firedragon-runner (stormwing)

This container is a CI runner for building and testing the Firedragon browser in an isolated environment. It is separate from the other GitLab runner to ensure only one build runs at a time, while the others can run in parallel.

Nix expression

{
  keys,
  ...
}:
{
  # No default modules, untrusted container!
  # imports = sources.defaultModules ++ [
  #   ./garuda/garuda.nix
  # ];

  imports = [
    ../../modules/hardening.nix
    ../../modules/motd.nix
    ../../services/compose-runner/compose-runner.nix
  ];

  # Common Docker configurations
  virtualisation.docker = {
    autoPrune.enable = true;
    autoPrune.flags = [ "-a" ];
  };

  # GitLab runners
  garuda.services.compose-runner.firedragon-runner = {
    source = ../../../compose/firedragon-runner;
  };

  # Enable SSH
  services.openssh.enable = true;

  # No custom users - only Stefan and root via nixos-container root-login
  users = {
    allowNoPasswordLogin = true;
    mutableUsers = false;
    users.stefan = {
      home = "/home/stefan";
      isNormalUser = true;
      openssh.authorizedKeys.keyFiles = [ keys.stefan ];
    };
  };

  nix.settings.trusted-users = [ "stefan" ];
  security.sudo.extraRules = [
    {
      users = [ "stefan" ];
      commands = [
        {
          command = "ALL";
          options = [ "NOPASSWD" ];
        }
      ];
    }
  ];

  systemd.oomd = {
    enable = true;
    enableSystemSlice = true;
    enableUserSlices = true;
  };

  system.stateVersion = "25.05";
}

Docker containers

services:
  firedragon-runner:
    image: gitlab/gitlab-runner:alpine
    container_name: firedragon-runner
    volumes:
      - ./firedragon-runner:/etc/gitlab-runner
      - /var/run/docker.sock:/var/run/docker.sock
    restart: 'no'
  firedragon-runner-dind:
    image: gitlab/gitlab-runner:alpine
    container_name: firedragon-runner-dind
    volumes:
      - ./firedragon-runner-dind:/etc/gitlab-runner
      - /var/run/docker.sock:/var/run/docker.sock
    restart: 'no'