♻️ consolidate nix configs

nix/modules/drone/default.nix

@@ -0,0 +1,46 @@
+{ pkgs, config, ... }: {
+  sops.secrets.drone = {
+    owner = "drone";
+  };
+
+  services = {
+    postgresql = {
+      ensureDatabases = [ "drone" ];
+      ensureUsers = [
+        {
+          name = "drone";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+    postgresqlBackup.databases = [ "drone" ];
+  };
+
+  systemd.services.drone = {
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      EnvironmentFile = [
+        config.sops.secrets.drone.path
+      ];
+      Environment = [
+        "DRONE_GITEA_SERVER=https://walkah.dev"
+        "DRONE_DATABASE_DATASOURCE=postgres:///drone?host=/run/postgresql"
+        "DRONE_DATABASE_DRIVER=postgres"
+        "DRONE_SERVER_HOST=https://drone.walkah.dev"
+        "DRONE_SERVER_PORT=:3030"
+        "DRONE_SERVER_PROTO=https"
+        "DRONE_USER_CREATE=username:walkah,admin:true"
+      ];
+      ExecStart = "${pkgs.drone}/bin/drone-server";
+      User = "drone";
+      Group = "drone";
+    };
+  };
+
+  users.users.drone = {
+    isSystemUser = true;
+    createHome = true;
+    group = "drone";
+  };
+  users.groups.drone = { };
+}

nix/modules/drone/nginx.nix

@@ -0,0 +1,17 @@
+_:
+
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "drone.walkah.dev" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.111.208.75:3030";
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+}

nix/modules/drone/runner-docker.nix

@@ -0,0 +1,22 @@
+{ pkgs, config, ... }: {
+  systemd.services.drone-runner-docker = {
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Environment = [
+      ];
+      EnvironmentFile = [
+        config.sops.secrets.drone.path
+      ];
+      ExecStart = "${pkgs.drone-runner-docker}/bin/drone-runner-docker";
+      User = "drone-runner-docker";
+      Group = "drone-runner-docker";
+    };
+  };
+
+  users.users.drone-runner-docker = {
+    isSystemUser = true;
+    group = "drone-runner-docker";
+    extraGroups = [ "docker" ];
+  };
+  users.groups.drone-runner-docker = { };
+}

nix/modules/drone/runner-exec.nix

@@ -0,0 +1,65 @@
+{ pkgs, config, ... }:
+{
+  nix.settings.allowed-users = [ "drone-runner-exec" ];
+  systemd.services.drone-runner-exec = {
+    wantedBy = [ "multi-user.target" ];
+    # might break deployment
+    restartIfChanged = false;
+    confinement.enable = true;
+    confinement.packages = [
+      pkgs.git
+      pkgs.gnutar
+      pkgs.bash
+      pkgs.nix
+      pkgs.gzip
+    ];
+    path = [
+      pkgs.git
+      pkgs.gnutar
+      pkgs.bash
+      pkgs.nix
+      pkgs.gzip
+    ];
+    serviceConfig = {
+      Environment = [
+        "DRONE_RUNNER_CAPACITY=10"
+        "CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
+        "NIX_REMOTE=daemon"
+        "PAGER=cat"
+      ];
+      BindPaths = [
+        "/nix/var/nix/daemon-socket/socket"
+        "/run/nscd/socket"
+        "/var/lib/drone"
+      ];
+      BindReadOnlyPaths = [
+        "/etc/passwd:/etc/passwd"
+        "/etc/group:/etc/group"
+        "/nix/var/nix/profiles/system/etc/nix:/etc/nix"
+        "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
+        "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
+        "${
+          builtins.toFile "ssh_config" ''
+            Host eve.thalheim.io
+              ForwardAgent yes
+          ''
+        }:/etc/ssh/ssh_config"
+        "/etc/machine-id"
+        # channels are dynamic paths in the nix store, therefore we need to bind mount the whole thing
+        "/nix/"
+      ];
+      EnvironmentFile = [
+        config.sops.secrets.drone.path
+      ];
+      ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec";
+      User = "drone-runner-exec";
+      Group = "drone-runner-exec";
+    };
+  };
+
+  users.users.drone-runner-exec = {
+    isSystemUser = true;
+    group = "drone-runner-exec";
+  };
+  users.groups.drone-runner-exec = { };
+}