firedragon-runner (stormwing)

This container is a CI runner for building and testing the Firedragon browser in an isolated environment. It is separate from the other GitLab runner to ensure only one build runs at a time, while the others can run in parallel.

Nix expression

{
  garuda-lib,
  inputs,
  keys,
  ...
}:
{
  # No default modules, untrusted container!
  imports = [
    inputs.sops-nix.nixosModules.sops
    ../../modules/garuda-lib.nix
    ../../modules/hardening.nix
    ../../modules/motd.nix
    ../../services/compose-runner/compose-runner.nix
    ../../services/mk.nix
    ../../services/monitoring
  ];

  inherit
    (garuda-lib.mkUntrustedRunner {
      user = "stefan";
      home = "/home/stefan";
      key = keys.stefan;
      units = [
        "compose-runner-firedragon.service"
        "docker.service"
      ];
      runners = {
        firedragon-runner = {
          source = ../../../compose/firedragon-runner;
        };
      };
    })
    garuda
    nix
    security
    services
    systemd
    users
    virtualisation
    ;

  system.stateVersion = "25.05";
}

Docker containers

services:
  firedragon-runner:
    image: gitlab/gitlab-runner:alpine
    container_name: firedragon-runner
    volumes:
      - ./firedragon-runner:/etc/gitlab-runner
      - /var/run/docker.sock:/var/run/docker.sock
    restart: 'no'
  firedragon-runner-dind:
    image: gitlab/gitlab-runner:alpine
    container_name: firedragon-runner-dind
    volumes:
      - ./firedragon-runner-dind:/etc/gitlab-runner
      - /var/run/docker.sock:/var/run/docker.sock
    restart: 'no'