From 1e894a86723cd3b9fcab1a5cd548f84507942fa5 Mon Sep 17 00:00:00 2001
From: Pim Kunis <pim@kunis.nl>
Date: Thu, 23 May 2024 21:07:32 +0200
Subject: [PATCH] Remove forgejo runner Migrate forgejo data to longhorn

---
 kubenix-modules/forgejo/default.nix       | 136 ----------------------
 kubenix-modules/forgejo/runner-config.nix |  34 ------
 kubenix-modules/volumes.nix               |  15 +--
 nixos-modules/data-sharing.nix            |   6 -
 secrets/sops.yaml                         |   6 +-
 5 files changed, 6 insertions(+), 191 deletions(-)
 delete mode 100644 kubenix-modules/forgejo/runner-config.nix

diff --git a/kubenix-modules/forgejo/default.nix b/kubenix-modules/forgejo/default.nix
index 38105f6..6b25875 100644
--- a/kubenix-modules/forgejo/default.nix
+++ b/kubenix-modules/forgejo/default.nix
@@ -1,11 +1,8 @@
 { lib, myLib, ... }: {
   kubernetes.resources = {
-    secrets.runner-secret.stringData.token = "ref+sops://secrets/sops.yaml#/forgejo/runnerToken";
-
     configMaps = {
       forgejo-config.data = {
         config = lib.generators.toINI { } (import ./config.nix);
-        runner-config = lib.generators.toYAML { } (import ./runner-config.nix);
       };
 
       forgejo-env.data = {
@@ -64,111 +61,6 @@
           };
         };
       };
-
-      # Forgejo-runner for docker in docker (dind) on Kubernetes:
-      # https://code.forgejo.org/forgejo/runner/src/branch/main/examples/kubernetes/dind-docker.yaml
-      forgejo-runner = {
-        metadata.labels = {
-          app = "forgejo";
-          component = "runner";
-        };
-
-        spec = {
-          selector.matchLabels = {
-            app = "forgejo";
-            component = "runner";
-          };
-
-          template = {
-            metadata.labels = {
-              app = "forgejo";
-              component = "runner";
-            };
-
-            spec = {
-              restartPolicy = "Always";
-              serviceAccountName = "forgejo-runner";
-
-              initContainers.runner-register = {
-                image = "code.forgejo.org/forgejo/runner:3.2.0";
-                command = [ "forgejo-runner" "register" "--no-interactive" "--token" "$(RUNNER_SECRET)" "--name" "$(RUNNER_NAME)" "--instance" "$(FORGEJO_INSTANCE_URL)" ];
-
-                env = {
-                  RUNNER_NAME.value = "runner";
-                  FORGEJO_INSTANCE_URL.value = "https://git.kun.is";
-                  RUNNER_SECRET.valueFrom.secretKeyRef = {
-                    name = "runner-secret";
-                    key = "token";
-                  };
-                };
-
-                resources.limits = {
-                  cpu = "0.50";
-                  memory = "64Mi";
-                };
-
-                volumeMounts = [
-                  {
-                    name = "data";
-                    mountPath = "/data";
-                  }
-                  {
-                    name = "config";
-                    mountPath = "/etc/runner-config.yaml";
-                    subPath = "runner-config";
-                  }
-                ];
-              };
-
-              containers = {
-                runner = {
-                  image = "code.forgejo.org/forgejo/runner:3.0.0";
-                  command = [ "sh" "-c" "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; forgejo-runner --config /etc/runner-config.yaml daemon" ];
-
-                  env = {
-                    DOCKER_HOST.value = "tcp://localhost:2376";
-                    DOCKER_CERT_PATH.value = "/certs/client";
-                    DOCKER_TLS_VERIFY.value = "1";
-                  };
-
-                  volumeMounts = [
-                    {
-                      name = "data";
-                      mountPath = "/data";
-                    }
-                    {
-                      name = "certs";
-                      mountPath = "/certs";
-                    }
-                    {
-                      name = "config";
-                      mountPath = "/etc/runner-config.yaml";
-                      subPath = "runner-config";
-                    }
-                  ];
-                };
-
-                daemon = {
-                  image = "docker:23.0.6-dind";
-                  securityContext.privileged = true;
-                  env.DOCKER_TLS_CERTDIR.value = "/certs";
-
-                  volumeMounts = [{
-                    name = "certs";
-                    mountPath = "/certs";
-                  }];
-                };
-              };
-
-              volumes = {
-                data.persistentVolumeClaim.claimName = "forgejo-runner-data";
-                certs.persistentVolumeClaim.claimName = "forgejo-runner-certs";
-                config.configMap.name = "forgejo-config";
-              };
-            };
-          };
-        };
-      };
     };
 
     services = {
@@ -195,34 +87,6 @@
         };
       };
     };
-
-    serviceAccounts.forgejo-runner = { };
-
-    clusterRoles.forgejo-runner.rules = [
-      {
-        apiGroups = [ "*" ];
-        resources = [ "*" ];
-        verbs = [ "*" ];
-      }
-      {
-        nonResourceURLs = [ "*" ];
-        verbs = [ "*" ];
-      }
-    ];
-
-    clusterRoleBindings.forgejo-runner = {
-      subjects = [{
-        kind = "ServiceAccount";
-        name = "forgejo-runner";
-        namespace = "default";
-      }];
-
-      roleRef = {
-        kind = "ClusterRole";
-        name = "forgejo-runner";
-        apiGroup = "rbac.authorization.k8s.io";
-      };
-    };
   };
 
   lab = {
diff --git a/kubenix-modules/forgejo/runner-config.nix b/kubenix-modules/forgejo/runner-config.nix
deleted file mode 100644
index decf9a4..0000000
--- a/kubenix-modules/forgejo/runner-config.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  log.level = "trace";
-  host.workdir_parent = "";
-
-  runner = {
-    file = "/data/.runner";
-    capacity = 4;
-    env_file = ".env";
-    timeout = "3h";
-    insecure = false;
-    fetch_timeout = "5s";
-    fetch_interval = "2s";
-    labels = [ ];
-    envs = { };
-  };
-
-  cache = {
-    enabled = true;
-    dir = "";
-    host = "";
-    port = 0;
-    external_server = "";
-  };
-
-  container = {
-    network = "";
-    privileged = false;
-    options = "";
-    workdir_parent = "";
-    valid_volumes = [ "**" ];
-    docker_host = "";
-    force_pull = false;
-  };
-}
diff --git a/kubenix-modules/volumes.nix b/kubenix-modules/volumes.nix
index e21b77e..7b447eb 100644
--- a/kubenix-modules/volumes.nix
+++ b/kubenix-modules/volumes.nix
@@ -5,19 +5,14 @@
 
   #     volumeMounts = [
   #       {
-  #         name = "pihole-data";
-  #         mountPath = "/pihole/data";
-  #       }
-  #       {
-  #         name = "pihole-dnsmasq";
-  #         mountPath = "/pihole/dnsmasq";
+  #         name = "forgejo";
+  #         mountPath = "/forgejo";
   #       }
   #     ];
   #   };
 
   #   volumes = {
-  #     pihole-data.persistentVolumeClaim.claimName = "pihole-data";
-  #     pihole-dnsmasq.persistentVolumeClaim.claimName = "pihole-dnsmasq";
+  #     forgejo.persistentVolumeClaim.claimName = "forgejo";
   #   };
   # };
 
@@ -30,6 +25,7 @@
       nextcloud.storage = "50Gi";
       pihole-data.storage = "750Mi";
       pihole-dnsmasq.storage = "16Mi";
+      forgejo.storage = "20Gi";
     };
 
     nfsVolumes = {
@@ -47,9 +43,6 @@
       kitchenowl.path = "kitchenowl/data";
       paperless-ngx-redisdata.path = "paperless-ngx/redisdata";
       paperless-ngx-data.path = "paperless-ngx/data";
-      forgejo.path = "forgejo/data";
-      forgejo-runner-data.path = "forgejo/runner/data";
-      forgejo-runner-certs.path = "forgejo/runner/certs";
     };
   };
 }
diff --git a/nixos-modules/data-sharing.nix b/nixos-modules/data-sharing.nix
index a57c4f3..6e013a1 100644
--- a/nixos-modules/data-sharing.nix
+++ b/nixos-modules/data-sharing.nix
@@ -3,13 +3,7 @@ let
   cfg = config.lab.data-sharing;
 
   nfsShares = [
-    "/nextcloud/data"
-    "/radicale"
-    "/pihole/data"
-    "/pihole/dnsmasq"
     "/forgejo/data"
-    "/forgejo/runner/data"
-    "/forgejo/runner/certs"
     "/kitchenowl/data"
     "/syncthing/config"
     "/paperless-ngx/data"
diff --git a/secrets/sops.yaml b/secrets/sops.yaml
index fdcbc2f..9f64afd 100644
--- a/secrets/sops.yaml
+++ b/secrets/sops.yaml
@@ -15,8 +15,6 @@ kitchenowl:
 forgejo:
     lfsJwtSecret: ENC[AES256_GCM,data:TZaptdiX/3HT2Q5lHqAOEQBkT3gV49dD6+RIludIcJVA6AevijgDonuVQA==,iv:hwU0K4JjFs8LaSNe5Dqmsj5Vz/w3sOWgSrnEW22bM/M=,tag:RJTDtYqRQdGVQ6PO2V+31g==,type:str]
     internalToken: ENC[AES256_GCM,data:28sIm0OW2G48ZECjCf5WM9/O5kbo54S96aD20MYfGrK0pbxgAwLjL8jXO/dNobSQ+26vet2WKfLbC9MPdBjhsQ5zC/keGHUFw6TPqnuhFchTLnP+JvMoqNZzcRo2kHi/EM93luG6xQvy,iv:Iy+1EVS7lvLust4MPkxyFonna/q1NVzRyMcTSJ3F5oM=,tag:v075jl/jtqcjSkEhRZVO2g==,type:str]
-    runnerToken: ENC[AES256_GCM,data:F6PsbkhT1epKfi9MpLpMqDosloVkhIiq/olBi/bbt8k88qxfw0vwvg==,iv:I/LH8V0Um+PCpjSrcjiZAN71nXcqv1m84wBUPLWT33Q=,tag:Y3qhbt7OqkRbHOCXRKLUeg==,type:str]
-    agePrivateKey: ENC[AES256_GCM,data:sEsVKpDd9VQKiaQNeLMqnA5304yf+4byCG2n4PIITM7c/HBRsdqpd4/BQEiYo8w95d41SjnFBay36KX+GWvJrx9vmCx7FPmv2kU=,iv:9jCW6ZL9nhcLZiGGmcylJKGh9erTOJdCTyWQXA1cgRY=,tag:ZgSeIcqDsvJipH+M1KGhMA==,type:str]
 atticd:
     jwtToken: ENC[AES256_GCM,data:DTiREnIdZxsewzLXeZgERBJKorUuqI71TgmUyKyc8iH6ioJLciU/9wfLiO+ltUA+3eEnuyuJHTpFwtLS0Wrjh5G4kYNkiX6Mw1bEJZnR+x2xJAJmfa4sJw==,iv:8jJfPosy02vezJOA0oKSphUItWqQ0Pr1cc8rBSuSawE=,tag:p+dZBP5+EYHjtTH9EkdYsw==,type:str]
     databaseURL: ENC[AES256_GCM,data:beyFNmbapw9asGHZN52taNx6klO3IQJ7wXbYTvo1NMaFyvo5qk2osocrwkeVv3w8bUWGgbQ/LKLuvg==,iv:qGFwhuLj0ApY9EpclM0x1nVBqXjv8XZC58cy6AE3AtQ=,tag:an+slq4Wlh7/sunX44yxOQ==,type:str]
@@ -44,8 +42,8 @@ sops:
             cHJRZWpDdWZlSnh3Qm1GZ28vZ0p0ZjAK7+BS6YQ2cUD21XCISBeNLSUNgNFQfSKI
             zL/AAqsVoBTrEs7s9fxmWmVm21/M3ZTYfU6Z6gIr6YEWe1pehRd6ZQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-05-01T21:17:22Z"
-    mac: ENC[AES256_GCM,data:Z854yGCEukya2IxAiNp/vmOpf+MqY6Pfvk2uhhH6UPoijvt7gU/AacmieKXNc+lErqh9mxwBoEoY/SwTYymqEsjm3vAWn9mrgvs6dfaTYuyFPg0ZrnV2pT5GiCLbmPhBKw/Fx53MLmB2CcYvYtJkoZk0+pSBOKpI+Mzr1tUOn98=,iv:3wZVY4KjXriFcpCAzjRZsVo/X7gi6WLVRzalKcA41Nk=,tag:evss+EvaaMpj3LyJCNOTZw==,type:str]
+    lastmodified: "2024-05-23T18:15:08Z"
+    mac: ENC[AES256_GCM,data:NUI//u2YJ5w3FyfFBaN7hzdeCKBzmoqMBQ60hhN5vLHf45QNgDtpVo7owaGOClSjaJWMwXHwvVsHWHgu4FlHh6ZPcevjNfZEW8E/kYiczcJTBOyvwuPz7hxSyIRmNC1ijChZgHgKF4ldxm/IscblSIMiLovmgpO5yQre1m89CLg=,iv:uJ22dS/jEKR3/kLbu9CgwgNgEn5YFyv/Kn8dxIwsvFg=,tag:LttLQ6yPD+/kpi7Zt5tZYQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1