Configure nixedo as a Forgejo Actions Runner

hosts/nixedo/services/default.nix

@@ -1,3 +1,5 @@
+{ config, inputs, ... }:
+
 {
   imports = [
     ./homepage
@@ -9,4 +11,19 @@
   services = {
     tailscale.enable = true;
   };
+
+  services.gitea-actions-runner.instances.default = {
+    enable = true;
+
+    labels = [
+      "nixos:host"
+    ];
+    name = config.networking.hostName;
+    tokenFile = config.age.secrets.forgejo-runner-token.path;
+    url = config.services.forgejo.settings.server.ROOT_URL;
+  };
+
+  age.secrets = {
+    forgejo-runner-token.file = "${inputs.self}/secrets/forgejo-runner-token.age";
+  };
 }

secrets.nix

@@ -20,6 +20,10 @@ in
     hosts.nixedo
   ] ++ [ users.opdavies ];
 
+  "secrets/forgejo-runner-token.age".publicKeys = [
+    hosts.nixedo
+  ] ++ [ users.opdavies ];
+
   "secrets/tubearchivist-env.age".publicKeys = [
     hosts.nixedo
     hosts.t480

secrets/forgejo-runner-token.age

@@ -0,0 +1,17 @@
+age-encryption.org/v1
+-> ssh-ed25519 IsVD3g mB4VczPxs3QfwaBzmQ0M11i2DvLiWuUFg0lxOc2SSxk
+P7HviMd5+e8pDRTKfWhyqN8Su7qtFLT3fINy4z1Iz2Y
+-> ssh-rsa +vTWQw
+QXgFMe0rRO6exSgeztsAFdF5CMCWNiutiYSX5AajAlWHf3or65xCJVJO1EEZrQEK
+u5BQXzS/iVxnjI+oEyHhID6J3rIiRSVlmA+BNFksh0Fh4ihSq8Iqdwp7TjkX5oas
+RWVzj5dIqTwhtXwcFYbX5Lj68UMZtHjRp8PLAa9WtV1zbU5R3000ofcDFXnZrHW9
+q8FD50EiA7S0ORHgMUlZPAXPU4mIxjs7Qj6QwL55md4ZExdAy8b+srGGSMZlO8Zo
+7gn2B778LAVzaiibtKN7Tc/+AX23QEDPJzkgUTPL4AbicMO8QS9fHDurDRDs0p9z
+cnWra1YhFujzD2z+cW/Tmt23dv9Zs11wEZ2pDK3T2Fi0mIfTZWkkoYz4rrlW9yJm
+Ag9XAJvJS1S4BWeT1UVUE7Z641t2Qsm+5isdRn0JOJ31pLBUE9XbemBmLQGxPhOp
+sYjEk5ldMY1U/nO7KDvot42uE6LcLF2PvRFUAqfwCG+Zu285EfSP1ic4AiyRBy/I
+gnXXeXCHou5uCyN3SpxwTrEen6LBuMbLAeOArXgSqUj/CGSYQJug2b7EPxM4m0+/
+axNzdt6Ytsr+9zfSrS6GCKgcrJtAmooptyustj+Zpr9sC7gtSZeLBWbvw4uVcmPt
+HabHNjE4Rayjwa+ILqrTLzK538dEK2ta1Kv4ebTAYgU
+--- ibayDVd69gBfWFeA9t+3f1zcB2fu1xzRVwsxmwwAPIM
+jgí<>àz{œdDo0hÑ}žAñøô´»Û³Ý–>-Ójèœ!ÜѬ†÷ÓQÀª“ŽeP¨ÀlÔæ5¥ªmwInEv¬ïv²®ŽçÑIHn