github-runner (stormwing)

This container is a GitHub Actions runner for CI/CD tasks related to Garuda Linux projects.

General

With this container, we provide a GitHub runner as well as (more recently), a GitLab runner. This container does not have the regular Garuda configurations because it is considered untrusted. Access needs to happen by running nixos-container root-login on stormwing.

Restarting containers

This can happen via the following commands:

sudo systemctl restart compose-runner-github-runner
sudo systemctl restart compose-runner-gitlab-runner

Watchtower additionally keeps the containers up to date.

Nix expression

{
  garuda-lib,
  inputs,
  keys,
  ...
}:
{
  # No default modules, untrusted container!
  imports = [
    inputs.sops-nix.nixosModules.sops
    ../../modules/garuda-lib.nix
    ../../modules/hardening.nix
    ../../modules/motd.nix
    ../../services/compose-runner/compose-runner.nix
    ../../services/mk.nix
    ../../services/monitoring
  ];

  inherit
    (garuda-lib.mkUntrustedRunner {
      user = "pedrohlc";
      home = "/home/pedrohlc";
      key = keys.pedrohlc;
      units = [
        "compose-runner-github-runner.service"
        "docker.service"
      ];
      runners = {
        github-runner = {
          envfile = "/var/.github-runner.env";
          source = ../../../compose/github-runner;
        };
        gitlab-runner = {
          source = ../../../compose/gitlab-runner;
        };
      };
    })
    garuda
    nix
    security
    services
    systemd
    users
    virtualisation
    ;

  system.stateVersion = "25.05";
}

Docker containers (GitHub)

services:
  github-runner:
    image: myoung34/github-runner:latest
    container_name: github-runner
    privileged: true
    environment:
      ACCESS_TOKEN: ${ACCESS_TOKEN:-?err}
      EPHEMERAL: true
      LABELS: nyxbuilder
      ORG_NAME: chaotic-cx
      RUNNER_NAME: immortalis
      RUNNER_SCOPE: org
      RUNNER_WORKDIR: /var/cache/github-runner/work
    volumes: ['/var/cache/github-runner/work:/var/cache/github-runner/work']
    restart: 'no'

Docker containers (GitLab)

services:
  gitlab-runner-garuda:
    image: gitlab/gitlab-runner:alpine
    container_name: gitlab-runner-garuda
    volumes:
      - /etc/gitlab-runner:/etc/gitlab-runner
      - /var/run/docker.sock:/var/run/docker.sock
    restart: 'no'
  gitlab-runner-chaotic:
    image: gitlab/gitlab-runner:alpine
    container_name: gitlab-runner-chaotic
    volumes:
      - /etc/gitlab-runner/chaotic:/etc/gitlab-runner
      - /var/run/docker.sock:/var/run/docker.sock
    restart: 'no'
  gitlab-runner-dind:
    image: gitlab/gitlab-runner:alpine
    container_name: gitlab-runner-dind
    volumes:
      - /etc/gitlab-runner/dind:/etc/gitlab-runner
      - /var/run/docker.sock:/var/run/docker.sock
    restart: 'no'
  # Automated container updates
  watchtower:
    image: nickfedor/watchtower:1.22.1
    container_name: watchtower
    command: --cleanup watchtower gitlab-runner-chaotic gitlab-runner-garuda gitlab-runner-dind
    volumes: ['/var/run/docker.sock:/var/run/docker.sock']
    restart: always