From 621a994a0dbc89ce3a13599a2f27abea1dbbf6ec Mon Sep 17 00:00:00 2001 From: Ivan Malison Date: Wed, 24 Jun 2026 18:45:41 -0700 Subject: [PATCH] github-agent-runner: self-hosted GitHub runner for rocket-sense Add a `myModules.githubAgentRunner` module wrapping services.github-runners for the rlrml/rocket-sense repo, with an agenix-encrypted registration token (github-rocket-sense-runner-token.age) and a toolchain (cargo, claude-code, codex, gh, git-lfs, ...) available to jobs via extraPackages/labels. Enabled on railbird-sf. Co-Authored-By: Claude Opus 4.8 (1M context) --- nixos/configuration.nix | 1 + nixos/github-agent-runner.nix | 63 +++++++++++++++++++ nixos/machines/railbird-sf.nix | 1 + .../github-rocket-sense-runner-token.age | 58 +++++++++++++++++ nixos/secrets/secrets.nix | 1 + 5 files changed, 124 insertions(+) create mode 100644 nixos/github-agent-runner.nix create mode 100644 nixos/secrets/github-rocket-sense-runner-token.age diff --git a/nixos/configuration.nix b/nixos/configuration.nix index 9cd863fb..087ee40d 100644 --- a/nixos/configuration.nix +++ b/nixos/configuration.nix @@ -23,6 +23,7 @@ ./extra.nix ./games.nix ./git-sync.nix + ./github-agent-runner.nix ./gitea-runner.nix ./gitea.nix ./gnome.nix diff --git a/nixos/github-agent-runner.nix b/nixos/github-agent-runner.nix new file mode 100644 index 00000000..e64ef678 --- /dev/null +++ b/nixos/github-agent-runner.nix @@ -0,0 +1,63 @@ +{ + pkgs, + config, + makeEnable, + ... +}: +makeEnable config "myModules.githubAgentRunner" false { + age.secrets.github-rocket-sense-runner-token = { + file = ./secrets/github-rocket-sense-runner-token.age; + mode = "0400"; + }; + + services.github-runners.rocket-sense-agent = { + enable = true; + url = "https://github.com/rlrml/rocket-sense"; + name = "${config.networking.hostName}-rocket-sense-agent"; + tokenFile = config.age.secrets.github-rocket-sense-runner-token.path; + tokenType = "registration"; + replace = true; + ephemeral = false; + user = "imalison"; + extraLabels = [ + "rocket-sense-agent" + "nixos" + "codex" + "claude-code" + ]; + extraPackages = with pkgs; [ + bashInteractive + cargo + claude-code + codex + coreutils + curl + direnv + gh + git-lfs + gitFull + gnugrep + gnused + jq + just + nixVersions.stable + nodejs + openssh + pkg-config + ripgrep + rustc + zsh + ]; + extraEnvironment = { + CODEX_HOME = "/home/imalison/.codex"; + NIX_CONFIG = "experimental-features = nix-command flakes"; + }; + serviceOverrides = { + ProtectHome = false; + ProtectSystem = "full"; + PrivateTmp = false; + PrivateUsers = false; + RestrictNamespaces = false; + }; + }; +} diff --git a/nixos/machines/railbird-sf.nix b/nixos/machines/railbird-sf.nix index c082c920..eaeabad3 100644 --- a/nixos/machines/railbird-sf.nix +++ b/nixos/machines/railbird-sf.nix @@ -74,6 +74,7 @@ myModules.fonts.enable = true; myModules.plasma.enable = true; myModules.nvidia.enable = true; + myModules.githubAgentRunner.enable = true; myModules.gitea-runner.enable = true; myModules.railbird-k3s = { enable = true; diff --git a/nixos/secrets/github-rocket-sense-runner-token.age b/nixos/secrets/github-rocket-sense-runner-token.age new file mode 100644 index 00000000..458d725b --- /dev/null +++ b/nixos/secrets/github-rocket-sense-runner-token.age @@ -0,0 +1,58 @@ +age-encryption.org/v1 +-> ssh-ed25519 ZgrTqA WERjrEhQkZC1Wu2gSY7SoVDMZdTWJ2k9WQExDtA5riI +r4yivcKhZhQODeJkVVJuoLRvNjLPFfV+KNrZ7PYv47o +-> ssh-ed25519 ZaBdSg yQ1c0p0/eJU9waYihNDFFaBM8rbHXrSu0CFz8CAF9hE +bKdWQPYqSQR1cugbiOtGLuXhQSml1dQHc8YhtMp/JzY +-> ssh-ed25519 MHZylw yqQekgwLz5/1obj8vpc4HODwnykQf4kOVbHB6eMezVc +9scmCrQU79lSU2435ao/s786/vO5Y0W32wCiXEh6wNQ +-> ssh-ed25519 sIUg6g iWNPvErqIHHPLWf/R31tz0qF1qIHEoNeEqsyjjsQU1Q +GufkttH169CPbhsp03v362xNa/3AtBaFBq0teW2Tfm4 +-> ssh-ed25519 TnanwQ qorZCvMeVJxRlcxBw2in3JPRxNf3ZKtLJPf8kC8NnCM +nAUKlhy7hGBLTeGadh21CJ308s5PKlaT3a2+nX8axek +-> ssh-ed25519 cH4aug Z8vFonGcmfSuPx7u0+msXvm66k0xmf3wf3IDj7jvkw8 +vRxernJUERfgL2fhtmAtgiKBiCKrOD3MGpx4Xg9BCik +-> ssh-ed25519 ggrAFQ BG5WcUGH644XV00rRayimXACIny8UdxpXGtURfTRWxM +WGmlHmiiU4JPcwAjE6Y8y5WHZ6BFuToJxlbhnbbho5I +-> ssh-rsa gwJx0Q +ZjAWj6xZIY0/zIUWBEHsqRqxgeULBhF/v5ubzVNDLGdfju5qHDE3F0qatVFZRLq9 +LZGFfCjwPHsmvfcLtQ/MmH1Wsa2DfQbbnaiR1kEAoAFhCjC6f9kPK45wIiOQzVvz +s6rVpaC0DFMRk9vKh0ciS1JCSGd1bT5ZsrAVi5IbnuiiGxZAyObuiMtXJOQ0QOZD +04yX2WDmu+aFSBisO+OFjuKtYni8PYsUEOOSjI9NgT1nx7NgmPvI0axbsQmz0xoc +k7tbMDZuxGwWI4exoJivOqHpPIU8/iQjEdx2FRSHSajlO8AHY7JZFa1KHp/oTTaA +hxyljPOAScLzRvcTqU+TYw +-> ssh-ed25519 YFIoHA 1A1qyn9cnso0P1kOSLoCcpdWAJ3HfxRYooROhEPTNCE +h2gSpQvqQZfjPK/66iqGhSp0Klk/HE1o1oIuizu6u08 +-> ssh-ed25519 KQfiow iZGuI7/6XNlMtIRzfoWy0LPEMPDkfCV66GRM6ust70g +lvA3zITgsALb9Qm3Lrjb+Y/PDSXYW6zsXqoAr3lnNKg +-> ssh-ed25519 kScIxg 19WlRcl6IYl037WestDI9U2SGQoTYauzWj+vmBK1fXU +Fdw0dAzHF98AV5uDtViA4zLZZuOQeAKTUn/XXSfBsQ4 +-> ssh-ed25519 HzX1zw hGb+4dT1BFf20BrLCit4PMCyQdmxkm/Oy0IRLVZ1iQw +TAVcLePJHrMPydTt8nSViDv1T5NiyiCG9ABdeUDE2dw +-> ssh-ed25519 KQfiow EFnkacINh0/bWP0B5qVNqNnXYPUeFl6j8UuDAKyvD1U +2+UJuDTNfhgsPd1WKfSOrUgM2ScgC4au9v25GsJOtUY +-> ssh-ed25519 1o2X0w icmVK1ZtpLup7zHH4dED4ds0lVjOR1T00JdF1NjIcU4 +guLk1p5/YR0QltciMkIGsl0BqcPV1j2YR5gQ5HHlAY0 +-> ssh-ed25519 KQ5iUA Ijy9wIN4OzySvVA7YGiQAy3NExm5F8Z1dLRnAOie/jM +hZUzWH2Yeie0nspmdCKAqTzSSHCcANeMhfTCmBSsAkg +-> ssh-ed25519 AKGkDw qLesp11W4TAt+LeBHyLCsi2T1VXBEeWFfaBlj2qKsDM +Y/nQ+lf0D/Wzr+FGoKbScpUVa0xDqYBvIphW6APNEYs +-> ssh-ed25519 0eS5+A R6JNu3CztGJSgS0NUdfiF89x7C95BtJQ8vuVVmqR7UA +xzNr/3RsvEfKb2CweUPDzSBMMTpJ2T9JmUaS1MqI8t4 +-> ssh-ed25519 9/4Prw FOyELXDK4iobCr7/tb5HTFrc/bDFukCho/ULSIRqwSo +eplhJs8GFWPJBM8C4QgAlGUTUROPvFcf1MO0thxZhKY +-> ssh-ed25519 gAk3+Q No2SVzHVmaC+CgdAWFpjvUhsqvTtoTzMQyImh12IwHE +aro58KYwDOr06F1gJy9wG7GFYkNc9op8jcz+5Zb54Go +-> ssh-ed25519 X6eGtQ LWGGUoSCA3O9LCyu6Xzcpuo59mPRV8R8mC3hDWvroQw +q7yObsvilwcixL6HwCgMhdm2ua8cNsP6ok3niCdGXrw +-> ssh-ed25519 0ma8Cw TeF/FmOUSXJsH83pPmR9m5h4GEOj/n6WSmTMjJ9nvhg +Nq8T7jBkmwPrOdiX3VYT8JlmrxrHt1f8sQ9JXdib7Nc +-> ssh-ed25519 Tp0Z1Q FaRC6yfjNBMKtX5OpbmdCmsKBdk0E0UUVae9TGZD8Rs +gMB2rZDaeUFbulwhYX8NNJrIQwpZNL9k/FjsgsPNUB0 +-> ssh-ed25519 ePNWZQ fph2Vx6Bk0XW9L8ee5bt8NHrlW8iyl6p76IiPNk7IQc +aPq3APEZYyh3UvRzqlDD7bMiYKSrtpT/ufu/C/bSbS4 +-> ssh-ed25519 hILzzA X1C8BysK863h1F+P8vLeWU+3IX2Pblh/dwaU2aCkIjs +c7x0aMakpPNHYQtJcInrwNeyLQXWHjFPIX/qc5zJXeE +-> ssh-ed25519 qQi7yA ZAiSmB/bC3kE/RzI0GAqQ2AWeFIs2lfhCQrUGP2TaFU +M4Eq2l+WW68VABlT+gnNkwd0cYdW+rdqNUEXHcEomPE +--- WOcsddprP2N9bBhfjomyRoOezhOIwEk+0xWJokcRIpw +%A4=qfײ-*Qn=H.qo?WWԪ֊aQ^ZYs>IV \ No newline at end of file diff --git a/nixos/secrets/secrets.nix b/nixos/secrets/secrets.nix index 7d1c8566..9a72232e 100644 --- a/nixos/secrets/secrets.nix +++ b/nixos/secrets/secrets.nix @@ -11,6 +11,7 @@ in { "gitea-runner-token.jimi-hendnix.age".publicKeys = keys.agenixKeys; "gitea-runner-token.adele.age".publicKeys = keys.agenixKeys; "gitea-runner-token.railbird-sf.age".publicKeys = keys.agenixKeys ++ keys.railbird-sf; + "github-rocket-sense-runner-token.age".publicKeys = keys.agenixKeys ++ keys.railbird-sf; "gitea-runner-token.mac-demarco-mini.age".publicKeys = keys.agenixKeys ++ keys.railbird-sf; "gitea-runner-token.age".publicKeys = keys.agenixKeys ++ keys.railbird-sf; "nextcloud-admin.age".publicKeys = keys.agenixKeys;