dec

nixos/consensus/hypervisor/configuration.nix

@@ -0,0 +1,43 @@
+{ name, attrs, ... }:
+{
+  systemd.network = {
+    enable = true;
+    networks."20-lan" = {
+      matchConfig.Type = "ether";
+      networkConfig = {
+        Address = [ (attrs.${name}.ipv4 + attrs.${name}.subnet) ];
+        Gateway = "10.0.0.1";
+        DNS = [ "1.1.1.1" ];
+        IPv6AcceptRA = true;
+        DHCP = "no";
+      };
+    };
+  };
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+    settings.KbdInteractiveAuthentication = false;
+  };
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 ];
+    allowedUDPPorts = [ ];
+    logRefusedConnections = true;
+  };
+  users.users = {
+    root = {
+      openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTJm2iu/5xacOoh4/JAvMtHE62duDlVVXpvVP+uQMR root@htz''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU2TUxKyGKoZ68IG4hw23RmxVf72u5K9W0StkgTr0b2 e@t14''
+      ];
+    };
+    e = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTJm2iu/5xacOoh4/JAvMtHE62duDlVVXpvVP+uQMR root@htz''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU2TUxKyGKoZ68IG4hw23RmxVf72u5K9W0StkgTr0b2 e@t14''
+      ];
+    };
+  };
+}

nixos/consensus/hypervisor/default.nix

@@ -0,0 +1,37 @@
+{ lib, pkgs, ... }:
+let
+  attrs = {
+    forgejo-runner = {
+      ipv4 = "10.0.0.2";
+      subnet = "/24";
+      mac = "02:00:00:00:00:01";
+    };
+  };
+  genVMConfig = name: addr: {
+    restartIfChanged = true;
+    pkgs = pkgs;
+    config = {
+      microvm = {
+        shares = lib.mkIf (addr.ro-store == true) [
+          {
+            source = "/nix/store";
+            mountPoint = "/nix/.ro-store";
+            tag = "ro-store";
+            proto = "virtiofs";
+          }
+        ];
+        interfaces = [
+          {
+            type = "tap";
+            id = name;
+            mac = attrs.${name}.mac;
+          }
+        ];
+      };
+    }
+    // import ./configuration.nix { inherit name attrs; };
+  };
+in
+{
+  microvm.vms = lib.mapAttrs genVMConfig attrs;
+}

nixos/consensus/hypervisor/forgejo-runner.nix

@@ -0,0 +1,35 @@
+{
+  inputs,
+  pkgs,
+  ...
+}:
+{
+  pkgs = pkgs;
+  config =
+    { config, ... }:
+    {
+      imports = [
+        inputs.sops-nix.nixosModules.sops
+      ];
+      sops = {
+        secrets = {
+          forgejo-runner = {
+            sopsFile = ../../secrets/forgejo-runner.yaml;
+          };
+        };
+      };
+      services.gitea-actions-runner = {
+        package = pkgs.forgejo-actions-runner;
+        instances.default = {
+          enable = true;
+          name = "runner-1";
+          url = "https://git.10110110.xyz";
+          tokenFile = config.sops.secrets.forgejo-runner.path;
+          labels = [
+            "ubuntu-latest:docker://node:20-bullseye"
+            "nix-upstream-latest:docker://nixos/nix:latest"
+          ];
+        };
+      };
+    };
+}