modules(drone-exec-runner): init

modules/default.nix

@@ -1,4 +1,5 @@
 {
   acme-dns = ./servers/acme-dns.nix;
   drone-server = ./servers/drone.nix;
+  drone-exec-runner = ./servers/drone-exec-runner.nix;
 }

modules/servers/drone-exec-runner.nix

@@ -0,0 +1,92 @@
+{ pkgs, lib, config, ... }:
+with lib;
+with types;
+let
+  cfg = config.services.drone-exec-runner;
+in
+  {
+    options.services.drone-exec-runner = {
+      enable = mkEnableOption "Enable an Drone CI/CD Exec Runner";
+      package = mkOption {
+        type = package;
+        default = pkgs.drone-runner-exec;
+        defaultText = "pkgs.drone-runner-exec";
+      };
+      env = mkOption {
+        type = listOf str;
+        description = "Environment strings (e.g. DRONE_RUNNER_CAPACITY, CLIENT_DRONE_RPC_HOST, etc.)";
+        example = [
+          "DRONE_RUNNER_CAPACITY=10"
+          "CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
+        ];
+      };
+      envFile = mkOption {
+        type = str;
+        description = "Path to the environment file (may contains secrets, notably the shared RPC secret)";
+      };
+      user = mkOption {
+        type = str;
+        default = "drone-runner-exec";
+      };
+      group = mkOption {
+        type = str;
+        default = "drone-runner-exec";
+      };
+      allowedPackages = mkOption {
+        type = listOf package;
+        default = with pkgs; [
+          git
+          gnutar
+          bash
+          nixUnstable
+          gzip
+        ];
+      };
+    };
+    config = mkIf cfg.enable {
+      systemd.services.drone-runner-exec = {
+        wantedBy = [ "multi-user.target" ];
+
+        confinement.enable = true;
+        confinement.packages = cfg.allowedPackages;
+        path = cfg.allowedPackages;
+
+        serviceConfig = {
+          Environment = [
+            "NIX_REMOTE=daemon"
+            "PAGER=cat"
+          ] ++ cfg.env;
+
+          BindPaths = [
+            "/nix/var/nix/daemon-socket/socket"
+            "/run/nscd/socket"
+            "/var/lib/drone"
+          ];
+
+          BindReadOnlyPaths = [
+            "/etc/passwd:/etc/passwd"
+            "/etc/group:/etc/group"
+            "/nix/var/nix/profiles/system/etc/nix:/etc/nix"
+            "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
+            "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
+            "/etc/machine-id"
+            "/nix/"
+          ];
+
+          EnvironmentFile = [
+            cfg.envFile
+          ];
+          
+          ExecStart = "${cfg.package}/bin/drone-runner-exec";
+          User = cfg.user;
+          Group = cfg.group;
+        };
+      };
+
+      users.users.${cfg.user} = {
+        isSystemUser = true;
+        group = cfg.group;
+      };
+      users.groups.${cfg.group} = {};
+    };
+  }