Configure nixedo as a Forgejo Actions Runner

hosts/nixedo/secrets.nix

@@ -2,6 +2,7 @@
   age.secrets = {
     cloudflare.file = ../../secrets/cloudflare.age;
     cloudflared.file = ../../secrets/cloudflared-credentials.age;
+    forgejo-runner-token.file = ../../secrets/forgejo-runner-token.age;
     tubearchivist-env.file = ../../secrets/tubearchivist-env.age;
   };
 }

hosts/nixedo/services/default.nix

@@ -1,3 +1,5 @@
+{ config, pkgs, ... }:
+
 {
   imports = [
     ./homepage
@@ -9,4 +11,15 @@
   services = {
     tailscale.enable = true;
   };
+
+  services.gitea-actions-runner.instances.default = {
+    enable = true;
+
+    labels = [
+      "nixos-host:host"
+    ];
+    name = config.networking.hostName;
+    token = ''$(${pkgs.coreutils}/bin/cat ${config.age.secrets.forgejo-runner-token.path}')'';
+    url = config.services.forgejo.settings.server.ROOT_URL;
+  };
 }

secrets.nix

@@ -20,6 +20,10 @@ in
     hosts.nixedo
   ] ++ [ users.opdavies ];
 
+  "secrets/forgejo-runner-token.age".publicKeys = [
+    hosts.nixedo
+  ] ++ [ users.opdavies ];
+
   "secrets/tubearchivist-env.age".publicKeys = [
     hosts.nixedo
     hosts.t480