Commit 0929d8a

@@ -0,0 +1,21 @@
+{den, ...}: {
+  den.hosts.mobius = {
+    settings = {
+      services.woodpecker.agent.agents = {
+        codeberg = {
+          server = "grpc.ci.codeberg.org:443";
+          secretFileAged = ./woodpecker-agent-codeberg-token.age;
+          labels = {
+            tier = "high";
+          };
+        };
+      };
+    };
+  };
+
+  den.aspects.mobius = {
+    includes = with den.aspects; [
+      services.woodpecker.agent
+    ];
+  };
+}

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> piv-p256 xCEwtQ AnpdkWZgSL4YLHSoJAiDJQaeSHX6REnq0IwXDMBfey0b
+61n7uI4SwtXyxIYZK/GGi8JYRiURE9ZHh3pBOiikp+U
+-> g-grease "`,0l5~ wjtC ,]
+eZZBTNbycgKyOvMYtmSzQbWwm++b0eVwhGdARIWlIYdA8dkb7w
+--- zNm68hH2goG1Fp24hlt1CL0wAUwSJU+AuiZBSF4Xn5I
+�	?�'6�c:������C����

+#a@Ͳ���Vo&��J]��%'6|J��jY!��}o�yf��]�H� ��\7!�q�d�PAS���[�
\ No newline at end of file

@@ -0,0 +1,83 @@
+{
+  den,
+  lib,
+  ...
+}: {
+  den.aspects.services.woodpecker.agent = {
+    includes = [den.aspects.services.podman];
+    settings = {
+      agents = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.submodule {
+          options = {
+            server = lib.mkOption {
+              type = lib.types.str;
+            };
+            secretFileAged = lib.mkOption {
+              type = lib.types.path;
+            };
+            labels = lib.mkOption {
+              type = lib.types.attrsOf lib.types.str;
+              default = {};
+            };
+            extraEnvironments = lib.mkOption {
+              type = lib.types.attrsOf lib.types.str;
+              default = {};
+            };
+          };
+        });
+        default = {};
+      };
+    };
+
+    nixos = {
+      host,
+      config,
+      ...
+    }: let
+      cfg = host.settings.services.woodpecker.agent;
+      mapLabels = lib.concatMapAttrsStringSep "," (n: v: "${n}=${v}");
+      mkSecretName = name: "woodpecker-agent-${name}-token";
+    in
+      lib.mkMerge (
+        lib.mapAttrsToList (name: agent: {
+          services.woodpecker-agents.agents.${name} = {
+            enable = true;
+            extraGroups = ["podman"];
+            environment =
+              {
+                WOODPECKER_AGENT_LABELS = mapLabels agent.labels;
+                WOODPECKER_SERVER = agent.server;
+                WOODPECKER_AGENT_SECRET_FILE = config.vaultix.secrets.${mkSecretName name}.path;
+                WOODPECKER_GRPC_SECURE = "true";
+                WOODPECKER_MAX_WORKFLOWS = "4";
+                DOCKER_HOST = "unix:///run/podman/podman.sock";
+                WOODPECKER_BACKEND = "docker";
+                WOODPECKER_BACKEND_DOCKER_ENABLE_IPV6 = "true";
+              }
+              // agent.extraEnvironments;
+          };
+
+          systemd.services."woodpecker-agent-${name}".serviceConfig = {
+            DynamicUser = lib.mkForce false;
+            User = "woodpecker-agent-${name}";
+            Group = "woodpecker-agent-${name}";
+          };
+
+          users.users."woodpecker-agent-${name}" = {
+            isSystemUser = true;
+            useDefaultShell = true;
+            group = "woodpecker-agent-${name}";
+          };
+          users.groups."woodpecker-agent-${name}" = {};
+
+          vaultix.secrets.${mkSecretName name} = {
+            file = agent.secretFileAged;
+            owner = "root";
+            group = "woodpecker-agent-${name}";
+            mode = "0440";
+          };
+        })
+        cfg.agents
+      );
+  };
+}

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 qzANJQ FSIai4elfnUk2BaN+lRLVSsGUvVLRTIEDAXm7/UkxF0
+7u6TnCvamSConX+jLk+9VB2qaxs9M8JkASCtQqgCtVs
+-> #`kFe2-grease YU5{Y- k 7OOJ
+l59u7OrgJlfDpstiNOmcu9KDs5EwTbW7TXdk9Ok
+--- YRR1WO+nDU62D3Dcb/1vn6hT3KOc75jx5w1G5Y3btCI
+�fK��׈�_�8&��?
#���i��ꘚ
Z��.�qellME�m�O��c<�]5�RfGհa�9�⾡��@���~ۈ�n6��
\ No newline at end of file