hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Fix Namespace Apple runner dispatch
Some checks failed
Build Rust / Cargo Test (push) Successful in 4m15s
Details
Build Site / Next.js Build (push) Failing after 5s
Details
Lint Governance / BEP Metadata (push) Successful in 1s
Details
Cache: Publish Nix / Publish Nix Cache (push) Failing after 20s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-07 08:26:23 -07:00
parent 212b129c31
commit a4db952d3f
12 changed files with 77 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

27
nixos/hosts/burrow-forge/default.nix
View file

@ -50,6 +50,29 @@ let
forgeAuthorizedKeys = map
(username: builtins.readFile identities.${username}.sshPublicKeyPath)
(builtins.attrNames (lib.filterAttrs (_: identity: identity.forgeAuthorized or false) identities));
forgejoNscMaterializeTokenCache = ''
install -d -m 700 -o forgejo-nsc -g forgejo-nsc /var/lib/forgejo-nsc/.config/ns
${pkgs.python3}/bin/python3 - <<'PY'
import json
from pathlib import Path
raw = Path("/var/lib/forgejo-nsc/nsc.token").read_text(encoding="utf-8").strip()
if not raw:
raise SystemExit("empty Namespace token")
if raw.startswith("{"):
data = json.loads(raw)
if "bearer_token" not in data and "session_token" not in data:
raise SystemExit("Namespace token JSON must contain bearer_token or session_token")
else:
data = {"session_token": raw}
Path("/var/lib/forgejo-nsc/.config/ns/token.json").write_text(
json.dumps(data) + "\n",
encoding="utf-8",
)
PY
chown forgejo-nsc:forgejo-nsc /var/lib/forgejo-nsc/.config/ns/token.json
chmod 600 /var/lib/forgejo-nsc/.config/ns/token.json
'';
in
{
@ -250,6 +273,7 @@ in
services.forgejo-nsc = {
enable = true;
nscPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.nsc;
nscTokenFile = config.age.secrets.burrowForgejoNscToken.path;
dispatcher = {
configFile = config.age.secrets.burrowForgejoNscDispatcherConfig.path;
@ -260,6 +284,9 @@ in
};
};
systemd.services.forgejo-nsc-dispatcher.preStart = lib.mkAfter forgejoNscMaterializeTokenCache;
systemd.services.forgejo-nsc-autoscaler.preStart = lib.mkAfter forgejoNscMaterializeTokenCache;
services.burrow.authentik = {
enable = true;
envFile = config.age.secrets.burrowAuthentikEnv.path;