From f4a59ff117235c532d0711b007d8df761f55bf29 Mon Sep 17 00:00:00 2001
From: yukkop <hectic.yukkop@gmail.com>
Date: Sun, 7 Jun 2026 23:14:14 +0000
Subject: [PATCH] fix: `mechabellum`: 413

---
 infra/gitea-runners/image/README.md        | 46 +++++++++++++
 nixos/system/hectic-lab/mechabellum.nix    |  1 +
 package/default.nix                        |  1 +
 package/gitea-runner-nix-image/default.nix | 79 ++++++++++++++++++++++
 4 files changed, 127 insertions(+)
 create mode 100644 infra/gitea-runners/image/README.md
 create mode 100644 package/gitea-runner-nix-image/default.nix

diff --git a/infra/gitea-runners/image/README.md b/infra/gitea-runners/image/README.md
new file mode 100644
index 00000000..3f5aa537
--- /dev/null
+++ b/infra/gitea-runners/image/README.md
@@ -0,0 +1,46 @@
+# Gitea runner Nix image
+
+The repo-owned Nix-capable job image is built by the flake package
+`gitea-runner-nix-image`.
+
+```sh
+nix build .#gitea-runner-nix-image
+```
+
+The package currently emits a Docker archive tagged:
+
+```text
+gitea-runner-nix-image:2026-06-07
+```
+
+After publishing to the internal registry, map the `nix` runner label to the
+published, immutable image reference:
+
+```text
+nix:docker://gitea.hectic-lab.com/hectic-lab/gitea-runner-nix-image:2026-06-07
+```
+
+Task 7 should replace the tag-only reference with the published digest once the
+image is pushed, for example
+`gitea.hectic-lab.com/hectic-lab/gitea-runner-nix-image@sha256:<digest>`.
+
+Keep `ubuntu-latest` on the `gitea/runner` default image unless a later runner
+configuration task explicitly changes it. Only the `nix` label should select
+this custom image.
+
+## Image contents
+
+The image includes `nix`, `git`, `bash`, `coreutils`, and `cacert`. Its
+`/etc/nix/nix.conf` enables flakes and configures the repo substituters from the
+top-level `flake.nix`:
+
+```text
+experimental-features = nix-command flakes
+substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
+trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gW4x6l1xP+GxgH0r7u+f6p1VFlr0= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
+sandbox = false
+```
+
+No Gitea runner token, SSH key, SOPS key, kubeconfig, Hetzner token, or S3
+credential belongs in this image. Runtime secrets stay with the Kubernetes
+runner configuration and token-file mount contract.
diff --git a/nixos/system/hectic-lab/mechabellum.nix b/nixos/system/hectic-lab/mechabellum.nix
index 3b36ebd1..34bd0c85 100644
--- a/nixos/system/hectic-lab/mechabellum.nix
+++ b/nixos/system/hectic-lab/mechabellum.nix
@@ -37,6 +37,7 @@ in {
       proxyPass = "http://${apiHost}:${builtins.toString apiPort}";
       extraConfig = ''
         proxy_http_version 1.1;
+        client_max_body_size 500M;
       '';
     };
 
diff --git a/package/default.nix b/package/default.nix
index 0226dd7d..9cb66f46 100644
--- a/package/default.nix
+++ b/package/default.nix
@@ -142,6 +142,7 @@ in {
   watch                        = pkgs.callPackage ./c/watch/default.nix               {};
   support-bot                  = pkgs.callPackage ./support-bot                       {};
   gitea-heatmap                = pkgs.callPackage ./gitea                             {};
+  gitea-runner-nix-image       = pkgs.callPackage ./gitea-runner-nix-image            {};
   nix-derivation-hash          = pkgs.callPackage ./nix-derivation-hash               {};
   "sentinèlla"                 = pkgs.callPackage (./. + "/sentinèlla")               {};
   deploy                       = pkgs.callPackage ./deploy                            { inherit inputs; };
diff --git a/package/gitea-runner-nix-image/default.nix b/package/gitea-runner-nix-image/default.nix
new file mode 100644
index 00000000..ad145b79
--- /dev/null
+++ b/package/gitea-runner-nix-image/default.nix
@@ -0,0 +1,79 @@
+{
+  bash,
+  cacert,
+  coreutils,
+  dockerTools,
+  git,
+  lib,
+  nix,
+  symlinkJoin,
+}:
+let
+  name = "gitea-runner-nix-image";
+  tag = "2026-06-07";
+  root = symlinkJoin {
+    name = "${name}-root";
+    paths = [
+      bash
+      cacert
+      coreutils
+      git
+      nix
+    ];
+  };
+in
+dockerTools.buildLayeredImageWithNixDb {
+  inherit name tag;
+
+  contents = [ root ];
+
+  fakeRootCommands = ''
+    mkdir -p ./etc
+    cat > ./etc/passwd <<'EOF'
+    root:x:0:0:root:/root:/bin/bash
+    nobody:x:65534:65534:nobody:/var/empty:/bin/false
+    EOF
+    cat > ./etc/group <<'EOF'
+    root:x:0:
+    nixbld:x:30000:
+    nobody:x:65534:
+    EOF
+    for n in $(seq 1 10); do
+      echo "nixbld$n:x:$((30000 + n)):30000:Nix build user $n:/var/empty:/bin/false" >> ./etc/passwd
+      sed -i "s/^nixbld:x:30000:.*/&,nixbld$n/" ./etc/group
+    done
+
+    mkdir -p ./nix/var/nix/{gcroots,profiles,temproots,userpool,db}
+    mkdir -p ./nix/var/log/nix/drvs
+    chmod 1777 ./nix/var/nix/gcroots ./nix/var/nix/profiles
+  '';
+
+  extraCommands = ''
+    mkdir -p etc/nix root tmp
+    chmod 1777 tmp
+
+    cat > etc/nix/nix.conf <<'EOF'
+    experimental-features = nix-command flakes
+    substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
+    trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gW4x6l1xP+GxgH0r7u+f6p1VFlr0= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
+    sandbox = false
+    EOF
+  '';
+
+  config = {
+    Cmd = [ "${bash}/bin/bash" ];
+    Env = [
+      "HOME=/root"
+      "PATH=${lib.makeBinPath [ bash coreutils git nix ]}"
+      "SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt"
+      "NIX_SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt"
+      "USER=root"
+    ];
+    Labels = {
+      "org.opencontainers.image.description" = "Nix-capable Gitea Actions job image";
+      "org.opencontainers.image.ref.name" = "${name}:${tag}";
+      "org.opencontainers.image.source" = "https://gitea.hectic-lab.com/hectic-lab/util.nix";
+    };
+    WorkingDir = "/workspace";
+  };
+}