1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
{
config,
pkgs,
...
}: {
imports = [
./hardware-configuration.nix
];
sops.secrets."srht/networkKey" = {};
sops.secrets."srht/serviceKey" = {};
sops.secrets."srht/webhooksPrivateKey" = {};
sops.secrets."srht/builds/clientSecret" = {};
sops.secrets."srht/pgpPrivateKey" = {
group = "pgpkeys";
mode = "0440";
};
sops.secrets."srht/pgpPublicKey" = {
group = "pgpkeys";
mode = "0440";
};
users.groups.pgpkeys.members = [
"buildsrht"
];
services.sourcehut = {
enable = true;
redis.enable = true;
settings = {
"sr.ht" = {
owner-email = "jonni@liljamo.com";
owner-name = "Jonni Liljamo";
global-domain = "src.quest";
network-key = config.sops.secrets."srht/networkKey".path;
service-key = config.sops.secrets."srht/serviceKey".path;
};
mail = {
# FIXME: runners should not need this, but the module requires it,
# pls fix
error-from = "no-reply@src.quest";
error-to = "jonni@liljamo.com";
pgp-key-id = "F86655FF033B89F88E4F57C193C69331A06D888D";
pgp-privkey = config.sops.secrets."srht/pgpPrivateKey".path;
pgp-pubkey = config.sops.secrets."srht/pgpPrivateKey".path;
smtp-from = "no-reply@src.quest";
};
webhooks.private-key = config.sops.secrets."srht/webhooksPrivateKey".path;
"builds.sr.ht" = {
migrate-on-upgrade = false;
origin = "https://builds.src.quest";
connection-string = "postgresql://buildsrht@gostir:5432/builds.sr.ht?sslmode=disable";
oauth-client-id = "b239c860-1507-4398-bd56-969c2ac9a5d1";
oauth-client-secret = config.sops.secrets."srht/builds/clientSecret".path;
};
"builds.sr.ht::worker" = {
name = "sqbuilds";
timeout = "45m";
bind-address = "0.0.0.0:8080";
};
"meta.sr.ht".origin = "https://meta.src.quest";
};
builds = {
enable = true;
enableWorker = true;
images = let
pkgs_unstable = builtins.fetchGit {
url = "https://github.com/NixOS/nixpkgs";
# NOTE: last updated 29.8.2024
rev = "a6292e34000dc93d43bccf78338770c1c5ec8a99";
ref = "nixos-unstable";
};
image_from_nixpkgs = pkgs_unstable: (import "${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix" {
pkgs = import pkgs_unstable {system = "x86_64-linux";};
});
in {
nixos.unstable.x86_64 = image_from_nixpkgs pkgs_unstable;
};
};
};
system.stateVersion = "24.05";
}