From 702f93f891bce4ee1d76f5b46ca81e90efbb58dc Mon Sep 17 00:00:00 2001
From: yukkop <hectic.yukkop@gmail.com>
Date: Tue, 8 Sep 2026 23:33:08 +0000
Subject: [PATCH] fix: microOS

---
 devshell/gitea-runners.nix                |  7 ++++++-
 nixos/system/hectic-lab/hectic-lab.nix    |  2 +-
 package/gitea-runner-controller/hcloud.sh | 23 ++++++++++++++++-------
 3 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/devshell/gitea-runners.nix b/devshell/gitea-runners.nix
index 514189cb..8179ed26 100644
--- a/devshell/gitea-runners.nix
+++ b/devshell/gitea-runners.nix
@@ -104,7 +104,12 @@
      fi
    done
    test -n "$root_device"
-   mount -o subvol=@ "$root_device" /mnt
+   mount -o subvolid=5,rw "$root_device" /mnt
+   default_subvolume="$(btrfs subvolume get-default /mnt | awk 'NR == 1 { print $2 }')"
+   umount /mnt
+   mount -o subvolid="$default_subvolume",rw "$root_device" /mnt
+   btrfs property set -ts /mnt ro false || true
+   install -d -m 0755 /mnt/nix /mnt/var/lib/gcr-nix
    install -d -m 0700 /mnt/root/.ssh
    printf '%s' '__IMAGE_PUBLIC_KEY_B64__' | base64 -d > /mnt/root/.ssh/gcr_authorized_keys
    printf '\n%s' '__PACKER_PUBLIC_KEY_B64__' | base64 -d >> /mnt/root/.ssh/gcr_authorized_keys
diff --git a/nixos/system/hectic-lab/hectic-lab.nix b/nixos/system/hectic-lab/hectic-lab.nix
index 1b3b9aff..d307d286 100644
--- a/nixos/system/hectic-lab/hectic-lab.nix
+++ b/nixos/system/hectic-lab/hectic-lab.nix
@@ -109,7 +109,7 @@ in {
       # NOTE(yukkop): ephemeral Hetzner VM runners (1 VM = 1 job).
       # Runbook: infra/gitea-runners/runbook.md "Ephemeral VM runner cutover".
       enable  = true;
-      imageId = "429564260"; # MicroOS x86 + persistent controller SSH key
+      imageId = "429747473"; # MicroOS x86 + persistent controller SSH key and writable Nix mount
       armImageId = "423979717"; # OpenSUSE MicroOS ARM K3S 2026-08-24 snapshot
       nixImageId = "161547269"; # Ubuntu 24.04 x86; Nix needs writable root
       armNixImageId = "161547270"; # Ubuntu 24.04 ARM; Nix needs writable root
diff --git a/package/gitea-runner-controller/hcloud.sh b/package/gitea-runner-controller/hcloud.sh
index 0e5bd81d..a93fe047 100644
--- a/package/gitea-runner-controller/hcloud.sh
+++ b/package/gitea-runner-controller/hcloud.sh
@@ -287,10 +287,10 @@ UNITEOF
 cat > /usr/local/sbin/gcr-install <<INSEOF
 #!/bin/sh
 set -eu
+nix_arch=""
+nix_sha=""
 case "$label" in
   nix|gross-nix-x86|gross-nix-arm|gross-nix-x86-perf|gross-nix-mixed-econ)
-  nix_arch=""
-  nix_sha=""
   case "\$(uname -m)" in
     x86_64)
       nix_arch=x86_64-linux
@@ -305,10 +305,19 @@ case "$label" in
       exit 1
       ;;
   esac
-  curl -fsSL "https://releases.nixos.org/nix/nix-$GCR_NIX_VERSION/nix-$GCR_NIX_VERSION-\$nix_arch.tar.xz" -o /tmp/nix.tar.xz
-  printf '%s  /tmp/nix.tar.xz\n' "\$nix_sha" | sha256sum -c -
+  curl -fsSL "https://releases.nixos.org/nix/nix-$GCR_NIX_VERSION/nix-$GCR_NIX_VERSION-\\\$nix_arch.tar.xz" -o /tmp/nix.tar.xz
+  printf '%s  /tmp/nix.tar.xz\n' "\\\$nix_sha" | sha256sum -c -
   tar -xJf /tmp/nix.tar.xz -C /tmp
-  /tmp/nix-$GCR_NIX_VERSION-\$nix_arch/install --no-daemon
+  mkdir -p /var/lib/gcr-nix
+  mount --bind /var/lib/gcr-nix /nix
+  getent group nixbld >/dev/null 2>&1 || groupadd --system nixbld
+  for nixbld_user in 1 2 3 4 5 6 7 8 9 10; do
+    if ! id "nixbld$nixbld_user" >/dev/null 2>&1; then
+      useradd --system --no-create-home --shell /usr/sbin/nologin \
+        --gid nixbld "nixbld$nixbld_user"
+    fi
+  done
+  /tmp/nix-$GCR_NIX_VERSION-\\\$nix_arch/install --no-daemon
   rm -rf /tmp/nix*
   ;;
 esac
@@ -325,8 +334,8 @@ esac
    aarch64|arm64) runner_arch=arm64 ;;
    *) echo "unsupported arch for runner bootstrap: \$(uname -m)" >&2; exit 1 ;;
  esac
- curl -fsSL "https://dl.gitea.com/gitea-runner/$GCR_ACT_RUNNER_VERSION/gitea-runner-$GCR_ACT_RUNNER_VERSION-linux-\$runner_arch" -o /usr/local/bin/gitea-runner
- if [ "\$runner_arch" = amd64 ]; then
+  curl -fsSL "https://dl.gitea.com/gitea-runner/$GCR_ACT_RUNNER_VERSION/gitea-runner-$GCR_ACT_RUNNER_VERSION-linux-\\\$runner_arch" -o /usr/local/bin/gitea-runner
+  if [ "\\\$runner_arch" = amd64 ]; then
    printf '%s  /usr/local/bin/gitea-runner\n' "$GCR_ACT_RUNNER_SHA256" | sha256sum -c -
  fi
 chmod 0755 /usr/local/bin/gitea-runner