build: update flake.lock

.nixd.nix

@@ -1,12 +0,0 @@
-{
-  formatting = {
-    command = "nixpkgs-fmt";
-  };
-  options = {
-    enable = true;
-    target = {
-      args = [];
-      installable = ".#nixosConfigurations.luna.options";
-    };
-  };
-}

README.org

@@ -1,2 +0,0 @@
-* TODO Luna
-- [X] Get a Gitea actions runner up for the new git server

flake.lock

@@ -140,11 +140,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1710427903,
-        "narHash": "sha256-sV0Q5ndvfjK9JfCg/QM/HX/fcittohvtq8dD62isxdM=",
+        "lastModified": 1710724748,
+        "narHash": "sha256-aXlifKr6Brg0SBUBgRNEBaZf3JLUeGhM9BX2gam+vvo=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "21d89b333ca300bef82c928c856d48b94a9f997c",
+        "rev": "c09c3a9639690f94ddff44c3dd25c85602e5aeb2",
         "type": "github"
       },
       "original": {
@@ -172,15 +172,15 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1687265871,
-        "narHash": "sha256-P8AOiQk/XN8/ia4289hDHlTfWB70cRQ5pc9GRfmEdpc=",
-        "owner": "inclyc",
+        "lastModified": 1673956053,
+        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "70e56389c58bbd300d11778913b255477ebbae22",
+        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
         "type": "github"
       },
       "original": {
-        "owner": "inclyc",
+        "owner": "edolstra",
         "repo": "flake-compat",
         "type": "github"
       }
@@ -276,6 +276,43 @@
         "type": "github"
       }
     },
+    "libgit2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1697646580,
+        "narHash": "sha256-oX4Z3S9WtJlwvj0uH9HlYcWv+x1hqp8mhXl7HsLu2f0=",
+        "owner": "libgit2",
+        "repo": "libgit2",
+        "rev": "45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "libgit2",
+        "repo": "libgit2",
+        "type": "github"
+      }
+    },
+    "nix": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "libgit2": "libgit2",
+        "nixpkgs": "nixpkgs_2",
+        "nixpkgs-regression": "nixpkgs-regression"
+      },
+      "locked": {
+        "lastModified": 1710838759,
+        "narHash": "sha256-lj3fizmDukI4vDo9xMwQ6WI1GaOkluDPcfwglG7tPUk=",
+        "owner": "nixos",
+        "repo": "nix",
+        "rev": "7c506432abab84d79744f4454aa20fe0a458e0fb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1702272962,
@@ -292,13 +329,45 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs-regression": {
       "locked": {
-        "lastModified": 1710451336,
-        "narHash": "sha256-pP86Pcfu3BrAvRO7R64x7hs+GaQrjFes+mEPowCfkxY=",
+        "lastModified": 1643052045,
+        "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d691274a972b3165335d261cc4671335f5c67de9",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1709083642,
+        "narHash": "sha256-7kkJQd4rZ+vFrzWu8sTRtta5D1kBG0LSRYAfhtmMlSo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b550fe4b4776908ac2a861124307045f8e717c8e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "release-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1710806803,
+        "narHash": "sha256-qrxvLS888pNJFwJdK+hf1wpRCSQcqA6W5+Ox202NDa0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b06025f1533a1e07b6db3e75151caa155d1c7eb3",
         "type": "github"
       },
       "original": {
@@ -314,10 +383,10 @@
         "blog": "blog",
         "deploy-rs": "deploy-rs",
         "disko": "disko",
-        "flake-compat": "flake-compat_2",
         "flake-utils": "flake-utils_3",
         "impermanence": "impermanence",
-        "nixpkgs": "nixpkgs_2"
+        "nix": "nix",
+        "nixpkgs": "nixpkgs_3"
       }
     },
     "rust-overlay": {

flake.nix

@@ -2,6 +2,7 @@
   description = "Price Hiller's flake for managing system configurations";
 
   inputs = {
+    nix.url = "github:nixos/nix";
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     flake-utils.url = "github:numtide/flake-utils";
     deploy-rs.url = "github:serokell/deploy-rs";
@@ -14,11 +15,6 @@
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # For the nixd language server
-    flake-compat = {
-      url = "github:inclyc/flake-compat";
-      flake = false;
-    };
     blog = {
       url = "git+https://git.orion-technologies.io/blog/blog";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -143,7 +139,6 @@
           ];
           shellHook = ''
             export RULES="$PWD/secrets/secrets.nix"
-            nix eval --json --file ./.nixd.nix > .nixd.json
           '';
         };
       });

hosts/luna/modules/docker/default.nix

@@ -6,9 +6,12 @@
     containers.enable = true;
     docker = {
       enable = true;
-      rootless.enable = true;
+      rootless = {
+        enable = true;
+        setSocketVariable = true;
+      };
       autoPrune.enable = true;
       package = pkgs.docker;
     };
   };
-}
+}

hosts/luna/modules/monitoring/auditd.nix

@@ -11,6 +11,8 @@ in {
     };
     auditd.enable = true;
   };
+  # Ensure the wrapped laurel service is available in time for auditd
+  systemd.services.suid-sgid-wrappers.before = [ "auditd.service" ];
   users.groups."${laurel-user}" = { };
   users.users."${laurel-user}" = {
     isSystemUser = true;

hosts/luna/modules/services/gitea.nix

@@ -1,6 +1,52 @@
-{ config, fqdn, ... }:
-let gitea_host = "git.${fqdn}";
+{ config, fqdn, inputs, pkgs, ... }:
+let
+  gitea_host = "git.${fqdn}";
+  # TODO: Move this docker image out to a separate package and NixOS Module
+  # Huge thank you to https://icewind.nl/entry/gitea-actions-nix/ -- wouldn't have figured this out
+  # without that post 🙂
+  base = import (inputs.nix + "/docker.nix") {
+    inherit pkgs;
+    name = "nix-ci-base";
+    maxLayers = 10;
+    extraPkgs = with pkgs; [ nodejs_20 bash ];
+    nixConf = {
+      substituters = [
+        "https://cache.nixos.org/"
+        "https://nix-community.cachix.org"
+        # insert any other binary caches here
+      ];
+      trusted-public-keys = [
+        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        # insert the public keys for those binary caches here
+      ];
+      # allow using the new flake commands in our workflows
+      experimental-features = [ "nix-command" "flakes" ];
+    };
+  };
+  runner = pkgs.dockerTools.buildImage {
+    name = "nix-runner";
+    tag = "latest";
+
+    fromImage = base;
+    fromImageName = null;
+    fromImageTag = "latest";
+
+    copyToRoot = pkgs.buildEnv {
+      name = "image-root";
+      paths = [ pkgs.coreutils-full ];
+      pathsToLink = [ "/bin" ]; # add coreutuls (which includes sleep) to /bin
+    };
+  };
 in {
+  virtualisation.oci-containers.containers = {
+    "nix-runner" = {
+      image = "nix-runner:latest";
+      imageFile = runner;
+      autoStart = false;
+    };
+  };
+
   age.secrets.gitea-db-pass = {
     owner = config.services.gitea.user;
     group = config.services.gitea.group;
@@ -61,7 +107,7 @@ in {
         name = "Default";
         settings = { runner.capacity = 8; };
         labels = [
-          "default:docker://nixos/nix:latest"
+          "default:docker://nix-runner:latest"
           "alpine:docker://alpine:latest"
           "debian:docker://debian:latest"
         ];