pc2 ci for swarm?

nixosConfigurations/muede-pc2/hive-ci-runner.nix

@@ -0,0 +1,84 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  instance = "hive";
+  unit = "gitea-runner-${instance}";
+  instanceCfg = config.services.gitea-actions-runner.instances.${instance};
+
+  # The swarm store's `pki` root. fetch it on lpt2:
+  #   /var/lib/hive-tls/trust-bundle.pem
+  hiveCa = "/etc/hive-ci-runner/ca.pem";
+
+  caBundle = "/run/${unit}/ca-bundle.pem";
+  # Same file upstream generates from `settings`.
+  configFile = (pkgs.formats.yaml { }).generate "config.yaml" instanceCfg.settings;
+in
+{
+  services.gitea-actions-runner.instances.${instance} = {
+    enable = true;
+    name = "swarm-ci-runner-pc2";
+    url = "https://forge.constellation.darkest.space";
+    # TOKEN=<token>, root-only, placed manually. The forge's instance
+    # registration token, which the hive also publishes; on lpt2:
+    #   sudo cat /var/lib/nixos-containers/swarm-ci-runner/var/lib/swarm-ci-runner/registration-token
+    tokenFile = "/etc/hive-ci-runner/registration_token";
+    labels = [ "hive-ci:host" ];
+    # jobs run on the host, so builds go through pc2's own nix daemon
+    hostPackages = with pkgs; [
+      bash
+      coreutils
+      curl
+      gawk
+      gitMinimal
+      gnused
+      nodejs
+      wget
+      config.nix.package
+    ];
+    settings = {
+      runner.capacity = 2;
+      runner.timeout = "1h";
+    };
+  };
+
+  systemd.services.${unit} = {
+    environment = {
+      # Go daemon, curl and git replace the system store; node adds to it.
+      SSL_CERT_FILE = caBundle;
+      GIT_SSL_CAINFO = caBundle;
+      NODE_EXTRA_CA_CERTS = hiveCa;
+    };
+    serviceConfig = {
+      RuntimeDirectory = unit;
+      # Before upstream's register step, which already talks to the forge.
+      ExecStartPre = lib.mkBefore [
+        (pkgs.writeShellScript "${unit}-ca-bundle" ''
+          set -eu
+          if [ ! -s ${hiveCa} ]; then
+            echo "${hiveCa} is missing or empty; copy lpt2's /var/lib/hive-tls/trust-bundle.pem there" >&2
+            exit 1
+          fi
+          cat ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt ${hiveCa} > ${caBundle}
+        '')
+      ];
+      # Host jobs inherit the daemon's environment; only the register step
+      # (ExecStartPre) needs the token, so the daemon drops it.
+      ExecStart = lib.mkForce (
+        pkgs.writeShellScript "${unit}-daemon" ''
+          unset TOKEN
+          exec ${lib.getExe config.services.gitea-actions-runner.package} daemon --config ${configFile}
+        ''
+      );
+      # DynamicUser state dir may be mounted noexec; jobs run what they build
+      # in their workspace.
+      ExecPaths = [
+        "-/var/lib/gitea-runner"
+        "-/var/lib/private/gitea-runner"
+      ];
+    };
+  };
+}