nixos/forgejo.runner: assert on long usernames and expose option for user name

Author: adamcstephens

nixos/modules/services/continuous-integration/forgejo-runner.nix

@@ -92,7 +92,7 @@ in
       '';
       type = attrsOf (
         submodule (
-          { name, ... }:
+          { config, name, ... }:
           {
             options = {
               labels = labelsOption;
@@ -109,6 +109,13 @@ in
 
               url = urlOption;
 
+              user = mkOption {
+                type = types.str;
+                description = "The dynamic username of the runner service.";
+                default = "runner-${escapeSystemdPath config.name}";
+                defaultText = literalExpression "runner-\${escapeSystemdPath config.name}";
+              };
+
               registrationTokenFile = mkOption {
                 type = types.nullOr (types.either types.str types.path);
                 default = null;
@@ -233,6 +240,9 @@ in
   config = mkIf (cfg.instances != { }) {
     assertions = lib.foldlAttrs (
       acc_inst: _: instance:
+      let
+        userNameLength = builtins.stringLength instance.user;
+      in
       (lib.foldlAttrs (
         acc_conn: name: connection:
         acc_conn
@@ -270,6 +280,10 @@ in
           assertion = hasDockerScheme (instanceLabels instance) -> hasDocker || hasPodman;
           message = "forgejo.runner.instances.${instance.name} label configuration requires either docker or podman.";
         }
+        {
+          assertion = userNameLength <= 31;
+          message = ''forgejo.runner.instances.${instance.name}.user = "${instance.user}" has a length of ${toString userNameLength} which exceeds 31 character limit from systemd+glibc. Shorten instance name or explicitly define `instances.<name>.user`.'';
+        }
       ]
     ) [ ] cfg.instances;
 
@@ -308,6 +322,7 @@ in
             path = [ pkgs.coreutils ] ++ lib.optionals wantsHost instance.hostPackages;
 
             serviceConfig = {
+              User = instance.user;
               MemoryDenyWriteExecute = !wantsHost;
 
               LoadCredential =
@@ -365,7 +380,6 @@ in
 
           serviceConfig = {
             DynamicUser = true;
-            User = "forgejo-runner-%i";
             StateDirectory = "forgejo-runner/%i";
             WorkingDirectory = "/var/lib/forgejo-runner/%i";
 

nixos/tests/forgejo.nix

@@ -63,16 +63,22 @@ let
             specialisation = {
               runner = {
                 inheritParentConfig = true;
-                configuration.services.forgejo.runner = {
-                  package = pkgs.forgejo-runner;
-                  instances."test" = {
-                    enable = true;
-                    url = "http://localhost:3000";
-                    labels = [
-                      # type ":host" does not depend on docker/podman/lxc
-                      "native:host"
-                    ];
-                    registrationTokenFile = "/var/lib/forgejo/runner_token";
+                configuration = {
+                  services.forgejo.runner = {
+                    package = pkgs.forgejo-runner;
+
+                    instances = {
+                      legacyRegistration = {
+                        enable = true;
+                        user = "runner-legacy";
+                        url = "http://localhost:3000";
+                        labels = [
+                          # type ":host" does not depend on docker/podman/lxc
+                          "native:host"
+                        ];
+                        registrationTokenFile = "/var/lib/forgejo/runner_token";
+                      };
+                    };
                   };
                 };
               };
@@ -81,7 +87,7 @@ let
                 inheritParentConfig = true;
                 configuration.services.gitea-actions-runner = {
                   package = pkgs.forgejo-runner;
-                  instances."test" = {
+                  instances.test = {
                     enable = true;
                     name = "ci";
                     url = "http://localhost:3000";
@@ -269,8 +275,8 @@ let
               )
 
               server.succeed("${serverSystem}/specialisation/runner/bin/switch-to-configuration test")
-              server.wait_for_unit("forgejo-runner@test.service")
-              server.succeed("journalctl -o cat -u forgejo-runner@test.service | grep -q 'Runner registered successfully'")
+              server.wait_for_unit("forgejo-runner@legacyRegistration.service")
+              server.succeed("journalctl -o cat -u forgejo-runner@legacyRegistration.service | grep -q 'Runner registered successfully'")
 
               # enable actions feature for this repository, defaults to disabled
               server.succeed(