treewide: more github runners + naive concurrency

hosts/kazuki/default.nix

@@ -27,5 +27,12 @@
     };
 
     common.hercules.enable = true;
+    common.github-runner = {
+      enable = true;
+      runners.settei = {
+        url = "https://github.com/nrabulinski/settei";
+        instances = 2;
+      };
+    };
   };
 }

hosts/kogata/default.nix

@@ -14,5 +14,9 @@
     environment.systemPackages = with pkgs; [teams];
 
     common.hercules.enable = true;
+    common.github-runner = {
+      enable = true;
+      runners.settei.url = "https://github.com/nrabulinski/settei";
+    };
   };
 }

hosts/legion/default.nix

@@ -38,5 +38,12 @@
     users.users.${username}.hashedPasswordFile = config.age.secrets.niko-pass.path;
 
     common.hercules.enable = true;
+    common.github-runner = {
+      enable = true;
+      runners.settei = {
+        url = "https://github.com/nrabulinski/settei";
+        instances = 4;
+      };
+    };
   };
 }

hosts/ude/default.nix

@@ -22,7 +22,10 @@
     services.hercules-ci-agent.settings.concurrentTasks = 6;
     common.github-runner = {
       enable = true;
-      runners.settei.url = "https://github.com/nrabulinski/settei";
+      runners.settei = {
+        url = "https://github.com/nrabulinski/settei";
+        instances = 6;
+      };
     };
 
     services.nginx = {

modules/system/common/github-runner.nix

@@ -17,19 +17,28 @@
   };
 
   linuxConfig = lib.optionalAttrs isLinux {
-    services.github-runners =
-      lib.mapAttrs (name: cfg: {
-        enable = true;
-        tokenFile = config.age.secrets.github-token.path;
-        inherit (cfg) name url;
-        ephemeral = true;
-        user = github-runner-user;
-        serviceOverrides = {
-          DynamicUser = false;
-        };
-        extraLabels = ["nix"];
-      })
-      cfg.runners;
+    services.github-runners = lib.pipe cfg.runners [
+      (lib.mapAttrsToList (
+        name: cfg:
+          lib.genList (i:
+            lib.nameValuePair
+            "${name}-${toString i}"
+            {
+              enable = true;
+              tokenFile = config.age.secrets.github-token.path;
+              inherit (cfg) url;
+              name = "${cfg.name}-${toString i}";
+              user = github-runner-user;
+              serviceOverrides = {
+                DynamicUser = false;
+              };
+              extraLabels = ["nix"];
+            })
+          cfg.instances
+      ))
+      lib.flatten
+      lib.listToAttrs
+    ];
 
     users = {
       users.${github-runner-user} = {
@@ -59,6 +68,10 @@ in {
             url = mkOption {
               type = types.str;
             };
+            instances = mkOption {
+              type = types.int;
+              default = 1;
+            };
           };
         }));
     };

secrets/alert-nrab-lol-pass.age

@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 84j9mw mwmdWJGJ/XJNFdlu3rfdwPZwArc4k0jCyg0IOt7Woms
-mR9gZHcrQpfIBahm1F4Mi8peBjMqRtcqvKiNat15mE0
--> ssh-ed25519 GKhvwg 56FsOXlgqk60VEJCbw6MxVm7rdNLTHhZLec+B3uiXyI
-Tr5+EuPuCOUEH3+snhq/Pt7RRzT0N5GTi8+kBL5W+JE
---- GsG8dZ4Pm4fmdeTAB3FK9hpeuoLK3vBDgNZtGCWULj8
-M‡å-fë5Þ7Il³üÌÝòÔóºµäzŸìB«×s<C397>¦ÌÉõæ|Ä uˆÂÌKqy_c<>ÌPÁ¶zy2eë0êbœ 4ºäSðƧ2ëgb^ˆ=uüZdÐ<64>)
+-> ssh-ed25519 84j9mw tfUR84yYxwWvNBmxvhsZHGtaIruTij97ZI50cJSL/Qg
+O4l3r8XdWzLZuxp5BolTS7XOfbDvwj1Ybbl1TPSrtSY
+-> ssh-ed25519 GKhvwg DItnbkoSp8LfS6MZsKZ8njOnbtiqYufdEHr+dbb8i0M
+NYOrpEIWujBGLdBWyHJmtTTdvlhVlpDaI1r3RM8K9zg
+--- Lyzm1dKlnSIdBYB2tQuDEbGy9Gf/KlHfOAPw3NT15Xs
+‰ïšá69ùü…@#JQËçÂ#;’)?ØäêÀÿ¾8ý/0ç¹8ö¸ÆêZ û{÷ጶSìä°[·N¥…<C2A5>{‘rJb’©¦—¿S~™¾<12>zk˜O'4„

secrets/alert-plain-pass.age

@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 ioPMHA 4EqxwfHCz9VJQPMfULLbAr9eaesivV9BE1ERyrH91xY
-M2l3meRzStyjlG9enK3ObCeglXP6cOfiYzrqcw0in2U
--> ssh-ed25519 GKhvwg 2CjaggQgGYNEfP/IBME/T0cueM5KY94nK5VbbXw4Tj8
-Mi0Sig6qtnBtKVEiw7uBQqyLdqxw6OuJzAbu7USrR40
---- OfhXRbqvSTxx9Sv/Ke7IHMSZrkVF/dmCqabmt5fbhP8
-ëHŠržm-iB̳ޥ.Ú{2»]PÔ¾d!eæô¥²Uým1ø{dŒÈ
+-> ssh-ed25519 ioPMHA ataMxkoppMnkRaCScXAtEohUU3WE8fEYxBeaZYOQoXE
+WcBLxLGjV1uawwi5C70+XMEo7Z+UfWspPbWW+mQDqhc
+-> ssh-ed25519 GKhvwg 01u8Pl4uXUryHlKVkgywl0glUBEtVjdNxXCPexoqvFE
+mVlJz6NKCto+Re1Ps64+yg1Ztf6sWWPX91TKyerIXa0
+--- b/8Zb9zbaU7zLm0OXMsWrIx0Iahq/oKkxcQLhkDsutA
+Å"¦¦>¤Yk˜lR¢iëó›}="‡-uì:•†¶8":¾Ï(DíøâWƒ†µ½þ’ªp

secrets/attic-creds.age

@@ -1,8 +1,8 @@
 age-encryption.org/v1
--> ssh-ed25519 84j9mw L1Lee3U0LWtn6zx0M5pA+VpiRtx903AYyVPmeaciumA
-dfEtGwEhEtBGnltkRFT2KMUl/tC1b8bYCLKtut0S75g
--> ssh-ed25519 GKhvwg Ybp7LvImp228BXqj9IfahYkdCZdO5NgPGol+GacnfQM
-hSU9nhgpeOgRDQHDpO9mFPdu52R6y2/lfYCI01/3ypA
---- YnhUF2kfu+Va5YyMjZcySvd4dSbvz5CMIAkbX+2iUQ4
-'ÁÝQì”þß	~	ʲ"#Ñ…~,ýT¹6!™G~×Ö7Sô}Èê¿‚ñ˜-¹E+Ì\
-)¶˜,2Žf¨. ¼|M9	z‚s'³žJ"'6_º[.rqÝ<71>8¤Ý|yü>‚æ]c"º„wÍH<C38D>ÙöÏ›E´ùËî„Îc®†Ni‘jã›Óýž×þ—ú7ã 0
‹<>ñ’
+-> ssh-ed25519 84j9mw v0YsgTbyCuVI0uAXTeCR6XSORbwJxVpegx+adh15aw8
+HvNFhJmh8MEybRtG92IlsQZXYeDyvh0vsiu0f08CXy0
+-> ssh-ed25519 GKhvwg MrFFxPlJ7JBvUhl2QByLvRIigGmBT2J/123O90srXx0
+f8dGUqoJbQjH1epgvTte161wRn/sas6AayOvqgEcfc0
+--- s1v3ZB9lVmLob/xQ48C/xa3DnXZhoJr0zVk/X5VfdJU
+Рέ+ÄëO <4F>PUâºuÎ’M“<4D><E2809C>´ãÛxÒ¯æVG')´Ë´ÎnS¬.>•4Ù<34>Éô±]<5D>YÔ:pPT4UBò€œ?J“<<3C>&dZ›S—<53>"À™2_<32>(ÿÒå
+IÖâ«Mšû?Ž¯B³éI‰VP:œ•¼ó%O<>ýr¾[â&0½Aˆ©?[Jò<AƒŸÐF»CfãfÀü[ÑàHj+:³Œwö¼‘E

secrets/github-token.age

@@ -1,7 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 IFuY+w UcPjVl8nIr6sgfsxOrYmgi46rAsfdCRy9iTGkQAOaSE
-vKislIP2yoQahKTpAE0d8P3ZdyyCHThy4u6vshtOQAI
--> ssh-ed25519 GKhvwg 2ZS+VXjZFBj3n9RoJD8Ynn6Rur6Abs5loOtebFIang0
-/47vHgkd8KPnM1sPWjqFDSdTk3LiUQNmO9X0HodHjS8
---- MBuCzebM317ShOJsMaGMdUR83avwx/Ig84l1q2Fv6Ng
-Îå0“ÅË€©C¥;¨d-Žû
Ò”1
À"%?<02>WèÝÞb®Q%Ž¤k
àœWU3}º‚-µyM,ƒ@ô‡_¡â\‘ QU§oPmJ
+-> ssh-ed25519 IFuY+w O/FQauaFhUwbinIrTM7/cRbolpvUWXNKJBxrMoUVJF0
+GKPP4rmiC2YQs/ythlp+UwPEchVg5PMQ4zr1Kapukmw
+-> ssh-ed25519 84j9mw 4R3KhL7n/7/bLOwipVLST25sjANznNtdPCOUDS8Ztmg
+JjrQ/BWgrBly4SyEskM0I4Q1tnyVytOA6TmwFAKilr8
+-> ssh-ed25519 GKhvwg Fi1Ji7ohIublP7bzYWhHZeWVg6dB9SJClTZx9iGIxk4
+FH8JIjI+oPJTcQARh50PhegayJw6Bm71QglpB40Y5VE
+--- Vzb2XFEK08ENArloqCy6gAU4laVkKo+0kKAJ8d/uzgo
+	IÊvVX´O+ê,nØn3\{'SØ9ÆÏ/ε>I;q£Ü¸ÛÈðè‡d‘W9Tˆnðl	*ì=èå†R)1Cç©èˆ‹ýÃRì

secrets/legion-niko-pass.age

@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 ioPMHA BCoFRArzhiWzaXVtF1qkiPxL+M5WuLsrUqH9T8hh7D0
-3be6hdQ8hjRLCuN91pB8X/WhvwfpvPifsICFOxAUxlY
--> ssh-ed25519 GKhvwg 0L+oViZLW+pKKDmP2H4uv1PDAE423vqAHpPltN+euhU
-zDVev9k/LRuqUWvSjFxCE0H+yt8xniV/Au0Z+49zY9M
---- 1UkToOyXP7ljQ+KTcSfNydUd8J1rm3QeyabusJiZqAM
-J)2<><32><EFBFBD>a ^6<><36><EFBFBD>
<01>䗍<EFBFBD>AJ<41><13><12>͜5<CD9C><35><EFBFBD>1i<31>	<09><><EFBFBD>ғ<EFBFBD>c<EFBFBD><63><EFBFBD><EFBFBD>Z<EFBFBD><5A>P<L<>V<EFBFBD><0F>l<EFBFBD><6C><15>3<05>0\<5C>2\/oc<><63>9µ<18>rdl<64><6C><EFBFBD>#<23>͌5<CD8C>=<3D>,'9<><39>
+-> ssh-ed25519 ioPMHA kdyCpSDZA4wsaPClpGwicXN3bLytnBT2RmRD14tjdDs
+vRNd1HuCBYTD2Co9G+Edb3T5ecTLzjTBWWn/J26y8gA
+-> ssh-ed25519 GKhvwg 5MZxra/oc5lMPmx7Y2mPJ0axSQrZm+Vc9ep8vWu3Mm4
+vGC56lhi+uwLBx4Khne+YoHkNi6pH6srRFDyNKqr/8s
+--- NfSPAUies7aRBOwFmVUbcBzkPxfTnonEqP/Iot6Mc/M
+{¾^iúl4m*Î(ïý¦‹ÂO¸×Œ‡î‰r¡^êún<<3C>j47Ëh[Kd¢,„#Ö³ï.æ^s½þҽȀbà˜þüjÄw¸[LöQÉõ''Oè^'6¦­‚Òc?~DM’Zóh'q«V

secrets/nrab-lol-cf.age

@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 84j9mw QEsw7uvxEdZ/2Bab/bGd9/Ap5psN7p5RudFZJFZQ3kM
-UZCthc92ptbwxxe8nFnhvdedkpt6Y/nJf8GI0qdQRcc
--> ssh-ed25519 GKhvwg BIAW4Jad+tcsVXR6ibhWvvuvXCNQ1seZR1HGym11Mz8
-9NHhqlljWYoH8t1s4vvgzUjfL5lxVPVEY/pDiDP9h1I
---- dyefPpAwwsQ4xLsUBr3L5VYBhhdVKOYaCrabI042cCk
-_ÁèŽóofVžÅ!Ë€v^Çå>'˜`šëqW'C§êEØ{jÅñ³7ªñ‚_ç)|t6{»}ÑpÐûœÃÒ»úÌ#Ž°ŸG—ó›S·ÑîØíÉ>QÏ£"C
+-> ssh-ed25519 84j9mw Ao9xAby1hDTHybu6IkkpSYj2+fIrp7RyPtD4UhDcllU
+JagJ33GdoNif6fv4x679IkFUVKIB5s+q8p/86pYWG/k
+-> ssh-ed25519 GKhvwg wWBJKWZBeHz19y6/YHooVoeNtyS45+ff3zwZ+uTLTBo
+NjgD+eZzt6lYZlN+TgpYQxTJ+JhjHY56vktCoLpvGLE
+--- ebDqhUoYKbGEfLWElIgwD8nPei/6dWKTRyLuT3AgG0w
+•OœÇlkýnéÒÏLЗv<E28094>Éáiö%(žÛâ3ð2µ6d¾óWN$i)ãÉzz^cÉè	:@‰˜l|VÑßkdÅâ¿Æ[¾X_¯)üh?ôÝUaC}

secrets/secrets.nix

@@ -57,6 +57,7 @@ in {
   ];
   "github-token.age".publicKeys = [
     keys.system.ude
+    keys.system.kazuki
     keys.other.bootstrap
   ];
 }

secrets/storage-box-creds.age

@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 84j9mw Ne+o6QDh4zL7sYize81+CsErRJqFPVPvqgKof1NaGXE
-cxgH4T1TL1QNebEpJjbhtNzsruScnfiJmooyu1H1hqA
--> ssh-ed25519 GKhvwg D7vjyGI59njgGefZ0siA84egRuXDBJKHMykAfejvbiE
-F6g9/HZYUGvH8fwXvn0jUbBpouloFbyD6cSYyj6efcY
---- 6wPtAFTNJYMqW26PpAHohjNjryx/XL7UIo7+91CFjZY
-ÖO··ô>ŕeNęŤ×2ŹË—]˘C4»lÖ#ómoź ’›â‚ő `™%0XX)C:ó[č[Ť<>ü ŠůĎʵč+äČ*tčm
+-> ssh-ed25519 84j9mw flAGDRU7ONCpOxgQvudxjl2H8U4LB3ATxOF6/Q04QnA
+KTudGd6ePDARxgM3pxNbcFvmHKOsrr1+5pMhoBOOn8c
+-> ssh-ed25519 GKhvwg xyDU0Bfmt/ib35pF8PcZAi4mBwbsMlyacUqNnBlAyG0
+fjyIGDjOaLgb1qzejoxDEUZiMGuXwRKc1p9Az0qy20I
+--- rLpJ72c+QSvu+8LMOJp1XRrtlNmH6xU8ObnvilPzl4I
+0¶=v´ž2äU篱×RÒuÞž<C39E><C5BE>¬y¥¸.¸,ö&Êæä“ßþÎÄ9!‚[A`$Ɖ	Ý°q‡Ö{ïD]ÈW!ÓBk

secrets/vault-cert-env.age

@@ -1,7 +1,8 @@
 age-encryption.org/v1
--> ssh-ed25519 84j9mw eje98xFWmQ76FVbbuu1fIJSN26sxalB3hQeCZe86tGw
-2hIPVSC1oLwY/AtEhKa0qUenw8nBBOY5uC74B0O4ohs
--> ssh-ed25519 GKhvwg e4D3PZQrTW3DHV9YLD9d9wvirIhCNJCBVqI/BKC6CWA
-jpQnjh4yhLJdjeBcjlyP+aRZfSI++7j8PxlIwbQ00Qw
---- eU8hHBZ0+PiVjH1SetgWVronyegyAZclWnIdxHmeO8Q
-í)b³#pBJxÖ<78>
¼Í%¶—<C2B6>ù…<txsdJŽƒ‡º`jÞ_FÅd€n2gåMO
Ožó«\?~6ç>êa
«§q(ÿlP¨«{ƒ+j¼¿>lâé#Ó<13>
+-> ssh-ed25519 84j9mw hvZRPX7KPlenU4WVrYxW9LrmjGuJyUv3L8Vf07QvIDA
+1r+hIxsH22OlbqmPnhBO+8IYAgF+MyzYIslzfyKYkHQ
+-> ssh-ed25519 GKhvwg WvQ3d2G+R3vLmBmz5P7zEP/0/xNgmg09sMEzbVGy11c
+joIgz1+t5czRm3Mz7H+aggPJCU3EsfLunRc3T0CTZOM
+--- 8Vd7XSFbf48XVttovVQcS4eVwn3tf6eTEUN5HHn+r14
+Î-›ã£P³¨pÜ>9RS:d³Sô7ÆFÎ_D‰-&ÁÀÐ<C380>Yz¥W•5d›â¹Ü0ãpd$÷äióe:
+š<EFBFBD>ü’u:£®2N]Þ#W*sÜø)Æ{cy
ûYt.