nixos/gitlab-runner: add options for privileged services

The dockerServicesPrivileged and dockerAllowedPrivilegedServices limit
which containers are allowed to run in privileged mode in the GitLab CI.

nixos/modules/services/continuous-integration/gitlab-runner/runner.nix

@@ -189,11 +189,15 @@ let
                         [ "--docker-image ${service.dockerImage}" ]
                         ++ optional service.dockerDisableCache "--docker-disable-cache"
                         ++ optional service.dockerPrivileged "--docker-privileged"
+                        ++ optional service.dockerServicesPrivileged "--docker-services_privileged true"
                         ++ optional (service.dockerPullPolicy != null) "--docker-pull-policy ${service.dockerPullPolicy}"
                         ++ map (v: "--docker-volumes ${escapeShellArg v}") service.dockerVolumes
                         ++ map (v: "--docker-extra-hosts ${escapeShellArg v}") service.dockerExtraHosts
                         ++ map (v: "--docker-allowed-images ${escapeShellArg v}") service.dockerAllowedImages
                         ++ map (v: "--docker-allowed-services ${escapeShellArg v}") service.dockerAllowedServices
+                        ++ map (
+                          v: "--docker-allowed-privileged-services ${escapeShellArg v}"
+                        ) service.dockerAllowedPrivilegedServices
                       )
                     )
                   )
@@ -521,6 +525,13 @@ in
                 Give extended privileges to container.
               '';
             };
+            dockerServicesPrivileged = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Give extended privileges to services.
+              '';
+            };
             dockerExtraHosts = mkOption {
               type = types.listOf types.str;
               default = [ ];
@@ -554,6 +565,19 @@ in
                 Whitelist allowed services.
               '';
             };
+            dockerAllowedPrivilegedServices = mkOption {
+              type = types.listOf types.str;
+              default = [ ];
+              example = [
+                "docker.io/library/docker:*-dind-rootless"
+                "docker.io/library/docker:dind-rootless"
+                "docker:*-dind-rootless"
+                "docker:dind-rootless"
+              ];
+              description = ''
+                Whitelist allowed privileged services.
+              '';
+            };
             preGetSourcesScript = mkOption {
               type = types.nullOr (types.either types.str types.path);
               default = null;