feat: add forgejo runner

.forgejo/workflows/ci.yaml

@@ -1,6 +1,8 @@
 on: [push]
+
 jobs:
   test:
-    runs-on: debian-latest
+    runs-on: nix
     steps:
-      - run: echo All Good
+      - uses: actions/checkout@v4
+      - run: nix  --experimental-features 'nix-command flakes' flake check --verbose

hosts/raptus/forgejo.nix

@@ -16,13 +16,24 @@ in
       "L+ ${config.services.forgejo.customDir}/public/robots.txt - - - - ${robots.outPath}"
     ];
 
+  services.gitea-actions-runner = {
+    instances."raptus" = {
+      enable = true;
+      name = "raptus";
+      tokenFile = config.age.secrets.forgejo-runner-token.age;
+      url = "https://git.ccnlc.eu";
+      labels = [
+        "debian-latest:docker://node:18-bullseye"
+        "nix:docker://ghcr.io/nydragon/runner:latest"
+      ];
+    };
+  };
+
+  virtualisation.docker.enable = true;
+
   networking.firewall.allowedTCPPorts = [ sshPort ];
 
   services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    clientMaxBodySize = "50M";
     virtualHosts.${domain} = {
       locations."/" = {
         proxyPass = "http://unix:/run/forgejo/forgejo.sock";

secrets/forgejo-runner-token.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 b3HlPA dBkOMVkozSkc7hGVGBV8KanAOqT57d/FGTyPQnZGQBM
+4MGa6vkR/XtD6scjA2giiDINdfFH4Y9Ebn/Pki7bxPM
+-> ssh-ed25519 WcjW5A HOrY4chLCOJJQmZqn2ax8sBWqFi1MnzwUmT3qY1+Uxk
+4L36W1eX4rfzH0e6YWtJ4hEl5FoKA9Okd1CYNWP1yXU
+--- syAd07l1R2c15ZVprT+nEw0IO2o/EAWPG0KieTVQxOE
+t³­ÆNÎh†ùN‰(sfEkS(¤Â)ž_kÐö K/iŽš˜<C5A1>eX/Ìí8„ÒhÚá«
S	øÁ”¼Œ‡É~‡éjœÒ$Ó

secrets/secrets.nix

@@ -16,4 +16,8 @@ in
   "rustypaste.age".publicKeys = devices ++ [ ny ];
   "navidrome.age".publicKeys = devices ++ [ ny ];
   "adguard-dns-list.age".publicKeys = devices ++ [ ny ];
+  "forgejo-runner-token.age".publicKeys = [
+    raptus
+    ny
+  ];
 }