lelgenio/nixos-config
1
0
Fork 0
Code Issues 1 Pull requests Projects 2 Releases Packages Wiki Activity Actions

monolith: enable nix cache over ssh

Browse source
This commit is contained in:
Leonardo Eugênio 2025-06-03 01:15:57 -03:00
parent 22dc422b63
commit 868496d2b9
No known key found for this signature in database
GPG key ID: 2F8F21CE8721456B
5 changed files with 138 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

136
system/gitlab-runner.nix
View file

@ -1,55 +1,95 @@
{ pkgs, lib, ... }:
let
installNixScript = pkgs.writeScriptBin "install-nix" ''
mkdir -p -m 0755 /nix/var/log/nix/drvs
mkdir -p -m 0755 /nix/var/nix/gcroots
mkdir -p -m 0755 /nix/var/nix/profiles
mkdir -p -m 0755 /nix/var/nix/temproots
mkdir -p -m 0755 /nix/var/nix/userpool
mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
mkdir -p -m 1777 /nix/var/nix/profiles/per-user
mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
mkdir -p -m 0700 "$HOME/.nix-defexpr"
installNixScript =
{
authenticationTokenConfigFile,
nixCacheSshPrivateKeyPath ? null,
...
}:
pkgs.writeScriptBin "install-nix" ''
mkdir -p -m 0755 /nix/var/log/nix/drvs
mkdir -p -m 0755 /nix/var/nix/gcroots
mkdir -p -m 0755 /nix/var/nix/profiles
mkdir -p -m 0755 /nix/var/nix/temproots
mkdir -p -m 0755 /nix/var/nix/userpool
mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
mkdir -p -m 1777 /nix/var/nix/profiles/per-user
mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
mkdir -p -m 0700 "$HOME/.nix-defexpr"
. ${pkgs.nix}/etc/profile.d/nix.sh
. ${pkgs.nix}/etc/profile.d/nix.sh
${pkgs.nix}/bin/nix-env -i ${
lib.concatStringsSep " " (
with pkgs;
[
nix
cacert
git
openssh
docker
]
)
}
'';
${pkgs.nix}/bin/nix-env -i ${
lib.concatStringsSep " " (
with pkgs;
[
nix
cacert
git
openssh
docker
]
)
}
${lib.optionalString (nixCacheSshPrivateKeyPath != null) ''
NIX_CACHE_SSH_PRIVATE_KEY_PATH="${nixCacheSshPrivateKeyPath}"
. ${./gitlab-runner/nix-cache-start}
''}
'';
pushStoreContents =
{
authenticationTokenConfigFile,
nixCacheSshPrivateKeyPath ? null,
...
}:
pkgs.writeScriptBin "push-to-cache" ''
${lib.optionalString (nixCacheSshPrivateKeyPath != null) ''
. ${./gitlab-runner/nix-cache-end}
''}
'';
in
{
mkNixRunner = authenticationTokenConfigFile: {
# File should contain at least these two variables:
# `CI_SERVER_URL`
# `REGISTRATION_TOKEN`
inherit authenticationTokenConfigFile; # 2
dockerImage = "alpine:3.18.2";
dockerVolumes = [
"/etc/nix/nix.conf:/etc/nix/nix.conf:ro"
"/nix/store:/nix/store:ro"
"/nix/var/nix/db:/nix/var/nix/db:ro"
"/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
"/tmp:/tmp"
"/var/run/docker.sock:/var/run/docker.sock"
"/var/lib/docker/containers:/var/lib/docker/containers"
];
dockerDisableCache = true;
preBuildScript = "\". ${lib.getExe installNixScript}\"";
environmentVariables = {
ENV = "/etc/profile";
USER = "root";
NIX_REMOTE = "daemon";
NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
rec {
mkNixRunnerFull =
{
authenticationTokenConfigFile,
nixCacheSshPrivateKeyPath ? null,
...
}@args:
{
# File should contain at least these two variables:
# `CI_SERVER_URL`
# `REGISTRATION_TOKEN`
inherit authenticationTokenConfigFile; # 2
dockerImage = "alpine:3.18.2";
dockerVolumes =
[
"/etc/nix/nix.conf:/etc/nix/nix.conf:ro"
"/nix/store:/nix/store:ro"
"/nix/var/nix/db:/nix/var/nix/db:ro"
"/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
"/tmp:/tmp"
"/var/run/docker.sock:/var/run/docker.sock"
"/var/lib/docker/containers:/var/lib/docker/containers"
]
++ lib.optionals (nixCacheSshPrivateKeyPath != null) [
"${nixCacheSshPrivateKeyPath}:${nixCacheSshPrivateKeyPath}"
];
dockerDisableCache = true;
preBuildScript = "\". ${lib.getExe (installNixScript args)}\"";
postBuildScript = "\". ${lib.getExe (pushStoreContents args)}\"";
environmentVariables = {
ENV = "/etc/profile";
USER = "root";
NIX_REMOTE = "daemon";
NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
};
};
mkNixRunner =
authenticationTokenConfigFile:
mkNixRunnerFull {
inherit authenticationTokenConfigFile;
};
};
}