Improve gitlab config

system/gitlab-runner.nix

@@ -0,0 +1,40 @@
+{ pkgs, lib, ... }: {
+  mkNixRunner = registrationConfigFile: with lib; rec {
+    # File should contain at least these two variables:
+    # `CI_SERVER_URL`
+    # `REGISTRATION_TOKEN`
+    inherit registrationConfigFile; # 2
+    dockerImage = "alpine:3.18.2";
+    dockerAllowedImages = [ dockerImage ];
+    dockerVolumes = [
+      "/etc/nix/nix.conf:/etc/nix/nix.conf:ro"
+      "/nix/store:/nix/store:ro"
+      "/nix/var/nix/db:/nix/var/nix/db:ro"
+      "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+    ];
+    dockerDisableCache = true;
+    preBuildScript = pkgs.writeScript "setup-container" ''
+      mkdir -p -m 0755 /nix/var/log/nix/drvs
+      mkdir -p -m 0755 /nix/var/nix/gcroots
+      mkdir -p -m 0755 /nix/var/nix/profiles
+      mkdir -p -m 0755 /nix/var/nix/temproots
+      mkdir -p -m 0755 /nix/var/nix/userpool
+      mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+      mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+      mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+      mkdir -p -m 0700 "$HOME/.nix-defexpr"
+
+      . ${pkgs.nix}/etc/profile.d/nix.sh
+
+      ${pkgs.nix}/bin/nix-env -i ${concatStringsSep " " (with pkgs; [ nix cacert git openssh ])}
+    '';
+    environmentVariables = {
+      ENV = "/etc/profile";
+      USER = "root";
+      NIX_REMOTE = "daemon";
+      PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+      NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
+    };
+    tagList = [ "nix" ];
+  };
+}

system/monolith-gitlab-runner.nix

@@ -1,4 +1,8 @@
-{ config, pkgs, lib, ... }: {
+{ config, pkgs, lib, ... }:
+let
+  inherit (pkgs.callPackage ./gitlab-runner.nix { }) mkNixRunner;
+in
+{
   boot.kernel.sysctl."net.ipv4.ip_forward" = true;
   virtualisation.docker.enable = true;
   services.gitlab-runner = {
@@ -18,44 +22,8 @@
 
       # runner for building in docker via host's nix-daemon
       # nix store will be readable in runner, might be insecure
-      nix = with lib; rec {
+      thoreb-telemetria-nix = mkNixRunner config.age.secrets.gitlab-runner-thoreb-telemetria-registrationConfigFile.path;
-        # File should contain at least these two variables:
+      thoreb-itinerario-nix = mkNixRunner config.age.secrets.monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.path;
-        # `CI_SERVER_URL`
-        # `REGISTRATION_TOKEN`
-        registrationConfigFile = config.age.secrets.gitlab-runner-thoreb-telemetria-registrationConfigFile.path; # 2
-        dockerImage = "alpine:3.18.2";
-        dockerAllowedImages = [ dockerImage ];
-        dockerVolumes = [
-          "/etc/nix/nix.conf:/etc/nix/nix.conf:ro"
-          "/nix/store:/nix/store:ro"
-          "/nix/var/nix/db:/nix/var/nix/db:ro"
-          "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
-        ];
-        dockerDisableCache = true;
-        preBuildScript = pkgs.writeScript "setup-container" ''
-          mkdir -p -m 0755 /nix/var/log/nix/drvs
-          mkdir -p -m 0755 /nix/var/nix/gcroots
-          mkdir -p -m 0755 /nix/var/nix/profiles
-          mkdir -p -m 0755 /nix/var/nix/temproots
-          mkdir -p -m 0755 /nix/var/nix/userpool
-          mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
-          mkdir -p -m 1777 /nix/var/nix/profiles/per-user
-          mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
-          mkdir -p -m 0700 "$HOME/.nix-defexpr"
-
-          . ${pkgs.nix}/etc/profile.d/nix.sh
-
-          ${pkgs.nix}/bin/nix-env -i ${concatStringsSep " " (with pkgs; [ nix cacert git openssh ])}
-        '';
-        environmentVariables = {
-          ENV = "/etc/profile";
-          USER = "root";
-          NIX_REMOTE = "daemon";
-          PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
-          NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
-        };
-        tagList = [ "nix" ];
-      };
     };
   };
   systemd.services.gitlab-runner.serviceConfig.Nice = 10;

system/rainbow-gitlab-runner.nix

@@ -1,4 +1,8 @@
-{ config, pkgs, lib, ... }: {
+{ config, pkgs, lib, ... }:
+let
+  inherit (pkgs.callPackage ./gitlab-runner.nix { }) mkNixRunner;
+in
+{
   boot.kernel.sysctl."net.ipv4.ip_forward" = true;
   virtualisation.docker.enable = true;
   services.gitlab-runner = {
@@ -16,46 +20,8 @@
         dockerPrivileged = true;
       };
 
-      # runner for building in docker via host's nix-daemon
+      thoreb-telemetria-nix = mkNixRunner config.age.secrets.gitlab-runner-thoreb-telemetria-registrationConfigFile.path;
-      # nix store will be readable in runner, might be insecure
+      thoreb-itinerario-nix = mkNixRunner config.age.secrets.gitlab-runner-thoreb-itinerario-registrationConfigFile.path;
-      nix = with lib; rec {
-        # File should contain at least these two variables:
-        # `CI_SERVER_URL`
-        # `REGISTRATION_TOKEN`
-        registrationConfigFile = config.age.secrets.gitlab-runner-thoreb-telemetria-registrationConfigFile.path; # 2
-        dockerImage = "alpine:3.18.2";
-        dockerAllowedImages = [ dockerImage ];
-        dockerVolumes = [
-          "/etc/nix/nix.conf:/etc/nix/nix.conf:ro"
-          "/nix/store:/nix/store:ro"
-          "/nix/var/nix/db:/nix/var/nix/db:ro"
-          "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
-        ];
-        dockerDisableCache = true;
-        preBuildScript = pkgs.writeScript "setup-container" ''
-          mkdir -p -m 0755 /nix/var/log/nix/drvs
-          mkdir -p -m 0755 /nix/var/nix/gcroots
-          mkdir -p -m 0755 /nix/var/nix/profiles
-          mkdir -p -m 0755 /nix/var/nix/temproots
-          mkdir -p -m 0755 /nix/var/nix/userpool
-          mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
-          mkdir -p -m 1777 /nix/var/nix/profiles/per-user
-          mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
-          mkdir -p -m 0700 "$HOME/.nix-defexpr"
-
-          . ${pkgs.nix}/etc/profile.d/nix.sh
-
-          ${pkgs.nix}/bin/nix-env -i ${concatStringsSep " " (with pkgs; [ nix cacert git openssh ])}
-        '';
-        environmentVariables = {
-          ENV = "/etc/profile";
-          USER = "root";
-          NIX_REMOTE = "daemon";
-          PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
-          NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
-        };
-        tagList = [ "nix" ];
-      };
     };
   };
   systemd.services.gitlab-runner.serviceConfig.Nice = 10;