gitlab-runner (stormwing)

This container runs GitLab CI runners that build our packages.

General

Two runners are configured on it, stormwing-nix-caching and stormwing-nix-dind. Both make use of the shared Nix cache and are allowed to use KVM, which is why the container has /dev/kvm passed through. The main selling point of these is obviously the shared Nix store, which is the reason why these should in the long run be preferred over the other Docker-based runner.

For these to pick up any builds, the tags nix or nix-dind must be added to the CI configuration.

Its metrics are exposed on port 9252 and published on stormwing’s Tailnet IP for Prometheus (see Monitoring).

Nix expression

{
  config,
  garuda-lib,
  sources,
  ...
}:
{
  imports = sources.defaultModules ++ [ ../../modules ];

  garuda = garuda-lib.mkMonitoring {
    host = "stormwing";
    units = [
      "docker.service"
      "gitlab-runner.service"
    ];
  };

  networking.firewall.interfaces."eth0".allowedTCPPorts = [ 9252 ];

  services.garuda-gitlab-runner = {
    enable = true;
    runners = {
      stormwing-nix-caching = {
        authenticationTokenConfigFile =
          config.sops.secrets."gitlab-runner/runners/stormwing-nix-caching".path;
        nix-caching.enable = true;
        kvm.enable = true;
      };
      stormwing-nix-dind = {
        authenticationTokenConfigFile = config.sops.secrets."gitlab-runner/runners/stormwing-nix-dind".path;
        nix-caching.enable = true;
        kvm.enable = true;
      };
    };
  };

  sops.secrets = garuda-lib.mkSecrets [
    "gitlab-runner/runners/stormwing-nix-caching"
    "gitlab-runner/runners/stormwing-nix-dind"
  ];

  system.stateVersion = "26.11";
}