satr14/nix-flake
1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

use ssh instead of sudo
Some checks failed
Activate NixOS Homelab Configuration On Push / deploy (push) Has been cancelled
Details

Browse source
This commit is contained in:
Satria 2026-03-14 11:25:23 +07:00
commit 6e8692e44e
4 changed files with 25 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

21
modules/system/homelab/git.nix
View file

@ -1,11 +1,4 @@
{ lib, pkgs, homelab, ... }: {
security.sudo.extraRules = [{ # for configuration activation on push to git
users = [ "gitea-runner" ];
commands = [{
command = "/run/current-system/sw/bin/nixos-rebuild";
options = [ "NOPASSWD" ];
}];
}];
services = {
forgejo = {
enable = true;
@ -51,17 +44,9 @@
name = "nixos-server-runner";
url = "https://git.proxy.${homelab.domain}";
tokenFile = "/root/forgejo-token-runner";
labels = [ "nixos-server" ];
hostPackages = with pkgs; [ bash coreutils git nix nodejs sudo ];
container.enable = false;
};
};
systemd.services."gitea-runner-nixos-deploy" = {
restartIfChanged = false;
serviceConfig = {
NoNewPrivileges = lib.mkForce false;
RestrictSUIDSGID = lib.mkForce false;
PrivateUsers = lib.mkForce false;
labels = [ "nixos-server:host" ];
hostPackages = with pkgs; [ bash coreutils git nix ];
};
};
systemd.services."gitea-runner-nixos-deploy".restartIfChanged = false;
}

2
modules/system/server.nix
View file

@ -29,6 +29,8 @@ in {
./base.nix
];
users.users.root.openssh.authorizedKeys.keys = homelab.ssh-keys;
services.tailscale = {
enable = true;
authKeyFile = "/mnt/data/tailscale/authkey";