1{
 2  den,
 3  lib,
 4  ...
 5}: {
 6  den.aspects.services.woodpecker.agent = {
 7    includes = [den.aspects.services.podman];
 8    settings = {
 9      agents = lib.mkOption {
10        type = lib.types.attrsOf (lib.types.submodule {
11          options = {
12            server = lib.mkOption {
13              type = lib.types.str;
14            };
15            secretFileAged = lib.mkOption {
16              type = lib.types.path;
17            };
18            labels = lib.mkOption {
19              type = lib.types.attrsOf lib.types.str;
20              default = {};
21            };
22            extraEnvironments = lib.mkOption {
23              type = lib.types.attrsOf lib.types.str;
24              default = {};
25            };
26          };
27        });
28        default = {};
29      };
30    };
31
32    nixos = {
33      host,
34      config,
35      ...
36    }: let
37      cfg = host.settings.services.woodpecker.agent;
38      mapLabels = lib.concatMapAttrsStringSep "," (n: v: "${n}=${v}");
39      mkSecretName = name: "woodpecker-agent-${name}-token";
40    in
41      lib.mkMerge (
42        lib.mapAttrsToList (name: agent: {
43          services.woodpecker-agents.agents.${name} = {
44            enable = true;
45            extraGroups = ["podman"];
46            environment =
47              {
48                WOODPECKER_AGENT_LABELS = mapLabels agent.labels;
49                WOODPECKER_SERVER = agent.server;
50                WOODPECKER_AGENT_SECRET_FILE = config.vaultix.secrets.${mkSecretName name}.path;
51                WOODPECKER_GRPC_SECURE = "true";
52                WOODPECKER_MAX_WORKFLOWS = "4";
53                DOCKER_HOST = "unix:///run/podman/podman.sock";
54                WOODPECKER_BACKEND = "docker";
55                WOODPECKER_BACKEND_DOCKER_ENABLE_IPV6 = "true";
56              }
57              // agent.extraEnvironments;
58          };
59
60          systemd.services."woodpecker-agent-${name}".serviceConfig = {
61            DynamicUser = lib.mkForce false;
62            User = "woodpecker-agent-${name}";
63            Group = "woodpecker-agent-${name}";
64          };
65
66          users.users."woodpecker-agent-${name}" = {
67            isSystemUser = true;
68            useDefaultShell = true;
69            group = "woodpecker-agent-${name}";
70          };
71          users.groups."woodpecker-agent-${name}" = {};
72
73          vaultix.secrets.${mkSecretName name} = {
74            file = agent.secretFileAged;
75            owner = "root";
76            group = "woodpecker-agent-${name}";
77            mode = "0440";
78          };
79        })
80        cfg.agents
81      );
82  };
83}