fix: microOS

devshell/gitea-runners.nix

@@ -104,7 +104,12 @@
      fi
    done
    test -n "$root_device"
-   mount -o subvol=@ "$root_device" /mnt
+   mount -o subvolid=5,rw "$root_device" /mnt
+   default_subvolume="$(btrfs subvolume get-default /mnt | awk 'NR == 1 { print $2 }')"
+   umount /mnt
+   mount -o subvolid="$default_subvolume",rw "$root_device" /mnt
+   btrfs property set -ts /mnt ro false || true
+   install -d -m 0755 /mnt/nix /mnt/var/lib/gcr-nix
    install -d -m 0700 /mnt/root/.ssh
    printf '%s' '__IMAGE_PUBLIC_KEY_B64__' | base64 -d > /mnt/root/.ssh/gcr_authorized_keys
    printf '\n%s' '__PACKER_PUBLIC_KEY_B64__' | base64 -d >> /mnt/root/.ssh/gcr_authorized_keys

nixos/system/hectic-lab/hectic-lab.nix

@@ -109,7 +109,7 @@ in {
       # NOTE(yukkop): ephemeral Hetzner VM runners (1 VM = 1 job).
       # Runbook: infra/gitea-runners/runbook.md "Ephemeral VM runner cutover".
       enable  = true;
-      imageId = "429564260"; # MicroOS x86 + persistent controller SSH key
+      imageId = "429747473"; # MicroOS x86 + persistent controller SSH key and writable Nix mount
       armImageId = "423979717"; # OpenSUSE MicroOS ARM K3S 2026-08-24 snapshot
       nixImageId = "161547269"; # Ubuntu 24.04 x86; Nix needs writable root
       armNixImageId = "161547270"; # Ubuntu 24.04 ARM; Nix needs writable root

package/gitea-runner-controller/hcloud.sh

@@ -287,10 +287,10 @@ UNITEOF
 cat > /usr/local/sbin/gcr-install <<INSEOF
 #!/bin/sh
 set -eu
+nix_arch=""
+nix_sha=""
 case "$label" in
   nix|gross-nix-x86|gross-nix-arm|gross-nix-x86-perf|gross-nix-mixed-econ)
-  nix_arch=""
-  nix_sha=""
   case "\$(uname -m)" in
     x86_64)
       nix_arch=x86_64-linux
@@ -305,10 +305,19 @@ case "$label" in
       exit 1
       ;;
   esac
-  curl -fsSL "https://releases.nixos.org/nix/nix-$GCR_NIX_VERSION/nix-$GCR_NIX_VERSION-\$nix_arch.tar.xz" -o /tmp/nix.tar.xz
-  printf '%s  /tmp/nix.tar.xz\n' "\$nix_sha" | sha256sum -c -
+  curl -fsSL "https://releases.nixos.org/nix/nix-$GCR_NIX_VERSION/nix-$GCR_NIX_VERSION-\\\$nix_arch.tar.xz" -o /tmp/nix.tar.xz
+  printf '%s  /tmp/nix.tar.xz\n' "\\\$nix_sha" | sha256sum -c -
   tar -xJf /tmp/nix.tar.xz -C /tmp
-  /tmp/nix-$GCR_NIX_VERSION-\$nix_arch/install --no-daemon
+  mkdir -p /var/lib/gcr-nix
+  mount --bind /var/lib/gcr-nix /nix
+  getent group nixbld >/dev/null 2>&1 || groupadd --system nixbld
+  for nixbld_user in 1 2 3 4 5 6 7 8 9 10; do
+    if ! id "nixbld$nixbld_user" >/dev/null 2>&1; then
+      useradd --system --no-create-home --shell /usr/sbin/nologin \
+        --gid nixbld "nixbld$nixbld_user"
+    fi
+  done
+  /tmp/nix-$GCR_NIX_VERSION-\\\$nix_arch/install --no-daemon
   rm -rf /tmp/nix*
   ;;
 esac
@@ -325,8 +334,8 @@ esac
    aarch64|arm64) runner_arch=arm64 ;;
    *) echo "unsupported arch for runner bootstrap: \$(uname -m)" >&2; exit 1 ;;
  esac
- curl -fsSL "https://dl.gitea.com/gitea-runner/$GCR_ACT_RUNNER_VERSION/gitea-runner-$GCR_ACT_RUNNER_VERSION-linux-\$runner_arch" -o /usr/local/bin/gitea-runner
- if [ "\$runner_arch" = amd64 ]; then
+  curl -fsSL "https://dl.gitea.com/gitea-runner/$GCR_ACT_RUNNER_VERSION/gitea-runner-$GCR_ACT_RUNNER_VERSION-linux-\\\$runner_arch" -o /usr/local/bin/gitea-runner
+  if [ "\\\$runner_arch" = amd64 ]; then
    printf '%s  /usr/local/bin/gitea-runner\n' "$GCR_ACT_RUNNER_SHA256" | sha256sum -c -
  fi
 chmod 0755 /usr/local/bin/gitea-runner