github-runner
General
With this container, we provide a GitHub runner as well as (more recently), a GitLab runner. This container does not
have the regular Garuda configurations because it is considered untrusted.
Access needs to happen by running nixos-container root-login
on immortalis
(click me).
Restarting containers
This can happen via the following command:
sudo systemctl restart docker-compose-gitlab-runner-root
Watchtower additionally keeps the containers up to date.
Nix expression
{ keys
, ...
}: {
# No default modules, untrusted container!
# imports = sources.defaultModules ++ [
# ./garuda/garuda.nix
# ];
imports = [
../modules/hardening.nix
../modules/motd.nix
./github-runner/github-compose.nix
./github-runner/gitlab-compose.nix
];
# Common Docker configurations
virtualisation.docker = {
autoPrune.enable = true;
autoPrune.flags = [ "-a" ];
};
# Enable SSH
services.openssh.enable = true;
# No custom users - only Pedro and root via nixos-container root-login
users = {
allowNoPasswordLogin = true;
mutableUsers = false;
users.pedrohlc = {
home = "/home/pedrohlc";
isNormalUser = true;
openssh.authorizedKeys.keyFiles = [ keys.pedrohlc ];
};
};
# Make Pedro god here
nix.settings.trusted-users = [ "pedrohlc" ];
security.sudo.extraRules = [
{
users = [ "pedrohlc" ];
commands = [
{
command = "ALL";
options = [ "NOPASSWD" ];
}
];
}
];
# OOM prevention
systemd.oomd = {
enable = true; # This is actually the default, anyways...
enableSystemSlice = true;
enableUserSlices = true;
};
networking.firewall = {
extraCommands = ''
iptables -t nat -A PREROUTING -p tcp -d 172.17.0.1 --dport 3128 -j DNAT --to-destination 10.0.5.1:3128
iptables -t nat -A POSTROUTING -p tcp -d 172.17.0.1 --dport 3128 -j SNAT --to-source 10.0.5.130
'';
extraStopCommands = ''
iptables -t nat -D PREROUTING -p tcp -d 10.130.0.1 --dport 3128 -j DNAT --to-destination 10.0.5.1:3128
iptables -t nat -D POSTROUTING -p tcp -d 10.0.5.1 --dport 3128 -j SNAT --to-source 10.0.5.130
'';
};
system.stateVersion = "23.05";
}
Docker containers (GitHub)
# Auto-generated using compose2nix v0.2.2-pre.
{ pkgs, lib, ... }:
{
# Runtime
virtualisation.docker = {
enable = true;
autoPrune.enable = true;
};
virtualisation.oci-containers.backend = "docker";
# Containers
virtualisation.oci-containers.containers."github-runner" = {
image = "myoung34/github-runner:2.318.0";
environment = {
"EPHEMERAL" = "true";
"LABELS" = "nyxbuilder";
"ORG_NAME" = "chaotic-cx";
"RUNNER_NAME" = "immortalis";
"RUNNER_SCOPE" = "org";
"RUNNER_WORKDIR" = "/tmp/runner/work";
};
volumes = [
"/tmp/runner:/tmp/runner:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=github-runner"
"--network=github-runner_default"
"--privileged"
];
environmentFiles = [
"/var/garuda/secrets/github-runner.env"
];
};
systemd.services."docker-github-runner" = {
serviceConfig = {
Restart = lib.mkOverride 500 "no";
};
after = [
"docker-network-github-runner_default.service"
];
requires = [
"docker-network-github-runner_default.service"
];
partOf = [
"docker-compose-github-runner-root.target"
];
wantedBy = [
"docker-compose-github-runner-root.target"
];
unitConfig.RequiresMountsFor = [
"/tmp/runner"
];
};
# Networks
systemd.services."docker-network-github-runner_default" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "docker network rm -f github-runner_default";
};
script = ''
docker network inspect github-runner_default || docker network create github-runner_default
'';
partOf = [ "docker-compose-github-runner-root.target" ];
wantedBy = [ "docker-compose-github-runner-root.target" ];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."docker-compose-github-runner-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
}
Docker containers (GitLab)
# Auto-generated using compose2nix v0.2.2-pre.
{ pkgs, lib, ... }:
{
# Runtime
virtualisation.docker = {
enable = true;
autoPrune.enable = true;
};
virtualisation.oci-containers.backend = "docker";
# Containers
virtualisation.oci-containers.containers."gitlab-runner-chaotic" = {
image = "gitlab/gitlab-runner:alpine";
volumes = [
"/etc/gitlab-runner/chaotic:/etc/gitlab-runner:rw"
"/var/run/docker.sock:/var/run/docker.sock:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=gitlab-runner-chaotic"
"--network=gitlab-runner_default"
];
};
systemd.services."docker-gitlab-runner-chaotic" = {
serviceConfig = {
Restart = lib.mkOverride 500 "no";
};
after = [
"docker-network-gitlab-runner_default.service"
];
requires = [
"docker-network-gitlab-runner_default.service"
];
partOf = [
"docker-compose-gitlab-runner-root.target"
];
wantedBy = [
"docker-compose-gitlab-runner-root.target"
];
unitConfig.RequiresMountsFor = [
"/etc/gitlab-runner/chaotic"
"/var/run/docker.sock"
];
};
virtualisation.oci-containers.containers."gitlab-runner-dind" = {
image = "gitlab/gitlab-runner:alpine";
volumes = [
"/etc/gitlab-runner/dind:/etc/gitlab-runner:rw"
"/var/run/docker.sock:/var/run/docker.sock:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=gitlab-runner-dind"
"--network=gitlab-runner_default"
];
};
systemd.services."docker-gitlab-runner-dind" = {
serviceConfig = {
Restart = lib.mkOverride 500 "no";
};
after = [
"docker-network-gitlab-runner_default.service"
];
requires = [
"docker-network-gitlab-runner_default.service"
];
partOf = [
"docker-compose-gitlab-runner-root.target"
];
wantedBy = [
"docker-compose-gitlab-runner-root.target"
];
unitConfig.RequiresMountsFor = [
"/etc/gitlab-runner/dind"
"/var/run/docker.sock"
];
};
virtualisation.oci-containers.containers."gitlab-runner-garuda" = {
image = "gitlab/gitlab-runner:alpine";
volumes = [
"/etc/gitlab-runner:/etc/gitlab-runner:rw"
"/var/run/docker.sock:/var/run/docker.sock:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=gitlab-runner-garuda"
"--network=gitlab-runner_default"
];
};
systemd.services."docker-gitlab-runner-garuda" = {
serviceConfig = {
Restart = lib.mkOverride 500 "no";
};
after = [
"docker-network-gitlab-runner_default.service"
];
requires = [
"docker-network-gitlab-runner_default.service"
];
partOf = [
"docker-compose-gitlab-runner-root.target"
];
wantedBy = [
"docker-compose-gitlab-runner-root.target"
];
unitConfig.RequiresMountsFor = [
"/etc/gitlab-runner"
"/var/run/docker.sock"
];
};
virtualisation.oci-containers.containers."watchtower" = {
image = "containrrr/watchtower:1.7.1";
volumes = [
"/var/run/docker.sock:/var/run/docker.sock:rw"
];
cmd = [ "--cleanup" "gitlab-runner-chaotic" "gitlab-runner-garuda" "gitlab-runner-dind" ];
log-driver = "journald";
extraOptions = [
"--network-alias=watchtower"
"--network=gitlab-runner_default"
];
};
systemd.services."docker-watchtower" = {
serviceConfig = {
Restart = lib.mkOverride 500 "always";
RestartMaxDelaySec = lib.mkOverride 500 "1m";
RestartSec = lib.mkOverride 500 "100ms";
RestartSteps = lib.mkOverride 500 9;
};
after = [
"docker-network-gitlab-runner_default.service"
];
requires = [
"docker-network-gitlab-runner_default.service"
];
partOf = [
"docker-compose-gitlab-runner-root.target"
];
wantedBy = [
"docker-compose-gitlab-runner-root.target"
];
unitConfig.RequiresMountsFor = [
"/var/run/docker.sock"
];
};
# Networks
systemd.services."docker-network-gitlab-runner_default" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "docker network rm -f gitlab-runner_default";
};
script = ''
docker network inspect gitlab-runner_default || docker network create gitlab-runner_default
'';
partOf = [ "docker-compose-gitlab-runner-root.target" ];
wantedBy = [ "docker-compose-gitlab-runner-root.target" ];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."docker-compose-gitlab-runner-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
}