From 06f5dab0657f0a51c8a220bdb2b6089ce68b2e96 Mon Sep 17 00:00:00 2001 From: Vincent Haupert Date: Wed, 28 Feb 2024 09:40:25 +0100 Subject: github-runners: adapt to NixOS module While #859 added basic support for configuring GitHub runners through nix-darwin, it did not yet support all of the options the NixOS module offers. I am aware that this is a rather big overhaul. I think, however, that it's worth it: - Copies the `options.nix` from the [NixOS module] with only minor adaptations. This should help to keep track of any changes to it. - Respect the `workDir` config option. So far, the implementation didn't even read the value of the option. - Allow configuring a custom user and group. If both are `null`, nix-darwin manages the `_github-runner` user shared among all instances. Take care of creating your own users if that's not what you want. - Also creates the necessary directories for state, logs and the working directory (unless `workDir != null`). It uses the following locations: * state: `/var/lib/github-runners/${name}` * logs: `/var/log/github-runners/${name}` * work: The value of `workDir` or `/var/run/github-runners/${name}` if (`workDir == null`). We have to create the logs directory before starting the service since launchd expects that the `Standard{Error,Out}Path` exist. We do this by prepending to [`system.activationScripts.launchd.text`]. All directories belong to the configured `user` and `group`. - Warn if a `tokenFile` points to the Nix store. [NixOS module]: https://github.com/NixOS/nixpkgs/blob/3c30c56/nixos/modules/services/continuous-integration/github-runner/options.nix [`system.activationScripts.launchd.text`]: https://github.com/LnL7/nix-darwin/blob/bbde06b/modules/system/launchd.nix#L99-L123 --- tests/services-github-runners.nix | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) (limited to 'tests') diff --git a/tests/services-github-runners.nix b/tests/services-github-runners.nix index fc57102..5578750 100644 --- a/tests/services-github-runners.nix +++ b/tests/services-github-runners.nix @@ -1,21 +1,18 @@ { config, pkgs, ... }: { - users = { - knownUsers = [ "github-runner" ]; - knownGroups = [ "github-runner" ]; - }; - services.github-runners."a-runner" = { enable = true; url = "https://github.com/nixos/nixpkgs"; - tokenFile = pkgs.writeText "fake-token" "not-a-token"; - package = pkgs.runCommand "github-runner-0.0.0" { } "touch $out"; + tokenFile = "/secret/path/to/a/github/token"; + # We need an overridable derivation but cannot use the actual github-runner package + # since it still relies on Node.js 16 which is marked as insecure. + package = pkgs.hello; }; test = '' echo >&2 "checking github-runner service in /Library/LaunchDaemons" grep "org.nixos.github-runner-a-runner" ${config.out}/Library/LaunchDaemons/org.nixos.github-runner-a-runner.plist - grep "github-runner" ${config.out}/Library/LaunchDaemons/org.nixos.github-runner-a-runner.plist + grep "_github-runner" ${config.out}/Library/LaunchDaemons/org.nixos.github-runner-a-runner.plist echo >&2 "checking for user in /activate" grep "GitHub Runner service user" ${config.out}/activate -- cgit v1.2.3