I’m attempting to setup the Forgejo Actions runner to load a Podman image I’ve built locally with Nix, but I’m running into issues.
This is what I have so far:
{
config,
lib,
pkgs,
...
}:
let
inherit (lib) mkForce getExe;
actionsImage = pkgs.dockerTools.streamLayeredImage {
name = "actions-image";
tag = "latest";
contents = with pkgs; [
bash
git
nix
nodejs
];
config = {
Cmd = [ "bash" ];
};
};
in
{
services.gitea-actions-runner = {
package = pkgs.forgejo-actions-runner;
instances.default = {
enable = true;
name = config.networking.hostName;
url = "https://codeberg.org";
tokenFile = config.sops.templates.forgejo-actions-codeberg-token.path;
labels = [ "haddock:docker://localhost/${actionsImage.imageName}:latest" ];
settings = {
cache.enabled = true;
network = "host";
# options = "-e NIX_REMOTE=daemon -v /nix/:/nix/ -v /nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket";
# valid_volumes = [ "/nix/" ];
};
};
};
systemd.services.gitea-runner-default = {
preStart = "${actionsImage} | ${getExe config.virtualisation.podman.package} load";
serviceConfig = {
DynamicUser = mkForce false;
User = mkForce "forgejo_actions";
};
};
virtualisation.podman.enable = true;
users = {
users.forgejo_actions = {
isSystemUser = true;
group = "forgejo_actions";
# The runner needs permission to access the Podman socket
extraGroups = [ "podman" ];
};
groups.forgejo_actions = { };
};
sops = {
templates.forgejo-actions-codeberg-token = {
content = ''
TOKEN=${config.sops.placeholder."haddock/forgejo_actions/tokens/codeberg"}
'';
owner = "forgejo_actions";
};
secrets."haddock/forgejo_actions/tokens/codeberg".owner = "forgejo_actions";
};
}
I was basing it off of this: nur-combined/repos/eownerdead/hosts/nixos/actions.nix at 0caa434c479a92f0e8e0a86b728358c731c0ec0b · nix-community/nur-combined · GitHub
I’m getting this error when trying to run any actions though, which leads me to believe it isn’t able to find the image after loading it into Podman:
docker pull image=localhost/actions-image:latest platform= username= forcePull=false
Error response from daemon: {"message":"tls: internal error"}