Add gitlab-runner secrets using agenix

gitlab-runner.nix

@@ -1,30 +1,21 @@
 { pkgs, lib, config, ... }:
 
 {
+  age.secrets."secrets/ovni-token".file = ./secrets/ovni-token.age;
+
   services.gitlab-runner = {
     enable = true;
     services = {
-      # runner for executing stuff on host system (very insecure!)
+      ovni-shell = {
-      # make sure to add required packages (including git!)
+        registrationConfigFile = config.age.secrets."secrets/ovni-token".path;
-      # to `environment.systemPackages`
-      shell = {
-        # File should contain at least these two variables:
-        # `CI_SERVER_URL`
-        # `REGISTRATION_TOKEN`
-        registrationConfigFile = "/run/secrets/gitlab-runner-registration";
         executor = "shell";
         tagList = [ "nix" "xeon" ];
         environmentVariables = {
           SHELL = "${pkgs.bash}/bin/bash";
         };
       };
-
+      ovni-docker = {
-      # runner for everything else
+        registrationConfigFile = config.age.secrets."secrets/ovni-token".path;
-      default = {
-        # File should contain at least these two variables:
-        # `CI_SERVER_URL`
-        # `REGISTRATION_TOKEN`
-        registrationConfigFile = "/run/secrets/gitlab-runner-registration";
         dockerImage = "debian:stable";
         tagList = [ "docker" "xeon" ];
         registrationFlags = [ "--docker-network-mode host" ];
@@ -43,12 +34,6 @@
   systemd.services.gitlab-runner.serviceConfig.ExecStart = lib.mkForce
     ''${pkgs.gitlab-runner}/bin/gitlab-runner --debug run --config ''${HOME}/.gitlab-runner/config.toml --listen-address "127.0.0.1:9252" --working-directory ''${HOME}'';
 
-  # TODO https://docs.gitlab.com/runner/configuration/proxy.html
-  #systemd.services.docker.environment = {
-  #  HTTP_PROXY="http://localhost:23080/";
-  #  HTTPS_PROXY="http://localhost:23080/";
-  #};
-
   users.users.gitlab-runner = {
     uid = config.ids.uids.gitlab-runner;
     #isNormalUser = true;

secrets.nix

@@ -0,0 +1,8 @@
+let
+  root = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIII/1TNArcwA6D47mgW4TArwlxQRpwmIGiZDysah40Gb";
+  system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICO7jIp6JRnRWTMDsTB/aiaICJCl4x8qmKMPSs4lCqP1";
+  systems = [ root system ];
+in
+{
+  "secrets/ovni-token.age".publicKeys = systems;
+}

secrets/ovni-token.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 MSF3dg Ivlduky3TjzCthY9RB/Jb0+MouX2FYW06hoNdQ+f818
+NKnuQrTQBXjTArXG6/5KV5cdg/9JUk/l3vVdYq0fXOE
+-> ssh-ed25519 HY2yRg 1ZCKpZ7sXNPgllHoozCgyW8NqK2TCoyCYZdug6YeJkM
+BEeThDkjfaK9S5a81HcyaZv9zobKANVMEimduc/IO54
+-> &eB%}y-grease o;.XY Yirz }Xh\DG
+CkLRClqWRkCr7n8o5UV9+kdCik2iTG/dI1s666CKcgxbAPohmryJzOKdgRLyzCf0
+CSPMUfrixmuQtuShigtmY6Pm2A
+--- GEuNMnWZ3+B6QNXv7s7bfJdJ2bJAAW+jbfHQZ0UQB+k
+¦²3‡Ã.¦-ãÓ®ÒÆ¿D£€’{\¹ìÔ%ªÜR0¤ß·°þ¶±æ°|ÖP¿F›ñxžs‹_P°¯x`4Ä,<2C>z35üL˜Ë
‘drj½2¬ï^Õ
+ëÿ]Àhç4~APÍ‹äe3fTàEÃl*ù8z.û÷Õx2<78>0ª7