#!/usr/bin/env bash
# Set up GitLab Runner with the exe.dev sandbox executor on this VM.
# From https://exe.dev/deploy/gitlab-runner. Usage: runner-setup.sh BASE_VM
# Safe to run again: it updates GitLab Runner and the executor, and keeps
# the SSH key and the settings it already made.
set -euo pipefail
base=${1:?usage: runner-setup.sh BASE_VM}
src=https://exe.dev/deploy/gitlab-runner

# GitLab Runner from GitLab's package repository, as a systemd service.
curl -fsSL https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh \
  | sudo bash >/dev/null
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq gitlab-runner jq >/dev/null 2>&1

# The executor, and a timer that sweeps up job VMs whose cleanup never ran.
sudo curl -fsSL -o /usr/local/bin/exe-executor "$src/exe-executor"
sudo chmod 755 /usr/local/bin/exe-executor
sudo tee /etc/systemd/system/exe-sweep.service >/dev/null <<'U'
[Unit]
Description=Delete leftover GitLab job VMs on exe.dev
[Service]
Type=oneshot
ExecStart=/usr/local/bin/exe-executor sweep
U
sudo tee /etc/systemd/system/exe-sweep.timer >/dev/null <<'U'
[Unit]
Description=Delete leftover GitLab job VMs on exe.dev every 10 minutes
[Timer]
OnBootSec=5min
OnUnitActiveSec=10min
[Install]
WantedBy=timers.target
U

# An SSH key for reaching job VMs, and exe.dev's host key, pinned.
sudo install -d -m 700 /etc/gitlab-runner/exe
k=/etc/gitlab-runner/exe/id_ed25519
sudo test -f $k || sudo ssh-keygen -q -t ed25519 -N '' -C "$(hostname)-gitlab-jobs" -f $k
ssh-keyscan -t rsa exe.dev 2>/dev/null | sed 's/^exe\.dev /exe.dev,*.exe.xyz /' \
  | sudo tee /etc/gitlab-runner/exe/known_hosts >/dev/null
fp=$(sudo ssh-keygen -lf /etc/gitlab-runner/exe/known_hosts | awk '{print $2}')
if [ "$fp" != SHA256:JJOP/lwiBGOMilfONPWZCXUrfK154cnJFXcqlsi6lPo ]; then
  echo "unexpected exe.dev host key $fp" >&2; exit 1
fi

sudo test -f /etc/gitlab-runner/exe.env || sudo tee /etc/gitlab-runner/exe.env >/dev/null <<E
BASE_VM=$base
CP_FLAGS="--cpu=2 --memory=4GB"
MAX_CPU=8
MAX_HOURS=6
E
sudo chmod 600 /etc/gitlab-runner/exe.env
sudo systemctl daemon-reload
sudo systemctl enable --now exe-sweep.timer >/dev/null 2>&1
gitlab-runner --version | head -1
echo "The key that reaches job VMs:"
sudo cat $k.pub