nixos/forgejo.runner: remove systemd escaping, assert on username length

Author: adamcstephens

nixos/modules/services/continuous-integration/forgejo-runner.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  utils,
   ...
 }:
 
@@ -26,10 +25,6 @@ let
     types
     ;
 
-  inherit (utils)
-    escapeSystemdPath
-    ;
-
   cfg = config.services.forgejo.runner;
 
   settingsFormat = pkgs.formats.yaml { };
@@ -92,7 +87,7 @@ in
       '';
       type = attrsOf (
         submodule (
-          { name, ... }:
+          { config, name, ... }:
           {
             options = {
               labels = labelsOption;
@@ -109,6 +104,13 @@ in
 
               url = urlOption;
 
+              user = mkOption {
+                type = types.str;
+                description = "The dynamic username of the runner service.";
+                default = "forgejo-runner-${config.name}";
+                defaultText = literalExpression "forgejo-runner-\${name}";
+              };
+
               registrationTokenFile = mkOption {
                 type = types.nullOr (types.either types.str types.path);
                 default = null;
@@ -233,6 +235,9 @@ in
   config = mkIf (cfg.instances != { }) {
     assertions = lib.foldlAttrs (
       acc_inst: _: instance:
+      let
+        userNameLength = builtins.stringLength instance.user;
+      in
       (lib.foldlAttrs (
         acc_conn: name: connection:
         acc_conn
@@ -270,6 +275,10 @@ in
           assertion = hasDockerScheme (instanceLabels instance) -> hasDocker || hasPodman;
           message = "forgejo.runner.instances.${instance.name} label configuration requires either docker or podman.";
         }
+        {
+          assertion = userNameLength <= 31;
+          message = ''forgejo.runner.instances.${instance.name}.user = "${instance.user}" has a length of ${toString userNameLength} which exceeds 31 character limit from systemd+glibc. Shorten instance name or explicitly define `instances.<name>.user`.'';
+        }
       ]
     ) [ ] cfg.instances;
 
@@ -279,14 +288,13 @@ in
           _: instance:
           let
             allLabels = instanceLabels instance;
-            escapedName = escapeSystemdPath instance.name;
             wantsContainer = hasDockerScheme allLabels;
             wantsHost = hasHostScheme allLabels;
             wantsDocker = wantsContainer && hasDocker;
             wantsPodman = wantsContainer && hasPodman;
-            configFile = settingsFormat.generate "forgejo-runner-${escapedName}.yaml" instance.settings;
+            configFile = settingsFormat.generate "forgejo-runner-${instance.name}.yaml" instance.settings;
           in
-          nameValuePair "forgejo-runner@${escapedName}" {
+          nameValuePair "forgejo-runner@${instance.name}" {
             overrideStrategy = "asDropin";
             inherit (instance) enable;
             wants = [
@@ -308,6 +316,7 @@ in
             path = [ pkgs.coreutils ] ++ lib.optionals wantsHost instance.hostPackages;
 
             serviceConfig = {
+              User = instance.user;
               MemoryDenyWriteExecute = !wantsHost;
 
               LoadCredential =
@@ -317,12 +326,12 @@ in
                 ++ lib.mapAttrsToList (name: value: "${name}:${value}") instance.credentials;
 
               SupplementaryGroups = optionals wantsDocker [ "docker" ] ++ optionals wantsPodman [ "podman" ];
-              ExecPaths = lib.optionals wantsHost [ "/var/lib/forgejo-runner/${escapedName}" ];
+              ExecPaths = lib.optionals wantsHost [ "/var/lib/forgejo-runner/${instance.name}" ];
 
               ExecStartPre = lib.optionals (instance.registrationTokenFile != null) [
                 (lib.getExe (
                   pkgs.writeShellApplication {
-                    name = "forgejo-register-runner-${escapedName}";
+                    name = "forgejo-register-runner-${instance.name}";
                     text = ''
                       INSTANCE_DIR="$STATE_DIRECTORY"
                       mkdir -vp "$INSTANCE_DIR"

nixos/tests/forgejo.nix

@@ -63,16 +63,22 @@ let
             specialisation = {
               runner = {
                 inheritParentConfig = true;
-                configuration.services.forgejo.runner = {
-                  package = pkgs.forgejo-runner;
-                  instances."test" = {
-                    enable = true;
-                    url = "http://localhost:3000";
-                    labels = [
-                      # type ":host" does not depend on docker/podman/lxc
-                      "native:host"
-                    ];
-                    registrationTokenFile = "/var/lib/forgejo/runner_token";
+                configuration = {
+                  services.forgejo.runner = {
+                    package = pkgs.forgejo-runner;
+
+                    instances = {
+                      legacy-registration = {
+                        enable = true;
+                        url = "http://localhost:3000";
+                        user = "runner-legacy";
+                        labels = [
+                          # type ":host" does not depend on docker/podman/lxc
+                          "native:host"
+                        ];
+                        registrationTokenFile = "/var/lib/forgejo/runner_token";
+                      };
+                    };
                   };
                 };
               };
@@ -81,7 +87,7 @@ let
                 inheritParentConfig = true;
                 configuration.services.gitea-actions-runner = {
                   package = pkgs.forgejo-runner;
-                  instances."test" = {
+                  instances.test = {
                     enable = true;
                     name = "ci";
                     url = "http://localhost:3000";
@@ -269,8 +275,8 @@ let
               )
 
               server.succeed("${serverSystem}/specialisation/runner/bin/switch-to-configuration test")
-              server.wait_for_unit("forgejo-runner@test.service")
-              server.succeed("journalctl -o cat -u forgejo-runner@test.service | grep -q 'Runner registered successfully'")
+              server.wait_for_unit("forgejo-runner@legacy-registration.service", timeout=10)
+              server.succeed("journalctl -o cat -u forgejo-runner@legacy-registration.service | grep -q 'Runner registered successfully'")
 
               # enable actions feature for this repository, defaults to disabled
               server.succeed(