platform/modules/gitea-runner.nix

{
  pkgs,
  lib,
  config,
  ...
}:
let
  cfg = config.features.gitea-runner;
  storeDeps = pkgs.runCommand "store-deps" { } ''
    mkdir -p $out/bin
    for dir in ${
      toString [
        pkgs.coreutils
        pkgs.findutils
        pkgs.gnugrep
        pkgs.skopeo
        pkgs.openssh
        pkgs.curl
        pkgs.gawk
        pkgs.git
        pkgs.lix
        pkgs.bash
        pkgs.jq
        pkgs.nodejs
      ]
    }; do
      for bin in "$dir"/bin/*; do
        ln -s "$bin" "$out/bin/$(basename "$bin")"
      done
    done

    # Add SSL CA certs
    mkdir -p $out/etc/ssl/certs
    cp -a "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" $out/etc/ssl/certs/ca-bundle.crt
  '';

  configuration = {
    systemd.services = {
      # everything here has no dependencies on the store
      gitea-runner-nix-image = {
        wantedBy = [ "multi-user.target" ];
        after = [ "podman.service" ];
        requires = [ "podman.service" ];
        path = [
          config.virtualisation.podman.package
          pkgs.gnutar
          pkgs.shadow
          pkgs.getent
        ];
        # we also include etc here because the cleanup job also wants the nixuser to be present
        script = ''
          set -eux -o pipefail
          mkdir -p etc/nix

          # Create an unpriveleged user that we can use also without the run-as-user.sh script
          touch etc/passwd etc/group
          groupid=$(cut -d: -f3 < <(getent group nixuser))
          userid=$(cut -d: -f3 < <(getent passwd nixuser))
          groupadd --prefix $(pwd) --gid "$groupid" nixuser
          emptypassword='$6$1ero.LwbisiU.h3D$GGmnmECbPotJoPQ5eoSTD6tTjKnSWZcjHoVTkxFLZP17W9hRi/XkmCiAMOfWruUwy8gMjINrBMNODc7cYEo4K.'
          useradd --prefix $(pwd) -p "$emptypassword" -m -d /tmp -u "$userid" -g "$groupid" -G nixuser nixuser

          cat <<NIX_CONFIG > etc/nix/nix.conf
          accept-flake-config = true
          experimental-features = nix-command flakes
          NIX_CONFIG

          # NOTE: For private registries
          # cp {config.age.secrets.nix-gitea-runner-netrc.path} etc/nix/netrc

          cat <<NSSWITCH > etc/nsswitch.conf
          passwd:    files mymachines systemd
          group:     files mymachines systemd
          shadow:    files

          hosts:     files mymachines dns myhostname
          networks:  files

          ethers:    files
          services:  files
          protocols: files
          rpc:       files
          NSSWITCH

          # list the content as it will be imported into the container
          tar -cv . | tar -tvf -
          tar -cv . | podman import - gitea-runner-nix
        '';
        serviceConfig = {
          RuntimeDirectory = "gitea-runner-nix-image";
          WorkingDirectory = "/run/gitea-runner-nix-image";
          Type = "oneshot";
          RemainAfterExit = true;
        };
      };

      gitea-runner-nix = {
        after = [ "gitea-runner-nix-image.service" ];
        requires = [ "gitea-runner-nix-image.service" ];

        # Prevents gitea runner deployments
        # from being restarted on a system switch,
        # thus breaking a deployment.
        # You'll have to restart the runner manually
        # or reboot the system after a deployment!
        # restartIfChanged = false;
        serviceConfig = {
          # LoadCredential = "TOKEN_FILE:/run/gitea/gitea-runner-token";
          # EnvironmentFile = [ "$CREDENTIALS_DIRECTORY/TOKEN_FILE" ];
          EnvironmentFile = [ "/run/gitea/gitea-runner-token" ];

          # Hardening (may overlap with DynamicUser=)
          # The following options are only for optimizing output of systemd-analyze
          AmbientCapabilities = "";
          CapabilityBoundingSet = "";
          # ProtectClock= adds DeviceAllow=char-rtc r
          DeviceAllow = "";
          NoNewPrivileges = true;
          PrivateDevices = true;
          PrivateMounts = true;
          PrivateTmp = true;
          PrivateUsers = true;
          ProtectClock = true;
          ProtectControlGroups = true;
          ProtectHome = true;
          ProtectHostname = true;
          ProtectKernelLogs = true;
          ProtectKernelModules = true;
          ProtectKernelTunables = true;
          ProtectSystem = "strict";
          RemoveIPC = true;
          RestrictNamespaces = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          UMask = "0066";
          ProtectProc = "invisible";
          SystemCallFilter = [
            "~@clock"
            "~@cpu-emulation"
            "~@module"
            "~@mount"
            "~@obsolete"
            "~@raw-io"
            "~@reboot"
            "~@swap"
            # needed by go?
            #"~@resources"
            "~@privileged"
            "~capset"
            "~setdomainname"
            "~sethostname"
          ];
          SupplementaryGroups = [ "podman" ];
          RestrictAddressFamilies = [
            "AF_INET"
            "AF_INET6"
            "AF_UNIX"
            "AF_NETLINK"
          ];

          # Needs network access
          PrivateNetwork = false;
          # Cannot be true due to Node
          MemoryDenyWriteExecute = false;

          # The more restrictive "pid" option makes `nix` commands in CI emit
          # "GC Warning: Couldn't read /proc/stat"
          # You may want to set this to "pid" if not using `nix` commands
          ProcSubset = "all";
          # Coverage programs for compiled code such as `cargo-tarpaulin` disable
          # ASLR (address space layout randomization) which requires the
          # `personality` syscall
          # You may want to set this to `true` if not using coverage tooling on
          # compiled code
          LockPersonality = false;

          # Note that this has some interactions with the User setting; so you may
          # want to consult the systemd docs if using both.
          DynamicUser = true;
        };
      };
    };

    users.users.nixuser = {
      group = "nixuser";
      description = "Used for running nix ci jobs";
      home = "/var/empty";
      isSystemUser = true;
    };
    users.groups.nixuser = { };

    services.gitea-actions-runner = {
      instances.nix = {
        enable = true;
        name = "nix";
        url = "https://git.oceanbox.io";
        # Obtaining the path to the runner token file may differ
        # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
        # tokenFile = config.age.secrets.gitea-runner-token.path;
        tokenFile = "";
        labels = [ "nix:docker://gitea-runner-nix" ];
        settings = {
          runner.capacity = 16;
          container.options = builtins.toString [
            "-e NIX_BUILD_SHELL=/bin/bash"
            "-e PAGER=cat"
            "-e PATH=/bin"
            "-e NIX_PATH=nixpkgs=${builtins.toString pkgs.path}"
            "-e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
            "-v /nix:/nix"
            "-v ${storeDeps}/bin:/bin"
            "-v ${storeDeps}/etc/ssl:/etc/ssl"
            "--user nixuser"
            "--device=/dev/kvm"
          ];

          # The default network that also respects our dns server settings
          container.network = "host";
          container.valid_volumes = [
            "/nix"
            "${storeDeps}/bin"
            "${storeDeps}/etc/ssl"
          ];
        };
      };
    };

  };
in
{
  options.features.gitea-runner = {
    enable = lib.mkEnableOption "Enable Gitea runner service";
  };

  config = lib.mkIf cfg.enable configuration;
}