nixos/configurations/{metis,adrastea}: gitea service init

nixos/configurations/adrastea/default.nix

@@ -30,6 +30,7 @@
     ./wireguard.nix
     ./nvidia.nix
     ./game.nix
+    ./gitea.nix
   ];
 
   boot.binfmt.emulatedSystems = [

nixos/configurations/adrastea/gitea.nix

@@ -0,0 +1,61 @@
+{ config, pkgs, ... }:
+let
+  domain = "git.inclyc.cn";
+  url = "https://${domain}";
+in
+{
+
+  sops.secrets = {
+    "gitea/runners/fuse-feature" = { };
+  };
+
+  services.gitea-actions-runner.instances = {
+    "fuse-feature/gpu" = {
+      inherit url;
+      name = "fuse-feature/gpu";
+      enable = true;
+      tokenFile = config.sops.secrets."gitea/runners/fuse-feature".path;
+      labels = [
+        "adrastea-gpu:host"
+      ];
+      hostPackages = with pkgs; [
+        ninja
+        bash
+        coreutils
+        curl
+        gawk
+        gitMinimal
+        gnused
+        nodejs
+        wget
+        cmake
+        python3
+
+        (texlive.combine { inherit (texlive) scheme-full; })
+
+        poetry
+
+        gnutar
+        zstd
+
+        (buildFHSEnv {
+          name = "many-linux-fhs";
+          targetPkgs =
+            pkgs:
+            (with pkgs; [
+              stdenv.cc
+              perl
+              python3
+              glib
+              zlib
+              git
+              openssh
+              cudatoolkit
+              config.boot.kernelPackages.nvidia_x11
+            ]);
+          runScript = lib.getExe python3;
+        })
+      ];
+    };
+  };
+}

nixos/configurations/metis/default.nix

@@ -1,6 +1,11 @@
-{ pkgs, inputs, ... }:
+{
+  pkgs,
+  inputs,
+  ...
+}:
 {
   imports = [
+    ./gitea.nix
     ./wireguard.nix
     ./hardware-configuration.nix
     ./rathole.nix

nixos/configurations/metis/gitea.nix

@@ -0,0 +1,100 @@
+{ config, pkgs, ... }:
+let
+  domain = "git.inclyc.cn";
+  url = "https://${domain}";
+in
+{
+  sops.secrets = {
+    "gitea/runners/simd" = { };
+    "gitea/runners/fuse-feature" = { };
+  };
+
+  services = {
+    gitea-actions-runner.instances = {
+      "simd" = {
+        inherit url;
+        enable = true;
+        name = "simd";
+        tokenFile = config.sops.secrets."gitea/runners/simd".path;
+        labels = [
+          "native:host"
+        ];
+        hostPackages = with pkgs; [
+          ninja
+          gcc8
+          bash
+          coreutils
+          diffutils
+          curl
+          gawk
+          gitMinimal
+          gnused
+          nodejs
+          wget
+          cmake
+          python3
+        ];
+      };
+      "fuse-feature" = {
+        inherit url;
+        enable = true;
+        name = "fuse-feature";
+        tokenFile = config.sops.secrets."gitea/runners/fuse-feature".path;
+        labels = [
+          "native:host"
+        ];
+        hostPackages = with pkgs; [
+          coreutils
+          curl
+          gnused
+          nodejs
+          wget
+          cmake
+
+          gitMinimal
+
+          # Python environment
+          python3
+          poetry
+
+          (buildFHSEnv {
+            name = "many-linux-fhs";
+            targetPkgs =
+              pkgs:
+              (with pkgs; [
+                stdenv.cc
+                perl
+                python3
+                glib
+                zlib
+                git
+                openssh
+              ]);
+            runScript = lib.getExe python3;
+          })
+        ];
+      };
+    };
+    caddy = {
+      enable = true;
+      virtualHosts = {
+        "git.inclyc.cn" = {
+          extraConfig = "
+          reverse_proxy unix/${config.services.gitea.settings.server.HTTP_ADDR}
+        ";
+        };
+      };
+    };
+    gitea = {
+      enable = true;
+      settings = {
+        server = {
+          PROTOCOL = "http+unix";
+          DOMAIN = domain;
+          ROOT_URL = url;
+          SSH_PORT = 20122;
+        };
+      };
+    };
+  };
+}

secrets/general.yaml

@@ -17,6 +17,10 @@ wireguard:
 rathole-ssh-token: ENC[AES256_GCM,data:np5KdM2RSxFHP1aDAayUtmdHZgk=,iv:sJ8ssx/B0G0Qd2htudDv0JO+OQ+R8G9X9XJd9VLhLhk=,tag:F6TSl9kKewe7uWVwXMr1sw==,type:str]
 rathole-hitmc-token: ENC[AES256_GCM,data:ZtR6esl5QW8tLvgT51AHaoP/0og=,iv:pJoJS6qgY/1CHXpBSE1Hc4r+6Imd42BjQqbUPoX7AtY=,tag:P+1FY4gDQQVVMQMVVEzaEQ==,type:str]
 rathole-private-key: ENC[AES256_GCM,data:jCPL98APg1t5DzV8Xv9yRf+frtfpScxcNgFI/Obd6JtQetuGRLsYqrRJ6Yg=,iv:mNd4bC2udaXysryFPTwF9j+0v15YPupbKmEK9jFu4Cg=,tag:RU4Qo0iOQW5LTC1bEx+Ykw==,type:str]
+gitea:
+    runners:
+        simd: ENC[AES256_GCM,data:qicPRCb6kw4a62H99XYS/vZUx/oc0hERtXm8iOHxs3LWEL8PQ8ZWvOoXxYON1BE=,iv:UyIJvLkwSUYuuKEbolAClV/FfFnCKTexEYH0wkJrqLk=,tag:PNECKkvc+LkOugxau1wkMA==,type:str]
+        fuse-feature: ENC[AES256_GCM,data:pOulePuS9AbEcl3EM6LSOzvWmpVxKs3YcMsfofdlYOI1GOSE/oIjI1gpvssA59U=,iv:BmWCKURIfQSXJ5ryBzfIOeIISlrF43Nir9wOgzZjMGs=,tag:O2Wc/c/DtXvzOfG/TF/6UQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -59,8 +63,8 @@ sops:
             ZDg0T2hqR2tROVI1T1BLeFNnaGVYY1EKOnOp5ZPo48XIB7d9PnG2sKvsoLX32XEm
             Pqf4UTOmT47SSKsvu5xgxPXJrhBySkspn97gtpl9bYG4n8HYCSw+hg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-07T06:30:24Z"
-    mac: ENC[AES256_GCM,data:ZuUXYdBICd5z8DnBVjPNhET5hBVrFhL0ZehJ9RQMBbutl31VqY1DoO47+88cndc/2Loc4525DbNls/myz2Ss8A+NsTpFlSztrV/IQNyDjTtiPT7eqUJuebT+3TTD8fvG0fUv3ucIzaJSwKsgBDEmKIpO7Ubtdn4i6TU8uuC+yzk=,iv:rwYr3jqGYfJ7ms3DSzMwoTLr11MbCWiHWq6xnabBvUs=,tag:ozQPBOe12QI/8Y3/AMFcNQ==,type:str]
+    lastmodified: "2024-11-06T14:42:41Z"
+    mac: ENC[AES256_GCM,data:yP12RQWSBqT2zMGsy6xDLzenna2rrSEXdpZbyqN71q16bHzlobr22K3JTsw1zVmuklQC5X7x0srC+3ira6WIRrmi7R+O5hYlhXjnX1qVgRVNwGZkaf3j8pha6TUh34g8IrBHSlrLApWAIRDk3vjQvEEEKlyfK1DV7X7eO2p9eoY=,iv:X/sfI+05AtlTWHvFGBD+1RdlgLIKpM6c0bOlCU90raM=,tag:l71uJ1RTk21wlFwGBl3+CA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.9.1