forked from CCCHH/nix-infra
June
f5432bd682
With the shared system token, every time the Woodpecker host would restart, a new Woodpecker agent registration would be created, because the agent receives a unique ID on first connection using the system token, which it couldn't store however, because it doesn't have a writable config file in NixOS. Use an agent token now, which doesn't require the agent to store a unique ID in a wrtiable config, therefore not making it re-register. Also see: https://woodpecker-ci.org/docs/administration/agent-config#agent-registration
32 lines
1.1 KiB
Nix
32 lines
1.1 KiB
Nix
# Sources for this configuration:
|
|
# - https://woodpecker-ci.org/docs/administration/deployment/nixos
|
|
# - https://woodpecker-ci.org/docs/administration/agent-config
|
|
# - https://woodpecker-ci.org/docs/administration/backends/docker
|
|
|
|
{ config, pkgs, pkgs-unstable, ... }:
|
|
|
|
{
|
|
services.woodpecker-agents.agents."podman" = {
|
|
enable = true;
|
|
# Since we use woodpecker-server from unstable, use the agent from unstable as well.
|
|
package = pkgs-unstable.woodpecker-agent;
|
|
extraGroups = [ "podman" ];
|
|
environment = {
|
|
WOODPECKER_SERVER = "localhost${config.services.woodpecker-server.environment.WOODPECKER_GRPC_ADDR}";
|
|
WOODPECKER_MAX_WORKFLOWS = "4";
|
|
WOODPECKER_BACKEND = "docker";
|
|
DOCKER_HOST = "unix:///run/podman/podman.sock";
|
|
# Set via enviornmentFile:
|
|
# WOODPECKER_AGENT_SECRET
|
|
};
|
|
environmentFile = [ "/run/secrets/woodpecker_agent_environment_file" ];
|
|
};
|
|
|
|
sops.secrets."woodpecker_agent_environment_file" = {
|
|
mode = "0440";
|
|
owner = "root";
|
|
group = "root";
|
|
restartUnits = [ "woodpecker-agent-podman.service" ];
|
|
};
|
|
}
|