nixos_config/hosts/tesla-nixos/configuration.nix

{ config, pkgs, lib, ... }:

{
  security.sudo.wheelNeedsPassword = false;
  imports =
    [ ./hardware-configuration.nix ];
  networking.hostName = "tesla-nixos";
  boot.initrd.enable = true;
  boot.loader = {
    systemd-boot = {
      enable = true;
    }; # end loader.systemd-boot
  }; # end boot
  virtualisation.oci-containers.containers = {
    isponsorblocktv = {
      image = "ghcr.io/dmunozv04/isponsorblocktv:latest";
      autoStart = true;
      volumes = [
        "/home/alisceon/isponsorblocktv:/app/data"
      ];
    }; # end isponsorblocktv
  };
  
  boot.kernel.sysctl = {
    "kernel.unprivileged_userns_clone" = 1;
  };

  systemd.tmpfiles.rules = [
    "d /var/lib/gitlab-runner          0755 root root -"
    "d /var/lib/gitlab-runner/builds   0755 root root -"
    "d /var/lib/gitlab-runner/cache    0755 root root -"
  ];

  networking.nat = {
    enable = true;
    internalInterfaces = ["ve-+"];
    externalInterface = "ens18";
  };
  environment.systemPackages = with pkgs; [
    fuse-overlayfs
  ];

  containers.gitlab-runner = {
    autoStart = true;
    ephemeral = false;

    privateNetwork = true;
    privateUsers = "identity";
    hostAddress  = "10.250.0.1";
    localAddress = "10.250.0.2";

    extraFlags = [
      "--system-call-filter=@keyring"
      "--system-call-filter=bpf"
    ];
    bindMounts = {
      "/var/lib/gitlab-runner" = {
        hostPath = "/var/lib/gitlab-runner";
        isReadOnly = false;
      };
      "/proc" = {
        hostPath = "/run/proc";
      };
      "/sys" = {
        hostPath = "/run/sys";
      };
      "/dev/fuse" = {
        hostPath = "/dev/fuse";
      };
    };
    allowedDevices = [
      {
        path = "/dev/fuse";
        access = "rwm";
      }
    ];

    # Guest (inside the nspawn container)
    config = { pkgs, lib, ... }: {
      networking.hostName = "ci-nspawn";
      networking.useHostResolvConf = true;
      time.timeZone = "UTC";
      # Docker daemon inside the container
      virtualisation.docker = {
        enable = true;
        autoPrune = {
          enable = true;
          dates = "daily";
        };
        daemon.settings = {
          "runtimes" = {
            crun = { path = "${pkgs.crun}/bin/crun"; };
          };
          "default-runtime" = "crun";
        };
      };

      users.users.gitlab-runner = {
        isSystemUser = true;
        home = "/var/lib/gitlab-runner";
        createHome = true;
        shell = pkgs.bashInteractive;
        extraGroups = [ "docker" "wheel" ];
        group = "gitlab-runner";
      };
      users.groups.gitlab-runner = { };
      users.groups.docker = { };
      environment.systemPackages = with pkgs; [
        docker
        git
        crun
        fuse-overlayfs
      ];
      systemd.services."enable-linger-gitlab-runner" = {
        description = "Enable linger for gitlab-runner";
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
          Type = "oneshot";
          ExecStart = "${pkgs.systemd}/bin/loginctl enable-linger gitlab-runner";
          RemainAfterExit = true;
        };
      };

      # GitLab Runner configured to use the local Docker daemon
      services.gitlab-runner = {
        enable = true;
        services = {
          ci-nspawn-docker = {
            authenticationTokenConfigFile = "/var/lib/gitlab-runner/token-env";

            executor = "docker";
            dockerImage = "alpine:3";
            dockerPrivileged = true;
            dockerVolumes = [
              "/var/lib/gitlab-runner/cache:/cache"
            ];
          };
        };
      };
      systemd.services.gitlab-runner.serviceConfig = {
        StateDirectory = lib.mkForce "";
        LogsDirectory  = lib.mkForce "";
        CacheDirectory = lib.mkForce "";
        RuntimeDirectory = lib.mkForce "";
        ProtectSystem = lib.mkForce "no";
        ProtectHome   = lib.mkForce "no";
        ReadWritePaths = [ "/var/lib/gitlab-runner" ];
      };
      # Basics
      systemd.oomd.enable = false;
      services.dbus.enable = true;
    };
  }; # end containers.gitlab-runner

} # end file