1{lib, ...}: {
 2  den.aspects.services.provides.woodpecker.provides.agent = {
 3    name,
 4    server,
 5    tokenFileAged,
 6    labels ? {},
 7    extraEnv ? {},
 8  }: let
 9    mapLabels = lib.concatMapAttrsStringSep "," (n: v: "${n}=${v}");
10  in {
11    nixos = {config, ...}: {
12      services.woodpecker-agents.agents.${name} = {
13        enable = true;
14        extraGroups = ["podman"];
15        environment =
16          {
17            WOODPECKER_AGENT_LABELS = mapLabels labels;
18            WOODPECKER_SERVER = server;
19            WOODPECKER_GRPC_SECURE = "true";
20            WOODPECKER_AGENT_SECRET_FILE = config.vaultix.secrets."woodpecker-agent-${name}-token".path;
21            WOODPECKER_MAX_WORKFLOWS = "4";
22            DOCKER_HOST = "unix:///run/podman/podman.sock";
23            WOODPECKER_BACKEND = "docker";
24            WOODPECKER_BACKEND_DOCKER_ENABLE_IPV6 = "true";
25          }
26          // extraEnv;
27      };
28
29      systemd.services."woodpecker-agent-${name}".serviceConfig = {
30        DynamicUser = lib.mkForce false;
31        User = "woodpecker-agent-${name}";
32        Group = "woodpecker-agent-${name}";
33      };
34
35      users.users."woodpecker-agent-${name}" = {
36        isSystemUser = true;
37        useDefaultShell = true;
38        group = "woodpecker-agent-${name}";
39      };
40      users.groups."woodpecker-agent-${name}" = {};
41
42      vaultix.secrets."woodpecker-agent-${name}-token" = {
43        file = tokenFileAged;
44        owner = "root";
45        group = "woodpecker-agent-${name}";
46        mode = "0440";
47      };
48    };
49  };
50}