✧✦Catherine✦✧
as promised, here is a repository that lets you quickly turn any random VPS into a Forgejo Actions runner in under 30 minutes, for use with Codeberg or your private forge! https://codeberg.org/whitequark/nixos-forgejo-actions-runner
it uses NixOS internally, but Nix knowledge is neither required nor assumed, and the README walks you through the entire process.
✧✦Catherine✦✧
@janl you're welcome ^^
Jan Lehnardt :couchdb:
@whitequark you’re single-handedly building the future in want. Thank you <3
✧✦Catherine✦✧
@acidbong port + 1
Acid Bong
@whitequark why foldlAttrs instead of mapAttrs?
✧✦Catherine✦✧
@acidbong it's kind of an atrocious piece of code but we were both sleep-deprived and needed to get something working at least
Acid Bong
@whitequark ah, makes sense now, cheers
✧✦Catherine✦✧
@jalict no, it runs actions in a rootless container with no access to the host podman socket
the builds are isolated, but I am just being very cautious as there have been high-profile backdoor incidents attacking GitHub Actions workflows and I don't have that much trust in the Forgejo Actions runners &c
Frans
@whitequark I _think_ the "important" note covers this, but my English is failing me: So this runs actions directly on the host agent?
✧✦Catherine✦✧
@jalict I clarified the "important" remark as well, hopefully to make it clear that there _is_ job isolation, it's just difficult to make hard promises about it
Frans
@whitequark Answers my question perfectly. Last time I setup Forgejo runner I had some odd handshake connection issues, so I had to resort to the Gitea one which felt stupid. Thank you, very useful!
✧✦Catherine✦✧
@Naich forgejo is a foss github clone with none of the bullshit
🇳𝗮ꜟ𝖼𝘩
@whitequark
I've read the main page and the FAQ, and I'm still not sure what Forgejo is or does.
✧✦Catherine✦✧
@dragonarchitect aw, thank you :)
Snaketember King Naga Calyo
@whitequark Good grief you're really cooking on all of these git-powerup projects. (This is admiration.)
✧✦Catherine✦✧
re first question: this is a bit complicated. it mostly doesn't matter what user the forgejo-runner process runs as because that's not where the sensitive parts are. the bit that _really_ matters is your exact container runtime setup (that forgejo-runner is using via a socket). my configuration takes great care to set one up in a way where what's inside can't escape, but it's very easy to configure Docker on a regular Linux install such that this isn't the case
Stylus
@whitequark It's great to see this! Many of us have plenty of compute inside our homes, enough to support our own small project CI needs, but it's easy to be intimidated by the setup process, worrying about security if we let people use the runner via pull requests, etc.
I followed some manual steps to set up a runner on a raspberry pi 5 earlier this year.
I have what are probably some very basic questions.
First, does using NixOS provide any extra isolation or security compared to just running forgejo-runner under its own Unix user in a regular Linux install?
Second, would these steps adapt to the ARM-based pi5 or is it specific to x86_64 type machines?
Semi-answering my second question, I see that pi 5 gets "community supported (unverified)" in the NixOS support matrix which is not exactly inspiring... but pi4 is YES. https://wiki.nixos.org/wiki/NixOS_on_ARM/Raspberry_Pi
✧✦Catherine✦✧
@stylus
re second question: ARM64 runners should work _but_ my configuration only runs on virtualized (QEMU, KVM, etc) hardware. it will need to be modified a fair bit to run on bare metal, since it wasn't designed to be. I actually don't use NixOS on bare metal at all so I wouldn't know offhand how to do this
✧✦Catherine✦✧
@stylus so to finish answering your first q: it does not really matter that you use NixOS (it is equally possible, with the right effort, to securely configure NixOS, Debian, Fedora, whatever) but it does matter that you use a configuration where this effort has been put into it
✧✦Catherine✦✧
@stylus podman doesn't have a privileged daemon so a host takeover through it is unlikely; I'd expect a logic bug in forgejo-runner to be a more likely source of compromise (which you can't do anything about)
Docker however does have a privileged daemon, and also there are two modes where the CI workflows are given access to a Docker control socket which are insecure in various well known ways. by not doing that you avoid that problem
Stylus
@whitequark sounds like what I need is an understanding of how to secure podman properly, then.
doty
@whitequark This is so great, thanks! The idea of putting my forgejo token into a configuration file is very scary to me…. I haven’t looked at the implementation but is there a way it could come from somewhere a little more secure? (I would want to commit my configuration file, but the chances of me then leaking my forgejo token at some point become 100%)
✧✦Catherine✦✧
@doty consider this: forgejo will show the token to anybody who can open the web interface, so if you put the configuration into a private repo on the same forgejo instance, then you need the same privileges to view either
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.