From cd116db45e8e31e01f9c20d4fbb7785febed74d8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 18 Mar 2023 17:05:05 +0000
Subject: [PATCH] nixos/woodpecker-agents: bind network files

Otherwise the agent might experience trouble with DNS resolution [1].

[1]: https://github.com/woodpecker-ci/plugin-git/issues/65
---
 .../services/continuous-integration/woodpecker/agents.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nixos/modules/services/continuous-integration/woodpecker/agents.nix b/nixos/modules/services/continuous-integration/woodpecker/agents.nix
index 10ad94cee7bd..ac6ec45c0ba7 100644
--- a/nixos/modules/services/continuous-integration/woodpecker/agents.nix
+++ b/nixos/modules/services/continuous-integration/woodpecker/agents.nix
@@ -83,6 +83,14 @@ let
         PrivateMounts = true;
         SystemCallArchitectures = "native";
         SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
+        BindReadOnlyPaths = [
+          "-/etc/resolv.conf"
+          "-/etc/nsswitch.conf"
+          "-/etc/ssl/certs"
+          "-/etc/static/ssl/certs"
+          "-/etc/hosts"
+          "-/etc/localtime"
+        ];
       };
       inherit (agentCfg) environment;
     };