ediblerope
dad207d19b
The gitea-actions-runner module loads tokenFile as a systemd EnvironmentFile, so it needs KEY=value lines, not a raw token. Comment updated to match — the runner failed to start the first time around because the file just contained the bare registration token. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
32 lines
1.2 KiB
Nix
32 lines
1.2 KiB
Nix
# services/forgejo-runner.nix — self-hosted Forgejo Actions runner.
|
|
#
|
|
# Registers with forg.gregersen.it and runs jobs in Docker containers.
|
|
# Workflows in this repo target `runs-on: fred-nix`, which maps to the
|
|
# catthehacker ubuntu image (the de-facto compatibility image for running
|
|
# GitHub-style workflows on self-hosted runners).
|
|
#
|
|
# The runner registration token is one-time-use: it must exist at the path
|
|
# below on first activation, after which the runner stores its own auth in
|
|
# /var/lib/gitea-runner. The module loads this file as a systemd
|
|
# EnvironmentFile, so it must use KEY=value format (not the raw token):
|
|
#
|
|
# echo 'TOKEN=YOUR_REGISTRATION_TOKEN' | sudo tee /var/secrets/forgejo-runner-token
|
|
# sudo chmod 600 /var/secrets/forgejo-runner-token
|
|
{ config, lib, pkgs, ... }:
|
|
{
|
|
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
|
|
|
|
services.gitea-actions-runner = {
|
|
package = pkgs.forgejo-runner;
|
|
instances.default = {
|
|
enable = true;
|
|
name = "mediaserver";
|
|
url = "https://forg.gregersen.it";
|
|
tokenFile = "/var/secrets/forgejo-runner-token";
|
|
labels = [
|
|
"fred-nix:docker://catthehacker/ubuntu:act-latest"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|