "https://gitlab.skynet.ie";
|
||||
type = types.str;
|
||||
};
|
||||
|
||||
description = mkOption {
|
||||
default = cfg.runner.name;
|
||||
type = types.str;
|
||||
};
|
||||
|
||||
docker = {
|
||||
image = mkOption {
|
||||
default = "alpine:latest";
|
||||
type = types.str;
|
||||
};
|
||||
|
||||
cleanup_dates = mkOption {
|
||||
# https://man.archlinux.org/man/systemd.time.7#CALENDAR_EVENTS
|
||||
# it will use a lot of storage so clear it daily, may change to hourly if required
|
||||
default = "daily";
|
||||
type = types.str;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# https://search.nixos.org/options?from=0&size=50&sort=alpha_desc&type=packages&query=services.gitlab-runner.
|
||||
environment.systemPackages = [
|
||||
pkgs.gitlab-runner
|
||||
];
|
||||
|
||||
age.secrets.runner_01_nix.file = ../../secrets/gitlab/runners/runner01.age;
|
||||
age.secrets.runner_02_general.file = ../../secrets/gitlab/runners/runner02.age;
|
||||
|
||||
boot.kernel.sysctl."net.ipv4.ip_forward" = true; # 1
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
# taken from https://github.com/NixOS/nixpkgs/issues/245365#issuecomment-1663854128
|
||||
virtualisation.docker.listenOptions = ["/run/docker.sock" "127.0.0.1:2375"];
|
||||
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
|
||||
# clear-docker-cache = {
|
||||
# enable = true;
|
||||
# dates = cfg.runner.docker.cleanup_dates;
|
||||
# };
|
||||
|
||||
services = {
|
||||
# might make a function later to have multiple runners, might never need it though
|
||||
runner_nix = {
|
||||
cloneUrl = cfg.runner.gitlab;
|
||||
description = "For Nix only";
|
||||
registrationFlags = ["--docker-host" "tcp://127.0.0.1:2375"];
|
||||
registrationConfigFile = config.age.secrets.runner_01_nix.path;
|
||||
dockerImage = cfg.runner.docker.image;
|
||||
|
||||
# from https://nixos.wiki/wiki/Gitlab_runner
|
||||
dockerVolumes = [
|
||||
"/nix/store:/nix/store:ro"
|
||||
"/nix/var/nix/db:/nix/var/nix/db:ro"
|
||||
"/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
|
||||
];
|
||||
dockerDisableCache = true;
|
||||
preBuildScript = pkgs.writeScript "setup-container" ''
|
||||
mkdir -p -m 0755 /nix/var/log/nix/drvs
|
||||
mkdir -p -m 0755 /nix/var/nix/gcroots
|
||||
mkdir -p -m 0755 /nix/var/nix/profiles
|
||||
mkdir -p -m 0755 /nix/var/nix/temproots
|
||||
mkdir -p -m 0755 /nix/var/nix/userpool
|
||||
mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
|
||||
mkdir -p -m 1777 /nix/var/nix/profiles/per-user
|
||||
mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
|
||||
mkdir -p -m 0700 "$HOME/.nix-defexpr"
|
||||
. ${pkgs.nix}/etc/profile.d/nix-daemon.sh
|
||||
${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixos-unstable nixpkgs
|
||||
${pkgs.nix}/bin/nix-channel --update nixpkgs
|
||||
${pkgs.nix}/bin/nix-env -i ${concatStringsSep " " (with pkgs; [lix cacert git openssh])}
|
||||
nix --version
|
||||
'';
|
||||
environmentVariables = {
|
||||
ENV = "/etc/profile";
|
||||
USER = "root";
|
||||
NIX_REMOTE = "daemon";
|
||||
PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
|
||||
NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
|
||||
};
|
||||
tagList = ["nix"];
|
||||
};
|
||||
|
||||
runner_general = {
|
||||
cloneUrl = cfg.runner.gitlab;
|
||||
description = "General Runner";
|
||||
registrationFlags = ["--docker-host" "tcp://127.0.0.1:2375"];
|
||||
registrationConfigFile = config.age.secrets.runner_02_general.path;
|
||||
dockerImage = cfg.runner.docker.image;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue