nixos-servers/kubenix-modules/forgejo/default.nix

239 lines
6.3 KiB
Nix
Raw Normal View History

{ lib, myLib, ... }: {
2024-03-29 14:49:34 +00:00
kubernetes.resources = {
2024-04-17 21:19:08 +00:00
secrets.runner-secret.stringData.token = "ref+sops://secrets/sops.yaml#/forgejo/runnerToken";
2024-03-29 14:49:34 +00:00
configMaps = {
2024-05-01 20:34:59 +00:00
forgejo-config.data = {
config = lib.generators.toINI { } (import ./config.nix);
runner-config = lib.generators.toYAML { } (import ./runner-config.nix);
};
2024-03-29 14:49:34 +00:00
forgejo-env.data = {
USER_UID = "1000";
USER_GID = "1000";
};
};
2024-04-17 21:19:08 +00:00
deployments = {
forgejo = {
metadata.labels = {
app = "forgejo";
component = "forgejo";
};
2024-03-29 14:49:34 +00:00
2024-04-17 21:19:08 +00:00
spec = {
selector.matchLabels = {
app = "forgejo";
component = "forgejo";
};
2024-03-29 14:49:34 +00:00
2024-04-17 21:19:08 +00:00
template = {
metadata.labels = {
app = "forgejo";
component = "forgejo";
};
2024-03-29 14:49:34 +00:00
2024-04-17 21:19:08 +00:00
spec = {
containers.forgejo = {
2024-04-29 13:48:25 +00:00
image = "codeberg.org/forgejo/forgejo:7.0.1";
2024-04-17 21:19:08 +00:00
envFrom = [{ configMapRef.name = "forgejo-env"; }];
ports = {
web.containerPort = 3000;
ssh.containerPort = 22;
};
volumeMounts = [
{
name = "data";
mountPath = "/data";
}
{
name = "config";
mountPath = "/data/gitea/conf/app.ini";
subPath = "config";
}
];
};
2024-03-29 14:49:34 +00:00
2024-04-17 21:19:08 +00:00
volumes = {
data.persistentVolumeClaim.claimName = "forgejo";
config.configMap.name = "forgejo-config";
2024-04-14 19:43:31 +00:00
};
2024-04-17 21:19:08 +00:00
};
};
};
};
2024-03-29 14:49:34 +00:00
2024-04-17 21:19:08 +00:00
# Forgejo-runner for docker in docker (dind) on Kubernetes:
# https://code.forgejo.org/forgejo/runner/src/branch/main/examples/kubernetes/dind-docker.yaml
forgejo-runner = {
metadata.labels = {
app = "forgejo";
component = "runner";
};
spec = {
selector.matchLabels = {
app = "forgejo";
component = "runner";
};
template = {
metadata.labels = {
app = "forgejo";
component = "runner";
2024-03-29 14:49:34 +00:00
};
2024-04-17 21:19:08 +00:00
spec = {
restartPolicy = "Always";
2024-05-01 20:34:59 +00:00
serviceAccountName = "forgejo-runner";
2024-04-17 21:19:08 +00:00
initContainers.runner-register = {
image = "code.forgejo.org/forgejo/runner:3.2.0";
command = [ "forgejo-runner" "register" "--no-interactive" "--token" "$(RUNNER_SECRET)" "--name" "$(RUNNER_NAME)" "--instance" "$(FORGEJO_INSTANCE_URL)" ];
env = {
RUNNER_NAME.value = "runner";
FORGEJO_INSTANCE_URL.value = "https://git.kun.is";
RUNNER_SECRET.valueFrom.secretKeyRef = {
name = "runner-secret";
key = "token";
};
};
resources.limits = {
cpu = "0.50";
memory = "64Mi";
};
2024-05-01 20:34:59 +00:00
volumeMounts = [
{
name = "data";
mountPath = "/data";
}
{
name = "config";
mountPath = "/etc/runner-config.yaml";
subPath = "runner-config";
}
];
2024-04-17 21:19:08 +00:00
};
containers = {
runner = {
image = "code.forgejo.org/forgejo/runner:3.0.0";
2024-05-01 20:34:59 +00:00
command = [ "sh" "-c" "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; forgejo-runner --config /etc/runner-config.yaml daemon" ];
2024-04-17 21:19:08 +00:00
env = {
DOCKER_HOST.value = "tcp://localhost:2376";
DOCKER_CERT_PATH.value = "/certs/client";
DOCKER_TLS_VERIFY.value = "1";
};
volumeMounts = [
{
name = "data";
mountPath = "/data";
2024-04-17 21:19:08 +00:00
}
{
name = "certs";
mountPath = "/certs";
2024-04-17 21:19:08 +00:00
}
2024-05-01 20:34:59 +00:00
{
name = "config";
mountPath = "/etc/runner-config.yaml";
subPath = "runner-config";
}
2024-04-17 21:19:08 +00:00
];
};
daemon = {
image = "docker:23.0.6-dind";
securityContext.privileged = true;
env.DOCKER_TLS_CERTDIR.value = "/certs";
volumeMounts = [{
name = "certs";
2024-04-17 21:19:08 +00:00
mountPath = "/certs";
}];
};
};
volumes = {
data.persistentVolumeClaim.claimName = "forgejo-runner-data";
certs.persistentVolumeClaim.claimName = "forgejo-runner-certs";
2024-05-01 20:34:59 +00:00
config.configMap.name = "forgejo-config";
};
2024-04-14 19:00:15 +00:00
};
2024-03-29 14:49:34 +00:00
};
};
};
};
services = {
forgejo-web.spec = {
2024-04-17 21:19:08 +00:00
selector = {
app = "forgejo";
component = "forgejo";
};
2024-03-29 14:49:34 +00:00
2024-04-14 19:43:31 +00:00
ports.web = {
2024-03-29 14:49:34 +00:00
port = 80;
2024-04-14 19:43:31 +00:00
targetPort = "web";
};
2024-03-29 14:49:34 +00:00
};
forgejo-ssh.spec = {
type = "LoadBalancer";
loadBalancerIP = myLib.globals.gitIPv4;
2024-03-29 14:49:34 +00:00
selector.app = "forgejo";
2024-04-14 19:43:31 +00:00
ports.ssh = {
2024-03-29 14:49:34 +00:00
port = 56287;
2024-04-14 19:43:31 +00:00
targetPort = "ssh";
};
2024-03-29 14:49:34 +00:00
};
};
2024-05-01 20:34:59 +00:00
serviceAccounts.forgejo-runner = { };
clusterRoles.forgejo-runner.rules = [
{
apiGroups = [ "*" ];
resources = [ "*" ];
verbs = [ "*" ];
}
{
nonResourceURLs = [ "*" ];
verbs = [ "*" ];
}
];
clusterRoleBindings.forgejo-runner = {
subjects = [{
kind = "ServiceAccount";
name = "forgejo-runner";
namespace = "default";
}];
roleRef = {
kind = "ClusterRole";
name = "forgejo-runner";
apiGroup = "rbac.authorization.k8s.io";
};
};
};
2024-03-29 14:49:34 +00:00
lab = {
ingresses.forgejo = {
host = "git.kun.is";
service = {
name = "forgejo-web";
portName = "web";
};
2024-03-29 14:49:34 +00:00
};
};
}