ci: run from hswaw forgejo on our own hosts

.ci.sh

@@ -2,17 +2,12 @@
 
 set -eou pipefail
 
-export NIX_CONFIG="use-xdg-base-directories = true"
+for hostOutput in $(nix eval --raw --impure --expr '
+    with import <nixpkgs> { };
+    (lib.mapAttrsToList (n: v: n)
+      (lib.attrsets.filterAttrs (n: v: v.pkgs.system == pkgs.system)
+        (builtins.getFlake(builtins.toString ./.)).outputs.nixosConfigurations))
+'); do
+    ~/.local/state/nix/profile/bin/nixos-rebuild build --flake ".#${hostOutput}"
+done
 
-nix profile install nixpkgs#nixos-rebuild
-
-~/.local/state/nix/profile/bin/nixos-rebuild build --flake ".#ciTest"
-
-# for hostOutput in $(nix eval --raw --impure --expr '
-#     with import <nixpkgs> { };
-#     (lib.mapAttrsToList (name: value: value)
-#         (builtins.getFlake(builtins.toString ./.)).outputs.nixosConfigurations)[0]'
-# ); do
-#     ~/.local/state/nix/profile/bin/nixos-rebuild build --flake ".#${hostOutput}"
-# done
-# 

.forgejo/workflows/ci.yml

@@ -0,0 +1,17 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  nixos-ci-x86_64:
+    runs-on: nixos-x86_64-linux
+    steps:
+      - run: ./.ci.sh
+
+  nixos-ci-aarch64:
+    runs-on: nixos-aarch64-linux
+    steps:
+      - run: ./.ci.sh

flake.nix

@@ -26,7 +26,8 @@
   outputs = { self, nixpkgs, nix-formatter-pack, nix-index-database, deploy-rs
     , agenix, lanzaboote, microvm, simple-nixos-mailserver, ... }:
     let
-      forAllSystems = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ];
+      systems = [ "x86_64-linux" "aarch64-linux" ];
+      forAllSystems = nixpkgs.lib.genAttrs systems;
       pkgsForDeploy =
         forAllSystems (system: import nixpkgs { inherit system; });
       deployPkgs = forAllSystems (system:
@@ -113,29 +114,57 @@
         nibylandia-gaming.imports = [ ./modules/gaming.nix ];
 
         nibylandia-monitoring.imports = [ ./modules/monitoring.nix ];
+
+        nibylandia-ci-runners.imports = [
+          ({ config, pkgs, lib, ... }:
+            let gitea-runner-directory = "/var/lib/gitea-runner";
+            in {
+              age.secrets.gitea-runner-token.file =
+                ./secrets/gitea-runner-token-${config.networking.hostName}.age;
+
+              services.gitea-actions-runner.package =
+                pkgs.forgejo-actions-runner;
+
+              services.gitea-actions-runner.instances.nix = {
+                enable = true;
+                name = config.networking.hostName;
+                tokenFile = config.age.secrets.gitea-runner-token.path;
+                labels = [ "nixos-${pkgs.system}:host" ];
+                url = "https://code.hackerspace.pl";
+                settings = {
+                  cache.enabled = true;
+                  host.workdir_parent =
+                    "${gitea-runner-directory}/action-cache-dir";
+                };
+
+                hostPackages = with pkgs; [
+                  bash
+                  coreutils
+                  curl
+                  gawk
+                  git-lfs
+                  nixFlakes
+                  gitFull
+                  gnused
+                  nodejs
+                  wget
+                ];
+              };
+
+              systemd.services.gitea-runner-nix.environment = {
+                XDG_CONFIG_HOME = gitea-runner-directory;
+                XDG_CACHE_HOME = "${gitea-runner-directory}/.cache";
+              };
+            })
+        ];
       };
 
       nixosConfigurations = with self.nixosModules; {
-        ciTest = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          modules = [
-            nibylandia-common
-
-            {
-              nibylandia-boot.uefi.enable = true;
-              fileSystems."/" = {
-                device = "none";
-                fsType = "tmpfs";
-                options = [ "defaults" "size=8G" "mode=755" ];
-              };
-            }
-          ];
-        };
-
         scylla = nixpkgs.lib.nixosSystem {
           system = "aarch64-linux";
           modules = [
             nibylandia-common
+            nibylandia-ci-runners
 
             ./nixos/scylla
           ];
@@ -191,6 +220,8 @@
             nibylandia-common
             nibylandia-secureboot
             nibylandia-monitoring
+            nibylandia-ci-runners
+
             simple-nixos-mailserver.nixosModule
 
             ./nixos/zorigami

secrets.nix

@@ -49,6 +49,8 @@ in {
   "secrets/mail/keycloakPlain.age".publicKeys = ar ++ [ zorigami ];
   "secrets/keycloakDatabase.age".publicKeys = ar ++ [ zorigami ];
   "secrets/synapseExtraConfig.age".publicKeys = ar ++ [ zorigami ];
+  "secrets/gitea-runner-token-zorigami.age".publicKeys = ar ++ [ zorigami ];
+  "secrets/gitea-runner-token-scylla.age".publicKeys = ar ++ [ scylla ];
 
   inherit ar;
 }

secrets/gitea-runner-token-zorigami.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 kY4Rgg 64ZlaAzkPr0IA+kPmCHBBRG1+SJ73oKceZqJhL7S0XU
+s6GkwLAF4pcMwrCzwezUsFE9sZXOjA4de98hzo89zPQ
+-> ssh-ed25519 grc4Uw Ux1FPbNpqAPX1ZzjiH2lfk2dbgxNqSHDdrgfF2d5UzM
+QEtTPUh004hN8lFyup4SF4kZQq7SIXPiUADnZzRABm8
+-> ssh-ed25519 DLT88w l2KIx4IatmC1ohQpZeDmxTLcN9deHpWAYwYXvrEmNSI
+VlgNMGD/TxBgs46R7+9qm7w693pMEgWS7FowNsPrWM4
+-> 9#t-grease bD(
+gk5EhdGziN68iLpJAg6drswXOIzdS7DO1Yw
+--- rdW0Pbvn/i6HdpOmdhqOCd0wate5lMBoZV9l0ag2Z2Q
+£!T9?§‡½>í	ÿXo\ª1&`­U¨Eí‡*î2]2ãÕ‚úÒ<C3BA>ßš±2<02>è°¼7R®Õ¬þ29ªZÖÈ€qØêBžt