mkem

.gitea/workflows/deploy.yaml

@@ -5,6 +5,9 @@ on:
 
 jobs:
   deploy:
+    container:
+      volumes:
+        - /nix/store:/var/nix/hosted-store
     permissions:
       contents: read
       id-token: write
@@ -26,7 +29,7 @@ jobs:
         with:
           extra_nix_config: |
             extra-trusted-public-keys = localhost:TiRpr2LzamX/MCKBUmFlZ8inWz94QWGL88fMEHg9Kgc=
-            substituters = http://localhost:5000
+            extra-substituters = "local?store=/var/nix/hosted-store&priority=20"
             secret-key-files = /var/secrets/cache_privkey
             post-build-hook = /etc/nix/upload-to-cache.sh
       - name: Install SSH key

hosts/thea/nix-serve.nix

@@ -1,12 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-{
-  services.nix-serve = {
-    enable = true;
-    secretKeyFile = config.age.secrets.cache-privkey.path;
-  };
-}

hosts/thea/ressources/cache/pubkey.pem

@@ -1 +0,0 @@
-localhost:TiRpr2LzamX/MCKBUmFlZ8inWz94QWGL88fMEHg9Kgc=

hosts/thea/secrets/cache-privkey.age

@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 QvCxGg uhxooXKWZwPQUJ2Dxu127JDdXC3fjcEZPHK1n1nXSHs
-8ZGyYyxHfQ2xpquGVWRaNBILDPGfxRxVWYXTTbPcmvU
--> ssh-ed25519 /uqj4A ZJjtn6qWDXjOfYm/wa9Ch87yC7Wn/xIPvfLZkNfLD1A
-oh84B629HMAX7d6kBAks/mnbwYla0gzLxZ1yTTGuYrE
--> ssh-ed25519 70Re8Q B01cYHBUptpfgjrZrEb1UO7mjFNBxYQRphMIMDmh4QQ
-KOwjzGz+DIlX0dhJyhjAG5Z6j+MERa/+tDO4FOgxnGo
---- l76GMa1frNIiNiloxdLv9HqSpMPVZYFhS5oVE10U9QI
-<EFBFBD>îá²KÍ!›*dí¾”7N¦í½›3S7×è9þ$öWšLõªa¦7¹(Ì<>áؼCå¦ç¨<C3A7>„acøíßì
-†ÝÅÞ†‹ `OŠê-òP<C3B2>áïïXf<58>:ê¯È+‰ìº½½

hosts/thea/secrets/default.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  age.secrets = {
-    cache-privkey = {
-      file = ./cache-privkey.age;
-      mode = "700";
-    };
-  };
-}

modules/gitea/thea/virtualisation.nix

@@ -24,7 +24,7 @@
           container:
             network: "host"
             valid_volumes:
-              - "/nix/store:/nix/store"
+              - "/var/nix/hosted-store"
         '';
       };
     in