yisroelbaum.com web stack

This flake owns the production NixOS configuration for the web services under yisroelbaum.com:

• the MyResume package at yisroelbaum.com;
• Jellyfin at jellyfin.yisroelbaum.com;
• Forgejo at git.yisroelbaum.com, including its Borg backup;
• nginx and per-host ACME certificates for those endpoints.

The importing host remains responsible for provisioning secrets. Import nixosModules.yisroelbaum-web or nixosModules.default, then pass the resulting runtime paths:

services.yisroelbaum-web = {
  enable = true;
  secretFiles = {
    borgPassphrase = "/run/secrets/borg-passphrase";
    borgPrivateKey = "/run/secrets/borg-private-key";
    forgejoMailerUser = "/run/secrets/forgejo-mailer-user";
    forgejoMailerPassword = "/run/secrets/forgejo-mailer-password";
  };
};

Run the checks with:

nix flake check

Forgejo Actions runner

The optional runner runs on the Forgejo host and executes jobs in Docker containers. Enable it in the importing host configuration:

services.yisroelbaum-web.actionsRunner = {
  enable = true;
  uuid = "UUID-OF-EXISTING-RUNNER";
  authenticationTokenFile = "/run/secrets/forgejo-runner-auth-token";
};

Provision the runner authentication token with the host secret manager. The UUID is ordinary configuration; the token must remain outside the Nix store. The native NixOS module supplies the file through systemd credentials. The service is named forgejo-runner-home.service.

For an existing runner, securely import the uuid and token fields from /var/lib/gitea-runner/home/.runner. Encrypt the token with SOPS, configure the UUID above, and pass the decrypted secret path. Use a root-owned secret with mode 0400 and restartUnits = [ "forgejo-runner-home.service" ]. Remove the obsolete registration-token environment template and declaration. Do not print the token or place it in command arguments or plaintext files.

The old tokenFile and registrationFile options have been removed. The runner no longer reads the old registration file. Retain that file during migration so the previous NixOS generation remains usable for rollback.

Publish this module revision, update the importing host's yisroelbaum-web flake input, and rebuild. The host must use nixpkgs with the services.forgejo-runner module. No runner configuration needs to be copied into the host repository.

Job environment

Use runs-on: linux. The home-server runner supplies a digest-pinned node:24-bookworm image with Bash, Git, and Node. It runs one job at a time with a one-hour timeout. Job containers are limited to 2 CPUs, 768 MiB RAM, no additional swap, and 512 processes. These are per-container limits, not an aggregate limit for workflows with multiple service containers; start with trusted, single-container jobs on this shared host.

Jobs use their own Docker network, without privileged mode, host bind mounts, or the Docker socket. The runner service itself can manage Docker and must be treated as trusted. Actions caching is disabled. Nix toolchains, Docker image builds, and deployment credentials are not configured by this initial setup. Larger builds may need a higher memory limit after checking the host's available RAM.

Verification and maintenance

Enable Actions in the repository's Settings → Units → Overview. Confirm home-server is online in Settings → Actions → Runners. Project workflows can use it by setting runs-on: linux.

On the host:

sudo systemctl status forgejo-runner-home.service
sudo journalctl -u forgejo-runner-home.service -n 100 --no-pager
sudo docker stats --no-stream
sudo docker system df

Use sudo docker inspect <job-container> during a job to verify its memory/CPU/process limits and mounts. After a service restart, verify that the same runner registration comes back online and a project workflow still succeeds. Check Forgejo, the website, and Jellyfin while a job runs.

Docker retains downloaded images. Inspect disk usage periodically; while no jobs are running, sudo docker image prune removes dangling images. Avoid pruning volumes containing other services' data. Update the pinned image digest deliberately and verify a project workflow after updates.

To pause work immediately, stop forgejo-runner-home.service. To disable it persistently, set actionsRunner.enable = false and rebuild. This preserves the provisioned credentials. Deleting a runner in Forgejo revokes its credentials. To replace a registration, provision the replacement UUID and authentication token through the host secret manager and update uuid, then restart the service. Drain running jobs before maintenance; shutdown allows 30 seconds before cancellation.

First deployment

This repository is hosted by the Forgejo instance that it configures. For the initial migration, publish and push this flake while the old host configuration is still active. Only then add the remote flake input to the host configuration and update its lock file.