updating some stuff, trying to get woodpecker, and grafana alerts off

the ground

hosts/profiles/woodpecker-agent/default.nix

@@ -0,0 +1,65 @@
+{
+
+  users.users.woodpecker-runner = {
+    isSystemUser = true;
+    group = "woodpecker-runner";
+  };
+  users.groups.woodpecker-runner = { };
+  # Allow the exec runner to write to build with nix
+  nix.allowedUsers = [ "woodpecker-runner" ];
+
+  systemd.services.woodpecker-runner-exec = {
+    enable = true;
+    wantedBy = [ "multi-user.target" ];
+    ### MANUALLY RESTART SERVICE IF CHANGED
+    restartIfChanged = true;
+    confinement.enable = true;
+    confinement.packages = [
+      pkgs.git
+      pkgs.gnutar
+      pkgs.bash
+      pkgs.nixFlakes
+      pkgs.gzip
+    ];
+    path = [
+      pkgs.git
+      pkgs.gnutar
+      pkgs.bash
+      pkgs.nixFlakes
+      pkgs.gzip
+    ];
+    serviceConfig = {
+      Environment = [
+        "WOODPECKER_RUNNER_CAPACITY=2"
+        "WOODPECKER_RUNNER_NAME=woodpecker-agent"
+        "NIX_REMOTE=daemon"
+        "PAGER=cat"
+      ];
+      BindPaths = [
+        "/nix/var/nix/daemon-socket/socket"
+        "/run/nscd/socket"
+        # "/var/lib/woodpecker"
+      ];
+      BindReadOnlyPaths = [
+        "/etc/passwd:/etc/passwd"
+        "/etc/group:/etc/group"
+        "/nix/var/nix/profiles/system/etc/nix:/etc/nix"
+        "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
+        "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
+        "${builtins.toFile "ssh_config" ''
+          Host git.sealight.xyz
+          ForwardAgent yes
+        ''}:/etc/ssh/ssh_config"
+        "/etc/machine-id"
+        "/etc/resolv.conf"
+        "/nix/"
+      ];
+      EnvironmentFile = [
+        # /run/agenix/woodpecker-agent-secret
+      ];
+      ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent";
+      User = "woodpecker-runner";
+      Group = "woodpecker-runner";
+    };
+  };
+}