home/nixos-servers
home/nixos-servers
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

Remove forgejo runner

Browse source 
Migrate forgejo data to longhorn
This commit is contained in:
Pim Kunis 2024-05-23 21:07:32 +02:00
parent 1e79b3ed75
commit 1e894a8672
5 changed files with 6 additions and 191 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

136
kubenix-modules/forgejo/default.nix
View file

@ -1,11 +1,8 @@
{ lib, myLib, ... }: {
kubernetes.resources = {
secrets.runner-secret.stringData.token = "ref+sops://secrets/sops.yaml#/forgejo/runnerToken";
configMaps = {
forgejo-config.data = {
config = lib.generators.toINI { } (import ./config.nix);
runner-config = lib.generators.toYAML { } (import ./runner-config.nix);
};
forgejo-env.data = {
@ -64,111 +61,6 @@
};
};
};
# Forgejo-runner for docker in docker (dind) on Kubernetes:
# https://code.forgejo.org/forgejo/runner/src/branch/main/examples/kubernetes/dind-docker.yaml
forgejo-runner = {
metadata.labels = {
app = "forgejo";
component = "runner";
};
spec = {
selector.matchLabels = {
app = "forgejo";
component = "runner";
};
template = {
metadata.labels = {
app = "forgejo";
component = "runner";
};
spec = {
restartPolicy = "Always";
serviceAccountName = "forgejo-runner";
initContainers.runner-register = {
image = "code.forgejo.org/forgejo/runner:3.2.0";
command = [ "forgejo-runner" "register" "--no-interactive" "--token" "$(RUNNER_SECRET)" "--name" "$(RUNNER_NAME)" "--instance" "$(FORGEJO_INSTANCE_URL)" ];
env = {
RUNNER_NAME.value = "runner";
FORGEJO_INSTANCE_URL.value = "https://git.kun.is";
RUNNER_SECRET.valueFrom.secretKeyRef = {
name = "runner-secret";
key = "token";
};
};
resources.limits = {
cpu = "0.50";
memory = "64Mi";
};
volumeMounts = [
{
name = "data";
mountPath = "/data";
}
{
name = "config";
mountPath = "/etc/runner-config.yaml";
subPath = "runner-config";
}
];
};
containers = {
runner = {
image = "code.forgejo.org/forgejo/runner:3.0.0";
command = [ "sh" "-c" "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; forgejo-runner --config /etc/runner-config.yaml daemon" ];
env = {
DOCKER_HOST.value = "tcp://localhost:2376";
DOCKER_CERT_PATH.value = "/certs/client";
DOCKER_TLS_VERIFY.value = "1";
};
volumeMounts = [
{
name = "data";
mountPath = "/data";
}
{
name = "certs";
mountPath = "/certs";
}
{
name = "config";
mountPath = "/etc/runner-config.yaml";
subPath = "runner-config";
}
];
};
daemon = {
image = "docker:23.0.6-dind";
securityContext.privileged = true;
env.DOCKER_TLS_CERTDIR.value = "/certs";
volumeMounts = [{
name = "certs";
mountPath = "/certs";
}];
};
};
volumes = {
data.persistentVolumeClaim.claimName = "forgejo-runner-data";
certs.persistentVolumeClaim.claimName = "forgejo-runner-certs";
config.configMap.name = "forgejo-config";
};
};
};
};
};
};
services = {
@ -195,34 +87,6 @@
};
};
};
serviceAccounts.forgejo-runner = { };
clusterRoles.forgejo-runner.rules = [
{
apiGroups = [ "*" ];
resources = [ "*" ];
verbs = [ "*" ];
}
{
nonResourceURLs = [ "*" ];
verbs = [ "*" ];
}
];
clusterRoleBindings.forgejo-runner = {
subjects = [{
kind = "ServiceAccount";
name = "forgejo-runner";
namespace = "default";
}];
roleRef = {
kind = "ClusterRole";
name = "forgejo-runner";
apiGroup = "rbac.authorization.k8s.io";
};
};
};
lab = {

34
kubenix-modules/forgejo/runner-config.nix
View file

@ -1,34 +0,0 @@
{
log.level = "trace";
host.workdir_parent = "";
runner = {
file = "/data/.runner";
capacity = 4;
env_file = ".env";
timeout = "3h";
insecure = false;
fetch_timeout = "5s";
fetch_interval = "2s";
labels = [ ];
envs = { };
};
cache = {
enabled = true;
dir = "";
host = "";
port = 0;
external_server = "";
};
container = {
network = "";
privileged = false;
options = "";
workdir_parent = "";
valid_volumes = [ "**" ];
docker_host = "";
force_pull = false;
};
}

15
kubenix-modules/volumes.nix
View file

@ -5,19 +5,14 @@
# volumeMounts = [
# {
# name = "pihole-data";
# mountPath = "/pihole/data";
# }
# {
# name = "pihole-dnsmasq";
# mountPath = "/pihole/dnsmasq";
# name = "forgejo";
# mountPath = "/forgejo";
# }
# ];
# };
# volumes = {
# pihole-data.persistentVolumeClaim.claimName = "pihole-data";
# pihole-dnsmasq.persistentVolumeClaim.claimName = "pihole-dnsmasq";
# forgejo.persistentVolumeClaim.claimName = "forgejo";
# };
# };
@ -30,6 +25,7 @@
nextcloud.storage = "50Gi";
pihole-data.storage = "750Mi";
pihole-dnsmasq.storage = "16Mi";
forgejo.storage = "20Gi";
};
nfsVolumes = {
@ -47,9 +43,6 @@
kitchenowl.path = "kitchenowl/data";
paperless-ngx-redisdata.path = "paperless-ngx/redisdata";
paperless-ngx-data.path = "paperless-ngx/data";
forgejo.path = "forgejo/data";
forgejo-runner-data.path = "forgejo/runner/data";
forgejo-runner-certs.path = "forgejo/runner/certs";
};
};
}

6
nixos-modules/data-sharing.nix
View file

@ -3,13 +3,7 @@ let
cfg = config.lab.data-sharing;
nfsShares = [
"/nextcloud/data"
"/radicale"
"/pihole/data"
"/pihole/dnsmasq"
"/forgejo/data"
"/forgejo/runner/data"
"/forgejo/runner/certs"
"/kitchenowl/data"
"/syncthing/config"
"/paperless-ngx/data"

6
secrets/sops.yaml
View file

@ -15,8 +15,6 @@ kitchenowl:
forgejo:
lfsJwtSecret: ENC[AES256_GCM,data:TZaptdiX/3HT2Q5lHqAOEQBkT3gV49dD6+RIludIcJVA6AevijgDonuVQA==,iv:hwU0K4JjFs8LaSNe5Dqmsj5Vz/w3sOWgSrnEW22bM/M=,tag:RJTDtYqRQdGVQ6PO2V+31g==,type:str]
internalToken: ENC[AES256_GCM,data:28sIm0OW2G48ZECjCf5WM9/O5kbo54S96aD20MYfGrK0pbxgAwLjL8jXO/dNobSQ+26vet2WKfLbC9MPdBjhsQ5zC/keGHUFw6TPqnuhFchTLnP+JvMoqNZzcRo2kHi/EM93luG6xQvy,iv:Iy+1EVS7lvLust4MPkxyFonna/q1NVzRyMcTSJ3F5oM=,tag:v075jl/jtqcjSkEhRZVO2g==,type:str]
runnerToken: ENC[AES256_GCM,data:F6PsbkhT1epKfi9MpLpMqDosloVkhIiq/olBi/bbt8k88qxfw0vwvg==,iv:I/LH8V0Um+PCpjSrcjiZAN71nXcqv1m84wBUPLWT33Q=,tag:Y3qhbt7OqkRbHOCXRKLUeg==,type:str]
agePrivateKey: ENC[AES256_GCM,data:sEsVKpDd9VQKiaQNeLMqnA5304yf+4byCG2n4PIITM7c/HBRsdqpd4/BQEiYo8w95d41SjnFBay36KX+GWvJrx9vmCx7FPmv2kU=,iv:9jCW6ZL9nhcLZiGGmcylJKGh9erTOJdCTyWQXA1cgRY=,tag:ZgSeIcqDsvJipH+M1KGhMA==,type:str]
atticd:
jwtToken: ENC[AES256_GCM,data:DTiREnIdZxsewzLXeZgERBJKorUuqI71TgmUyKyc8iH6ioJLciU/9wfLiO+ltUA+3eEnuyuJHTpFwtLS0Wrjh5G4kYNkiX6Mw1bEJZnR+x2xJAJmfa4sJw==,iv:8jJfPosy02vezJOA0oKSphUItWqQ0Pr1cc8rBSuSawE=,tag:p+dZBP5+EYHjtTH9EkdYsw==,type:str]
databaseURL: ENC[AES256_GCM,data:beyFNmbapw9asGHZN52taNx6klO3IQJ7wXbYTvo1NMaFyvo5qk2osocrwkeVv3w8bUWGgbQ/LKLuvg==,iv:qGFwhuLj0ApY9EpclM0x1nVBqXjv8XZC58cy6AE3AtQ=,tag:an+slq4Wlh7/sunX44yxOQ==,type:str]
@ -44,8 +42,8 @@ sops:
cHJRZWpDdWZlSnh3Qm1GZ28vZ0p0ZjAK7+BS6YQ2cUD21XCISBeNLSUNgNFQfSKI
zL/AAqsVoBTrEs7s9fxmWmVm21/M3ZTYfU6Z6gIr6YEWe1pehRd6ZQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-05-01T21:17:22Z"
mac: ENC[AES256_GCM,data:Z854yGCEukya2IxAiNp/vmOpf+MqY6Pfvk2uhhH6UPoijvt7gU/AacmieKXNc+lErqh9mxwBoEoY/SwTYymqEsjm3vAWn9mrgvs6dfaTYuyFPg0ZrnV2pT5GiCLbmPhBKw/Fx53MLmB2CcYvYtJkoZk0+pSBOKpI+Mzr1tUOn98=,iv:3wZVY4KjXriFcpCAzjRZsVo/X7gi6WLVRzalKcA41Nk=,tag:evss+EvaaMpj3LyJCNOTZw==,type:str]
lastmodified: "2024-05-23T18:15:08Z"
mac: ENC[AES256_GCM,data:NUI//u2YJ5w3FyfFBaN7hzdeCKBzmoqMBQ60hhN5vLHf45QNgDtpVo7owaGOClSjaJWMwXHwvVsHWHgu4FlHh6ZPcevjNfZEW8E/kYiczcJTBOyvwuPz7hxSyIRmNC1ijChZgHgKF4ldxm/IscblSIMiLovmgpO5yQre1m89CLg=,iv:uJ22dS/jEKR3/kLbu9CgwgNgEn5YFyv/Kn8dxIwsvFg=,tag:LttLQ6yPD+/kpi7Zt5tZYQ==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1