modules(drone-exec-runner): init

This commit is contained in:
Raito Bezarius 2021-07-26 02:28:05 +02:00
parent a567fa82ff
commit fb954f2d77
2 changed files with 93 additions and 0 deletions

View file

@ -1,4 +1,5 @@
{ {
acme-dns = ./servers/acme-dns.nix; acme-dns = ./servers/acme-dns.nix;
drone-server = ./servers/drone.nix; drone-server = ./servers/drone.nix;
drone-exec-runner = ./servers/drone-exec-runner.nix;
} }

View file

@ -0,0 +1,92 @@
{ pkgs, lib, config, ... }:
with lib;
with types;
let
cfg = config.services.drone-exec-runner;
in
{
options.services.drone-exec-runner = {
enable = mkEnableOption "Enable an Drone CI/CD Exec Runner";
package = mkOption {
type = package;
default = pkgs.drone-runner-exec;
defaultText = "pkgs.drone-runner-exec";
};
env = mkOption {
type = listOf str;
description = "Environment strings (e.g. DRONE_RUNNER_CAPACITY, CLIENT_DRONE_RPC_HOST, etc.)";
example = [
"DRONE_RUNNER_CAPACITY=10"
"CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
];
};
envFile = mkOption {
type = str;
description = "Path to the environment file (may contains secrets, notably the shared RPC secret)";
};
user = mkOption {
type = str;
default = "drone-runner-exec";
};
group = mkOption {
type = str;
default = "drone-runner-exec";
};
allowedPackages = mkOption {
type = listOf package;
default = with pkgs; [
git
gnutar
bash
nixUnstable
gzip
];
};
};
config = mkIf cfg.enable {
systemd.services.drone-runner-exec = {
wantedBy = [ "multi-user.target" ];
confinement.enable = true;
confinement.packages = cfg.allowedPackages;
path = cfg.allowedPackages;
serviceConfig = {
Environment = [
"NIX_REMOTE=daemon"
"PAGER=cat"
] ++ cfg.env;
BindPaths = [
"/nix/var/nix/daemon-socket/socket"
"/run/nscd/socket"
"/var/lib/drone"
];
BindReadOnlyPaths = [
"/etc/passwd:/etc/passwd"
"/etc/group:/etc/group"
"/nix/var/nix/profiles/system/etc/nix:/etc/nix"
"${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
"${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
"/etc/machine-id"
"/nix/"
];
EnvironmentFile = [
cfg.envFile
];
ExecStart = "${cfg.package}/bin/drone-runner-exec";
User = cfg.user;
Group = cfg.group;
};
};
users.users.${cfg.user} = {
isSystemUser = true;
group = cfg.group;
};
users.groups.${cfg.group} = {};
};
}