search

LnL7 / nix-darwin

nix modules for darwin
MIT License
3.19k stars 457 forks source link

github-runners: move `workDir` outside of `/run` #1018

Closed Enzime closed 3 months ago

Enzime commented 3 months ago

Turns out I messed up when testing #1013 and forgot to reboot when testing and the PR didn't actually work.

As /run gets recreated every reboot and we can't specify dependencies for launchd, creating the workDir every reboot will require extra complexity with a separate daemon that runs as root otherwise it won't have sufficient privileges.

As we clean the workDir when the service first starts anyway, it ends up being the same.

Enzime commented 3 months ago

Marking as draft until I've finished testing this properly this time :)

Enzime commented 3 months ago

Currently, changing workDir won't have any effect on existing setups that don't have ephemeral enabled.

https://github.com/LnL7/nix-darwin/blob/0413754b3cdb879ba14f6e96915e5fdf06c6aab6/modules/services/github-runner/service.nix#L128-L137

This is because the logic in NixOS that ensures runner registration is rerun if any configuration changes hasn't been ported yet:

https://github.com/NixOS/nixpkgs/blob/6d8391a3ce154bdf1870d998f187b26de8147065/nixos/modules/services/continuous-integration/github-runner/service.nix#L123-L140

My previous PR makes setting up new GitHub Runners broken as the configure script won't be run with sufficient permissions to create the work directory. This PR will fix setting up new GitHub Runners by changing the default directory and restoring the old logic of using the launchd activation script to create the folder, meaning new setups won't encounter this error.

As I'm short on time at the moment, migrating the logic to rerun runner registration on configuration changes will have to wait for another PR.

As a manual workaround, anyone with an existing setup can delete the file at /var/lib/github-runners/<name>/.runner to force runner registration, this will also require removing the runner in the GitHub UI if you have not set services.github-runners.<name>.replace = true;