Drone runner VM almost works

app/drone-ci/build/build-qcow2.nix

@@ -12,7 +12,7 @@ with lib;
   system.build.qcow2 = import <nixpkgs/nixos/lib/make-disk-image.nix> {
     inherit lib config;
     pkgs = import <nixpkgs> { inherit (pkgs) system; }; # ensure we use the regular qemu-kvm package
-    diskSize = 8192;
+    diskSize = 32768;
     format = "qcow2";
     configFile = pkgs.writeText "configuration.nix"
       ''

app/drone-ci/build/machine-config.nix

@@ -14,11 +14,22 @@ with lib;
       autoResize = true;
     };
 
+    fileSystems."/secrets" = {
+      device = "/dev/disk/by-label/QEMU\\x20VVFAT";
+      fsType = "vfat";
+    };
+
     boot.growPartition = true;
     boot.kernelParams = [ "console=ttyS0" ];
     boot.loader.grub.device = "/dev/vda";
     boot.loader.timeout = 0;
 
+    environment.systemPackages = with pkgs; [
+      iotop
+      jnettop
+      htop
+    ];
+
     users.extraUsers.root.openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJpaBZdYxHqMxhv2RExAOa7nkKhPBOHupMP3mYaZ73w9 lx@lindy"
     ];
@@ -31,11 +42,17 @@ with lib;
 
     virtualisation.docker.enable = true;
     virtualisation.oci-containers.backend = "docker";
+    systemd.user.services.drone_nix_setup = {
+      script = ''
+        docker run --rm -it -v /var/lib/drone/nix:/mnt nixpkgs/nix:nixos-21.05 cp -r /nix/{store,var} /mnt/
+      '';
+      wantedBy = [ "multi-user.target" ];
+    };
     virtualisation.oci-containers.containers = {
       drone_runner = {
         image = "drone/drone-runner-docker:1.4.0";
         volumes = [
-          "/nix:/nix"
+          "/var/lib/drone/nix:/nix"
           "/var/run/docker.sock:/var/run/docker.sock"
         ];
         environment = {
@@ -49,7 +66,7 @@ with lib;
           DRONE_RUNNER_LABELS = "nix:1";
         };
         environmentFiles = [
-          "/dev/qemu/dronesecret0"
+          "/secrets/secret_env"
         ];
       };
       drone_gc = {

app/drone-ci/deploy/runner-vm.hcl

@@ -4,7 +4,15 @@ job "drone-runner" {
 
   group "runner-vm" {
     network {
-      port "ssh" { }
+      port "ssh" {
+        static = 22544
+      }
+    }
+
+    constraint {
+      attribute = "${attr.unique.hostname}"
+      operator = "="
+      value = "caribou"
     }
 
     task "drone-runner-vm" {
@@ -14,7 +22,9 @@ job "drone-runner" {
         image_path = "local/drone-runner.qcow2"
         accelerator = "kvm"
         args = [
-          "-object", "secret,id=dronesecret0,file=secrets/secret_env"
+          "-drive", "index=1,file=fat:rw:/var/lib/nomad/alloc/${NOMAD_ALLOC_ID}/${NOMAD_TASK_NAME}/secrets,format=raw,media=disk",
+          "-device", "e1000,netdev=user.0",
+          "-netdev", "user,id=user.0,hostfwd=tcp::${NOMAD_PORT_ssh}-:22",
         ]
         port_map {
           ssh = 22