feat: add forgejo runner

.helix/config.toml

···
+editor.insert-final-newline = false

hosts/default.nix

···
     };
 
   systems = {
-    lungmen = "x86_64-linux";
-    tkaronto = "x86_64-linux";
+    # lungmen = "x86_64-linux";
+    # tkaronto = "x86_64-linux";
     wolumonde = "x86_64-linux";
     wsl = "x86_64-linux";
   };

hosts/tkaronto/modules/nixbuild.nix

···
-../../../modules/develop/nixbuild/default.nix

hosts/tkaronto/modules/secrets.nix

···
     group = "systemd-network";
   };
 
-  age.secrets.nixBuildKey = {
-    file = ../../../secrets/nixBuildKey.age;
-    owner = "root";
-    group = "nix-build-key-access";
-  };
-  users.groups."nix-build-key-access" = {};
+  # age.secrets.nixBuildKey = {
+  #   file = ../../../secrets/nixBuildKey.age;
+  #   owner = "root";
+  #   group = "nix-build-key-access";
+  # };
+  # users.groups."nix-build-key-access" = {};
 }

hosts/wolumonde/default.nix

···
     allowedUDPPortRanges = [];
   };
 
-  # virtualisation.docker.enable = true;
+  virtualisation.docker.enable = true;
 
   system.stateVersion = "22.05";
 }

hosts/wolumonde/modules/forgejo-runner.nix

···
+{pkgs, config, ...}: {
+  services.gitea-actions-runner.package = pkgs.forgejo-runner;
+  services.gitea-actions-runner.instances."thermex" = {
+    enable = true;
+    url = config.services.forgejo.settings.server.ROOT_URL;
+    name = "thermex";
+    tokenFile = config.age.secrets.forgejoActRunnerToken.path;
+    labels = ["docker:docker://yusdacra/lixpine:latest"];
+    settings.container.privileged = true;
+  };
+}

hosts/wolumonde/modules/secrets.nix

···
   # age.secrets.tmodloaderServerPass.file = ../../../secrets/tmodloaderServerPass.age;
   age.secrets.websiteConfig.file = ../../../secrets/websiteConfig.age;
   # age.secrets.giteaActRunnerToken.file = ../../../secrets/giteaActRunnerToken.age;
+  age.secrets.forgejoActRunnerToken.file = ../../../secrets/forgejoActRunnerToken.age;
   # age.secrets.xrayConfig = {
   #   name = "xrayConfig.json";
   #   file = ../../../secrets/xrayConfig.age;

secrets/forgejoActRunnerToken.age

···
+age-encryption.org/v1
+-> ssh-rsa Abmvag
+OmNZB1HxonlxQcPAmmJtUW5aZULDXFJBiBcswviAqTqZESzGCzZSe/dGEEsh9QOF
+ZZpC699LqLqNMJUJFCRuy+eiXgi98J4MVMlMFPBScGF3huhuNlZ7EvryB+MAibqa
+SouBuR0JXJ4dWhB5SJkA/Z5uFxwABCqvRzBZrjL5ldJoVXeTVl+e+8W/dR7VB/u1
+nzdlDaVxziH6aO/al0qeaNIQXCtUmmy+IKVZ8dnwwEDZwcgNp0p227K62R0UqI95
+Qsp/w+xTJyIu1XC2CaRvKA304PHbzUAqhAvexgvMXFi0A6cM4VoTk9Hrk1TH38VK
+tF8LU6jh873g9JpxCXwIJlATuiXMWO8u6EWEDPs7uJm+3Pvzja1qqUrBk7kwgZy6
+iLOJndyL0i52/PK6Rlt0mqsUNSzXvNuvtViKbvXsTCXPOG8vQCXj6hqNtXfFzipX
+laNlH8tyLhjMaQZzlU1SS0F+J3LSpF7gDpQywr6m5HNL7iaEL+zUEinn2lpDQCD6
+OWh1kTcPj8RprnH701P7vcS+21e5S0zxGXPGoYF/Xhj/BYGPz44I1d6hTYWuqSB2
+n/Xw21GFykIVPSWT32Yt/zVlaQagMUHDvMDUTK7yZmxT9BYO6a783KdE2G2hPy6V
+Uup5AKvbTpWtDtZ8D5u37/YO1li4Cquigw6QV7AUz5k
+-> ssh-ed25519 KjIL7g 1Ctb1OJio8Uues4VZyrgvo3G4Av4TRQ8EepnoIWaJ2M
+AZJRr+JmLcJ9lvhnSpw6LOCtWbi/0nQe6mL7ugRsNUg
+--- Ruv76wNOAJ0qhpvcoNa06V0Eml/a+FeyPXCCTXhAdrI
+��]KE���Ԫ���W�,��[_��5'J�����2��j��h^��so��W��7�@���M�g�X��%�����

secrets/giteaActRunnerToken.age

···
-age-encryption.org/v1
--> ssh-rsa Abmvag
-QRbeL4d60GYob6F2OKpZEJUFzHTuxZorUsPvgNdIBqBKDGEQcTXEc064QCeIbvzC
-Gy8UW8GXng+VFlxRnFDhTpIjOw9j0/azbTN8YzCtWpYmzNVLtGEcsnt3TJQYT45Y
-voIjm/PXcObH8Qj+dCcyeRkUij0HHsJmxFWgYSoKwR9PpeN9uDWWmJ3LZeFZs2ju
-RJmtOTasvQ5AwTwEIUTH1yR6iT81qLAUPDVTbMKz6QhRfLz/Vd3Db0DHcj6Q9UD/
-ompDcyOLflHrdvVAomz0++nJjHFP228hnmpDKS7heo8dwOwm1FSoS+qYCB/r+mFZ
-MvYlj6+gbVJ6WjUt6MRdOeqB5aO+WDHCKfv0Ld34LQrDdVxoR6x6yO23AfquEH8c
-OLeat2omAhU/Hk76+EfgJYUT60MKgsNeQyufAfUd+KbonGURL4IbYGkj26a+Fiby
-8a2Ya5VrHUloyjL/fbF46vFJuHmV7wbc7de8yH/NSj9VMs7G+OXR/VtQREDImeq8
-MEzdQyWrLnlQMe4ONNYmnqjANAn40IMTTRO97vGyILVyDGPTO8gPixCFe9H08t6x
-XMm13Kh3LsDr3+UJ1gi8AWNdB7IXEpsReHOO+SHDN5bxn4kq6C1O5wl8AhE3e5+a
-0AmVpjByWykEbgVDisT96xgSW9d35BJGPfKR5HkT6Ck
--> ssh-ed25519 KjIL7g qb2Rb0oSREc426K0+Z9oL+TXxIUB+n8+cdWri+HyHyY
-i6oIGtvXTbA6Hotg8jdG2BeNcuQrkiIfJYgOK8WqEyg
---- 0/5wQye+3Z1EeHOLFduhhh9V0GBKBrIzIvHLNvJPg4w
-?=@��.@�Ļ�v�g��;�QF�}	Mڟ��DI��ߧ�&�(T
-��Hes�����Ø��1Ijо4tX�i��������

secrets/secrets.nix

···
   "bernbotToken.age".publicKeys = [yusdacra wolumonde];
   "musikquadConfig.age".publicKeys = [yusdacra wolumonde];
   "nixGithubAccessToken.age".publicKeys = [yusdacra];
-  "nixBuildKey.age".publicKeys = [yusdacra];
-  "tmodloaderServerPass.age".publicKeys = [yusdacra wolumonde];
   "websiteConfig.age".publicKeys = [yusdacra wolumonde];
-  "giteaActRunnerToken.age".publicKeys = [yusdacra wolumonde];
+  "forgejoActRunnerToken.age".publicKeys = [yusdacra wolumonde];
   "xrayConfig.age".publicKeys = [yusdacra wolumonde];
   "pdsConfig.age".publicKeys = [yusdacra wolumonde];
 }

secrets/tmodloaderServerPass.age

···
-age-encryption.org/v1
--> ssh-rsa Abmvag
-0F4C6sVSL7x9LUPXO1REpj8tnlnEbQWUaebc79Tc0nj8YJ4c4mrR3IVYq8UiObUV
-xUMDjO0+XgHd4udJjmThD2UtBVYApmhYEc9Zv7199CHZARrXIgaFfNQvCnNC1E02
-FKUGSh42eQuXcQIGpmj5fU9HVoAfp6VKHvp1CFYRn3J03u9yB589ROIH4ySdWSQP
-cetenbKXKaZCYO8ipERumxyb76sninZjWc6BGj8HNF2ePEtXVcFOc5C/DrYX8xrs
-0wzCtzj2bUZhtYFT5OAiaDBOi1dbC+eyER1uK6qC4ZFNMAuhVLeU6774QxQ5dL7G
-g3FTNkyZdS9KZWl+4yntX0yFfXQbRGJErSRWW2g4w43EPniIgrMcqK5N1X+pycBD
-gt1qofz07YGwXUPJfurWkuFpHcsO2/0SXsOSpuxYyzuu/tIdmjGMmiEilQUtQC++
-yXdIXQzIyB9jWTwoXUMPMfsLtjwcok8l/dH+/9VWjgQZ+4wycHPDemhawnI33CDg
-04zAJEimqoavHY2BD9K88qJSJViKBfSvMPSittblBlMNjvOQ0uedGwB98axXe9mh
-LXa4rHnF48uL10HI0byYivamJNyfFug5G9WpH2fSjn1n90o1lp8ZPWKDVR/kj6+9
-01zzFthLXqBQ6s5AyVtOP9yLWU06d2lhhBr+g5+J5WU
--> ssh-ed25519 KjIL7g sFHELT2wiMJBp/8HrwSbJPMWthkbpU72Kizvkikc60A
-l6kk0fyz1mX8E5y37srUgW3zaZVtKdXyBoD55EgQaaY
--> N/}--grease Y
-iItOxVW8A6Mv+7+7bPiMfkxX80VizsYC
---- hfAvTCpVuTOQnTkLljMOpbH9g6gYN+V9FruGBG99YdM
-��35�W��@����lg���GƏ�����T-N���[{���qE�!L"��/�~