mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-08-27 02:34:53 +00:00
e6ed17b918
Add three options to `services.github-runners.<name>`: - `githubApp`: authenticate via a GitHub App installation instead of a `tokenFile`. The service derives a short-lived installation token from the App's private key on each start, registers the runner, and de-registers it on stop. The PEM key is a deployed secret, never copied into the store. - `count`: fan a single entry out into N identical runner services. `github-runner-<name>` is unchanged for `count == 1`, suffixed `-<n>` for `count > 1`. - `orgs`: serve several organisations (or repositories) from one entry, fanning out into `github-runner-<name>-<org>-<n>`. The entry-level auth is shared across orgs and only the App `login` changes per org; the per-org `count` defaults to the entry-level `count`. This brings the multi-org consumption shape of the soon-to-be-removed srvos runner role (nix-community/srvos#836, nix-community/srvos#837) into nixpkgs. An entry without `orgs` and with the default `count = 1` is unchanged, so existing runners do not re-register.
491 lines
20 KiB
Nix
491 lines
20 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
config.assertions = lib.flatten (
|
|
lib.flip lib.mapAttrsToList config.services.github-runners (
|
|
name: cfg:
|
|
map (lib.mkIf cfg.enable) [
|
|
{
|
|
assertion = (cfg.tokenFile == null) != (cfg.githubApp == null);
|
|
message = "`services.github-runners.${name}`: Exactly one of `tokenFile` and `githubApp` must be set";
|
|
}
|
|
{
|
|
assertion = cfg.orgs != { } || cfg.url != null;
|
|
message = "`services.github-runners.${name}`: `url` must be set unless `orgs` is used";
|
|
}
|
|
{
|
|
assertion = cfg.orgs != { } || cfg.githubApp == null || cfg.githubApp.login != null;
|
|
message = "`services.github-runners.${name}`: `githubApp.login` must be set unless `orgs` is used (the login is then derived per org)";
|
|
}
|
|
{
|
|
assertion = cfg.orgs != { } || cfg.count == 1 || cfg.name != null;
|
|
message = "`services.github-runners.${name}`: `name` must not be null when `count > 1` (each replica needs a distinct registration name)";
|
|
}
|
|
{
|
|
assertion = !cfg.noDefaultLabels || (cfg.extraLabels != [ ]);
|
|
message = "`services.github-runners.${name}`: The `extraLabels` option is mandatory if `noDefaultLabels` is set";
|
|
}
|
|
{
|
|
assertion = cfg.group == null || cfg.user != null;
|
|
message = ''`services.github-runners.${name}`: Setting `group` while leaving `user` unset runs the service as `root`. If this is really what you want, set `user = "root"` explicitly'';
|
|
}
|
|
]
|
|
)
|
|
);
|
|
|
|
config.systemd.services =
|
|
let
|
|
enabledRunners = lib.filterAttrs (_: cfg: cfg.enable) config.services.github-runners;
|
|
runnerInstances = lib.concatMapAttrs (
|
|
name: cfg:
|
|
if cfg.orgs == { } then
|
|
# Single org/repo (entry-level `url`), fanned out by `count`. For
|
|
# `count == 1` the service keeps the bare `github-runner-<name>` name
|
|
# for backwards compatibility; `count > 1` suffixes `-<n>`.
|
|
let
|
|
suffixes = if cfg.count == 1 then [ "" ] else map (n: "-${toString n}") (lib.range 1 cfg.count);
|
|
in
|
|
lib.listToAttrs (
|
|
map (
|
|
suffix:
|
|
lib.nameValuePair "${name}${suffix}" (
|
|
cfg // { name = if cfg.name == null then null else "${cfg.name}${suffix}"; }
|
|
)
|
|
) suffixes
|
|
)
|
|
else
|
|
lib.listToAttrs (
|
|
lib.concatLists (
|
|
lib.flip lib.mapAttrsToList cfg.orgs (
|
|
orgName: org:
|
|
map (
|
|
n:
|
|
let
|
|
key = "${name}-${orgName}-${toString n}";
|
|
in
|
|
lib.nameValuePair key (
|
|
cfg
|
|
// {
|
|
url = org.url;
|
|
name = key;
|
|
extraLabels = cfg.extraLabels ++ org.extraLabels;
|
|
githubApp = if cfg.githubApp == null then null else cfg.githubApp // { login = org.login; };
|
|
}
|
|
)
|
|
) (lib.range 1 org.count)
|
|
)
|
|
)
|
|
)
|
|
) enabledRunners;
|
|
in
|
|
(lib.flip lib.mapAttrs' runnerInstances (
|
|
name: cfg:
|
|
let
|
|
svcName = "github-runner-${name}";
|
|
systemdDir = "github-runner/${name}";
|
|
|
|
# %t: Runtime directory root (usually /run); see systemd.unit(5)
|
|
runtimeDir = "%t/${systemdDir}";
|
|
# %S: State directory root (usually /var/lib); see systemd.unit(5)
|
|
stateDir = "%S/${systemdDir}";
|
|
# %L: Log directory root (usually /var/log); see systemd.unit(5)
|
|
logsDir = "%L/${systemdDir}";
|
|
# Name of file stored in service state directory
|
|
currentConfigTokenFilename = ".current-token";
|
|
|
|
workDir = if cfg.workDir == null then runtimeDir else cfg.workDir;
|
|
|
|
newConfigTokenPath = "$STATE_DIRECTORY/.new-token";
|
|
currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}";
|
|
|
|
# Wrapper script which expects the full path of the state, working and logs
|
|
# directory as arguments. Overrides the respective systemd variables to provide
|
|
# unambiguous directory names. This becomes relevant, for example, if the
|
|
# caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory=
|
|
# to contain more than one directory. This causes systemd to set the respective
|
|
# environment variables with the path of all of the given directories, separated
|
|
# by a colon.
|
|
writeScript =
|
|
scriptName: lines:
|
|
pkgs.writeShellScript "${svcName}-${scriptName}.sh" ''
|
|
set -euo pipefail
|
|
|
|
STATE_DIRECTORY="$1"
|
|
WORK_DIRECTORY="$2"
|
|
LOGS_DIRECTORY="$3"
|
|
|
|
${lines}
|
|
'';
|
|
|
|
ghUrlPath = lib.removePrefix "https://github.com/" cfg.url;
|
|
ghUrlSegments = lib.filter (s: s != "") (lib.splitString "/" ghUrlPath);
|
|
runnerScope = if lib.length ghUrlSegments >= 2 then "repo" else "org";
|
|
appHelper =
|
|
helperName: scriptFile:
|
|
pkgs.writeShellApplication {
|
|
name = helperName;
|
|
runtimeInputs = with pkgs; [
|
|
jq
|
|
curl
|
|
openssl
|
|
coreutils
|
|
];
|
|
excludeShellChecks = [
|
|
"SC2154"
|
|
"SC2116"
|
|
];
|
|
text = builtins.readFile scriptFile;
|
|
};
|
|
fetchAccessToken = appHelper "github-app-access-token" ./app-token.sh;
|
|
fetchRegistrationToken = appHelper "github-runner-registration-token" ./registration-token.sh;
|
|
removeRunner = appHelper "github-runner-remove" ./remove-runner.sh;
|
|
appEnv = lib.optionalString (cfg.githubApp != null) ''
|
|
export APP_ID=${toString cfg.githubApp.id}
|
|
export APP_LOGIN=${lib.escapeShellArg cfg.githubApp.login}
|
|
APP_PRIVATE_KEY="$(cat ${lib.escapeShellArg cfg.githubApp.privateKeyFile})"
|
|
export APP_PRIVATE_KEY
|
|
export RUNNER_SCOPE=${runnerScope}
|
|
export ORG_NAME=${lib.escapeShellArg cfg.githubApp.login}
|
|
export REPO_URL=${lib.escapeShellArg cfg.url}
|
|
${
|
|
if cfg.name != null then
|
|
"export RUNNER_NAME=${lib.escapeShellArg cfg.name}"
|
|
else
|
|
''export RUNNER_NAME="$(uname -n)"''
|
|
}
|
|
'';
|
|
in
|
|
lib.nameValuePair svcName {
|
|
description = "GitHub Actions runner";
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
wants = [ "network-online.target" ];
|
|
after = [
|
|
"network.target"
|
|
"network-online.target"
|
|
];
|
|
|
|
environment = {
|
|
HOME = workDir;
|
|
RUNNER_ROOT = stateDir;
|
|
}
|
|
// cfg.extraEnvironment;
|
|
|
|
path =
|
|
(with pkgs; [
|
|
bashInteractive
|
|
coreutils
|
|
git
|
|
gnutar
|
|
gzip
|
|
])
|
|
++ [
|
|
config.nix.package
|
|
]
|
|
++ cfg.extraPackages;
|
|
|
|
serviceConfig = lib.mkMerge [
|
|
{
|
|
ExecStart = "${cfg.package}/bin/Runner.Listener run --startuptype service";
|
|
|
|
# Does the following, sequentially:
|
|
# - If the module configuration or the token has changed, purge the state directory,
|
|
# and create the current and the new token file with the contents of the configured
|
|
# token. While both files have the same content, only the later is accessible by
|
|
# the service user.
|
|
# - Configure the runner using the new token file. When finished, delete it.
|
|
# - Set up the directory structure by creating the necessary symlinks.
|
|
ExecStartPre =
|
|
let
|
|
runnerRegistrationConfig = lib.getAttrs [
|
|
"ephemeral"
|
|
"extraLabels"
|
|
"name"
|
|
"noDefaultLabels"
|
|
"runnerGroup"
|
|
"tokenFile"
|
|
"url"
|
|
"workDir"
|
|
] cfg;
|
|
newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
|
|
currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
|
|
|
|
runnerCredFiles = [
|
|
".credentials"
|
|
".credentials_rsaparams"
|
|
".runner"
|
|
];
|
|
unconfigureRunner = writeScript "unconfigure" ''
|
|
copy_tokens() {
|
|
# Copy the configured token file to the state dir and allow the service user to read the file
|
|
install --mode=666 ${lib.escapeShellArg cfg.tokenFile} "${newConfigTokenPath}"
|
|
# Also copy current file to allow for a diff on the next start
|
|
install --mode=600 ${lib.escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}"
|
|
}
|
|
clean_state() {
|
|
find "$STATE_DIRECTORY/" -mindepth 1 -delete
|
|
copy_tokens
|
|
}
|
|
diff_config() {
|
|
changed=0
|
|
# Check for module config changes
|
|
[[ -f "${currentConfigPath}" ]] \
|
|
&& ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \
|
|
|| changed=1
|
|
# Also check the content of the token file
|
|
[[ -f "${currentConfigTokenPath}" ]] \
|
|
&& ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${lib.escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \
|
|
|| changed=1
|
|
# If the config has changed, remove old state and copy tokens
|
|
if [[ "$changed" -eq 1 ]]; then
|
|
echo "Config has changed, removing old runner state."
|
|
echo "The old runner will still appear in the GitHub Actions UI." \
|
|
"You have to remove it manually."
|
|
clean_state
|
|
fi
|
|
}
|
|
if [[ "${lib.optionalString cfg.ephemeral "1"}" ]]; then
|
|
# In ephemeral mode, we always want to start with a clean state
|
|
clean_state
|
|
elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then
|
|
# There are state files from a previous run; diff them to decide if we need a new registration
|
|
diff_config
|
|
else
|
|
# The state directory is entirely empty which indicates a first start
|
|
copy_tokens
|
|
fi
|
|
# Always clean workDir
|
|
find -H "$WORK_DIRECTORY" -mindepth 1 -delete
|
|
'';
|
|
unconfigureRunnerGitHubApp = writeScript "unconfigure-github-app" ''
|
|
${appEnv}
|
|
ACCESS_TOKEN="$(${lib.getExe' fetchAccessToken "github-app-access-token"})"
|
|
export ACCESS_TOKEN
|
|
|
|
${lib.getExe' removeRunner "github-runner-remove"} || true
|
|
|
|
find "$STATE_DIRECTORY/" -mindepth 1 -delete
|
|
|
|
umask 000
|
|
${lib.getExe' fetchRegistrationToken "github-runner-registration-token"} \
|
|
| ${pkgs.jq}/bin/jq -r '.token' > "${newConfigTokenPath}"
|
|
install --mode=600 "${newConfigTokenPath}" "${currentConfigTokenPath}"
|
|
|
|
# Always clean workDir
|
|
find -H "$WORK_DIRECTORY" -mindepth 1 -delete
|
|
'';
|
|
configureRunner =
|
|
writeScript "configure" # bash
|
|
''
|
|
if [[ -e "${newConfigTokenPath}" ]]; then
|
|
echo "Configuring GitHub Actions Runner"
|
|
# shellcheck disable=SC2054 # don't complain about commas in --labels
|
|
args=(
|
|
--unattended
|
|
--disableupdate
|
|
--work "$WORK_DIRECTORY"
|
|
--url ${lib.escapeShellArg cfg.url}
|
|
--labels ${lib.escapeShellArg (lib.concatStringsSep "," cfg.extraLabels)}
|
|
${lib.optionalString (cfg.name != null) "--name ${lib.escapeShellArg cfg.name}"}
|
|
${lib.optionalString cfg.replace "--replace"}
|
|
${lib.optionalString (
|
|
cfg.runnerGroup != null
|
|
) "--runnergroup ${lib.escapeShellArg cfg.runnerGroup}"}
|
|
${lib.optionalString cfg.ephemeral "--ephemeral"}
|
|
${lib.optionalString cfg.noDefaultLabels "--no-default-labels"}
|
|
)
|
|
token=$(<"${newConfigTokenPath}")
|
|
${
|
|
if cfg.githubApp != null then
|
|
''
|
|
args+=(--token "$token")
|
|
''
|
|
else
|
|
''
|
|
case ${cfg.tokenType} in
|
|
access)
|
|
args+=(--pat "$token")
|
|
;;
|
|
registration)
|
|
args+=(--token "$token")
|
|
;;
|
|
auto)
|
|
# If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"),
|
|
# we have to use the --pat option, if it is not a PAT, we assume it contains a
|
|
# registration token and use the --token option
|
|
if [[ "$token" =~ ^gh[a-z]+_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
|
|
args+=(--pat "$token")
|
|
else
|
|
args+=(--token "$token")
|
|
fi
|
|
;;
|
|
esac
|
|
''
|
|
}
|
|
${cfg.package}/bin/Runner.Listener configure "''${args[@]}"
|
|
# Move the automatically created _diag dir to the logs dir
|
|
mkdir -p "$STATE_DIRECTORY/_diag"
|
|
cp -r "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/"
|
|
rm -rf "$STATE_DIRECTORY/_diag/"
|
|
# Cleanup token from config
|
|
rm "${newConfigTokenPath}"
|
|
# Symlink to new config
|
|
ln -s '${newConfigPath}' "${currentConfigPath}"
|
|
fi
|
|
'';
|
|
setupWorkDir = writeScript "setup-work-dirs" ''
|
|
# Link _diag dir
|
|
ln -s "$LOGS_DIRECTORY" "$WORK_DIRECTORY/_diag"
|
|
|
|
# Link the runner credentials to the work dir
|
|
ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$WORK_DIRECTORY/"
|
|
'';
|
|
in
|
|
map
|
|
(
|
|
x:
|
|
"${x} ${
|
|
lib.escapeShellArgs [
|
|
stateDir
|
|
workDir
|
|
logsDir
|
|
]
|
|
}"
|
|
)
|
|
[
|
|
# runs as root
|
|
"+${if cfg.githubApp != null then unconfigureRunnerGitHubApp else unconfigureRunner}"
|
|
configureRunner
|
|
setupWorkDir
|
|
];
|
|
|
|
ExecStopPost = lib.optionals (cfg.githubApp != null) (
|
|
let
|
|
unregister = writeScript "unregister-github-app" ''
|
|
${appEnv}
|
|
ACCESS_TOKEN="$(${lib.getExe' fetchAccessToken "github-app-access-token"})"
|
|
export ACCESS_TOKEN
|
|
${lib.getExe' removeRunner "github-runner-remove"} || true
|
|
'';
|
|
in
|
|
map (
|
|
x:
|
|
"${x} ${
|
|
lib.escapeShellArgs [
|
|
stateDir
|
|
workDir
|
|
logsDir
|
|
]
|
|
}"
|
|
) [ "-+${unregister}" ] # runs as root
|
|
);
|
|
|
|
# If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner)
|
|
# to trigger a fresh registration.
|
|
Restart = if cfg.ephemeral then "on-success" else "no";
|
|
# If the runner exits with `ReturnCode.RetryableError = 2`, always restart the service:
|
|
# https://github.com/actions/runner/blob/40ed7f8/src/Runner.Common/Constants.cs#L146
|
|
RestartForceExitStatus = [ 2 ];
|
|
|
|
# Contains _diag
|
|
LogsDirectory = [ systemdDir ];
|
|
# Default RUNNER_ROOT which contains ephemeral Runner data
|
|
RuntimeDirectory = [ systemdDir ];
|
|
# Home of persistent runner data, e.g., credentials
|
|
StateDirectory = [ systemdDir ];
|
|
StateDirectoryMode = "0700";
|
|
WorkingDirectory = workDir;
|
|
|
|
InaccessiblePaths = [
|
|
# Token file in the state directory
|
|
"${stateDir}/${currentConfigTokenFilename}"
|
|
]
|
|
# Token file path given in the configuration, if visible to the service
|
|
++ lib.optional (cfg.tokenFile != null) "-${cfg.tokenFile}"
|
|
++ lib.optional (cfg.githubApp != null) "-${cfg.githubApp.privateKeyFile}";
|
|
|
|
KillSignal = "SIGINT";
|
|
|
|
# Hardening (may overlap with DynamicUser=)
|
|
# The following options are only for optimizing:
|
|
# systemd-analyze security github-runner
|
|
AmbientCapabilities = lib.mkBefore [ "" ];
|
|
CapabilityBoundingSet = lib.mkBefore [ "" ];
|
|
# ProtectClock= adds DeviceAllow=char-rtc r
|
|
DeviceAllow = lib.mkBefore [ "" ];
|
|
NoNewPrivileges = lib.mkDefault true;
|
|
PrivateDevices = lib.mkDefault true;
|
|
PrivateMounts = lib.mkDefault true;
|
|
PrivateTmp = lib.mkDefault true;
|
|
PrivateUsers = lib.mkDefault true;
|
|
ProtectClock = lib.mkDefault true;
|
|
ProtectControlGroups = lib.mkDefault true;
|
|
ProtectHome = lib.mkDefault true;
|
|
ProtectHostname = lib.mkDefault true;
|
|
ProtectKernelLogs = lib.mkDefault true;
|
|
ProtectKernelModules = lib.mkDefault true;
|
|
ProtectKernelTunables = lib.mkDefault true;
|
|
ProtectSystem = lib.mkDefault "strict";
|
|
RemoveIPC = lib.mkDefault true;
|
|
RestrictNamespaces = lib.mkDefault true;
|
|
RestrictRealtime = lib.mkDefault true;
|
|
RestrictSUIDSGID = lib.mkDefault true;
|
|
UMask = lib.mkDefault "0066";
|
|
ProtectProc = lib.mkDefault "invisible";
|
|
SystemCallFilter = lib.mkBefore [
|
|
"~@clock"
|
|
"~@cpu-emulation"
|
|
"~@module"
|
|
"~@mount"
|
|
"~@obsolete"
|
|
"~@raw-io"
|
|
"~@reboot"
|
|
"~capset"
|
|
"~setdomainname"
|
|
"~sethostname"
|
|
];
|
|
RestrictAddressFamilies = lib.mkBefore [
|
|
"AF_INET"
|
|
"AF_INET6"
|
|
"AF_UNIX"
|
|
"AF_NETLINK"
|
|
];
|
|
|
|
BindPaths = lib.optionals (cfg.workDir != null) [ cfg.workDir ];
|
|
|
|
# Needs network access
|
|
PrivateNetwork = lib.mkDefault false;
|
|
# Cannot be true due to Node
|
|
MemoryDenyWriteExecute = lib.mkDefault false;
|
|
|
|
# The more restrictive "pid" option makes `nix` commands in CI emit
|
|
# "GC Warning: Couldn't read /proc/stat"
|
|
# You may want to set this to "pid" if not using `nix` commands
|
|
ProcSubset = lib.mkDefault "all";
|
|
# Coverage programs for compiled code such as `cargo-tarpaulin` disable
|
|
# ASLR (address space layout randomization) which requires the
|
|
# `personality` syscall
|
|
# You may want to set this to `true` if not using coverage tooling on
|
|
# compiled code
|
|
LockPersonality = lib.mkDefault false;
|
|
|
|
DynamicUser = lib.mkDefault true;
|
|
}
|
|
(lib.mkIf (cfg.user != null) {
|
|
DynamicUser = false;
|
|
User = cfg.user;
|
|
})
|
|
(lib.mkIf (cfg.group != null) {
|
|
DynamicUser = false;
|
|
Group = cfg.group;
|
|
})
|
|
cfg.serviceOverrides
|
|
];
|
|
}
|
|
));
|
|
}
|