imnyang
bbac123a8d
Some checks failed
CI / check (push) Has been cancelled
CI / ida (push) Has been cancelled
CI / cpt (push) Has been cancelled
CI / build-nixos (ena) (push) Has been cancelled
CI / build-nixos (hako) (push) Has been cancelled
CI / build-nixos (kazusa) (push) Has been cancelled
CI / build-nixos (mizuki) (push) Has been cancelled
67 lines
1.6 KiB
Nix
67 lines
1.6 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
runnerSecret = key: {
|
|
sopsFile = ../secrets/forgejo-runner.yaml;
|
|
inherit key;
|
|
owner = "root";
|
|
group = "root";
|
|
};
|
|
in
|
|
{
|
|
sops.secrets."forgejo-runner/token" = runnerSecret "forgejo-runner/token";
|
|
|
|
services.gitea-actions-runner = {
|
|
package = pkgs.forgejo-runner;
|
|
instances.my-forgejo-instance = {
|
|
enable = true;
|
|
name = "natsu-cicd";
|
|
tokenFile = config.sops.secrets."forgejo-runner/token".path;
|
|
url = "https://git.mizuki.guru/";
|
|
labels = [
|
|
"node-24:docker://node:24-bookworm"
|
|
"nixos-latest:docker://nixos/nix"
|
|
"native:host"
|
|
"AArch64:host"
|
|
"ubuntu-latest:docker://git.mizuki.guru/packages/act:ubuntu-latest-aarch64"
|
|
];
|
|
|
|
# act 엔진의 컨테이너 보안 가드 및 디렉토리 이탈 방지 설정 주입
|
|
settings = {
|
|
container = {
|
|
# 호스트 측의 임시 디렉토리 마운트 허용 범위를 명시
|
|
valid_volumes = [
|
|
"/var/run/docker.sock"
|
|
"/tmp"
|
|
"/run/user"
|
|
];
|
|
# 컨테이너 내 작업 디렉토리를 절대 경로로 고정하여 탈출 방지
|
|
workdir = "/workspace";
|
|
};
|
|
runner = {
|
|
# act 실행 환경 내부 임시 경로 강제 고정
|
|
envs = {
|
|
ACT_TEMP_DIR = "/tmp/act";
|
|
};
|
|
};
|
|
};
|
|
|
|
hostPackages = with pkgs; [
|
|
bash
|
|
git
|
|
python3
|
|
docker
|
|
docker-compose
|
|
docker-buildx
|
|
nodejs
|
|
bun
|
|
wget
|
|
curl
|
|
];
|
|
};
|
|
};
|
|
}
|