add ci

.forgejo/workflows/build.yaml

@@ -0,0 +1,36 @@
+name: build
+
+on:
+  pull_request: {}
+  push:
+    branches: [ main ]
+
+jobs:
+  build:
+    runs-on: nixos
+    strategy:
+      matrix:
+        # keep-sorted start
+        host: [muede-lpt2, muede-pc2]
+        # keep-sorted end
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v4
+      - run: nix build --no-link .#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel
+
+  # nightly-flake-update.yaml opens PRs from flake-update-* branches; if
+  # the build fails on one of those, close it rather than leaving a
+  # broken auto-generated PR around. Scoped to that branch prefix so a
+  # failing build on a human-authored PR is never auto-closed.
+  close-on-failure:
+    needs: build
+    if: failure() && startsWith(github.head_ref, 'flake-update-')
+    runs-on: nixos
+    steps:
+      - run: |
+          curl -sf -X PATCH \
+            -H "Authorization: token ${PR_BOT_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"state": "closed"}' \
+            "https://forge.darkest.space/api/v1/repos/mara/nixos-configs/pulls/${{ github.event.pull_request.number }}"
+        env:
+          PR_BOT_TOKEN: ${{ secrets.PR_BOT_TOKEN }}

.forgejo/workflows/nightly-flake-update.yaml

@@ -0,0 +1,33 @@
+name: nightly flake update
+
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch: {}
+
+jobs:
+  update:
+    runs-on: nixos
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v4
+      - run: |
+          nix flake update
+
+          if git diff --quiet -- flake.lock; then
+            exit 0
+          fi
+
+          branch="flake-update-$(date +%F)"
+          git checkout -b "$branch"
+          git -c user.name="flake-update-bot" -c user.email="flake-update-bot@darkest.space" \
+            commit -am "flake: nightly update"
+          git push "https://flake-update-bot:${PR_BOT_TOKEN}@forge.darkest.space/mara/nixos-configs.git" "$branch"
+
+          curl -sf -X POST \
+            -H "Authorization: token ${PR_BOT_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -n --arg h "$branch" \
+                  '{title: "flake: nightly update", head: $h, base: "main"}')" \
+            "https://forge.darkest.space/api/v1/repos/mara/nixos-configs/pulls"
+        env:
+          PR_BOT_TOKEN: ${{ secrets.PR_BOT_TOKEN }}

flake.lock

@@ -373,11 +373,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789229958,
-        "narHash": "sha256-/RQjL9iTDNXB5x/eARV3D50q1BSV4I6dUO1cCyjdpYU=",
+        "lastModified": 1789242036,
+        "narHash": "sha256-9K19rzugOfv3xw2kAQTYri07K2qr548ImDyhz9R9OkU=",
         "ref": "refs/heads/main",
-        "rev": "2a02c76ad53ee7e324628335bedbb7a71e7abc42",
-        "revCount": 4497,
+        "rev": "09d502ea3482cb8414f3f0a8271f201de9264ff0",
+        "revCount": 4501,
         "type": "git",
         "url": "https://forge.darkest.space/hyperhive/hyperhive.git"
       },
@@ -1057,11 +1057,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789232649,
-        "narHash": "sha256-0IP5Zluyh3pjvlzFAnCJ+dOXESxvVxB5vCIYWtVx+AE=",
+        "lastModified": 1789251874,
+        "narHash": "sha256-zJfMK8Xxjl8fZ6kEe+B1SpnHTPPEMUz51C7VgNSgp/w=",
         "owner": "vibec0re",
         "repo": "trollshell",
-        "rev": "9eab2211b4aed1b7e601a23363baf2e8ad4350d4",
+        "rev": "1b2472785e38513468d775018120ec4b1828411f",
         "type": "github"
       },
       "original": {

homeConfigurations/muede/trollshell.nix

@@ -38,13 +38,9 @@ in
         };
       };
       departures = {
-        enable = true;
+        enable = false;
         package = trollshellPkgs.hytte-plugin-departures;
       };
-      usage = {
-        enable = true;
-        package = trollshellPkgs.hytte-plugin-usage;
-      };
       weather = {
         enable = true;
         package = trollshellPkgs.hytte-plugin-weather;

nixosConfigurations/muede-pc2/default.nix

@@ -2,6 +2,7 @@
 {
   imports = [
     ./hardware.nix
+    ./gitea-runner.nix
     # ./vscode-server.nix
     # ./hass.nix
   ];

nixosConfigurations/muede-pc2/gitea-runner.nix

@@ -0,0 +1,34 @@
+{ config, pkgs, ... }:
+{
+  environment.systemPackages = [ pkgs.forgejo-runner ];
+
+  # https://wiki.nixos.org/wiki/Forgejo
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.default = {
+      enable = true;
+      name = "pc2";
+      url = "https://forge.darkest.space";
+      # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
+      # placed manually, not managed by Nix
+      tokenFile = "/etc/forgejo-runner/registration_token";
+      # no docker:// image -> jobs run directly on the host, giving them
+      # pc2's real Nix store/daemon (needed for `nix build` results to be
+      # substitutable by other hosts via the existing distributed-builds mesh)
+      labels = [ "nixos:host" ];
+      hostPackages = with pkgs; [
+        bash
+        coreutils
+        curl
+        gawk
+        gitMinimal
+        gnused
+        jq
+        nodejs
+        wget
+        config.nix.package
+      ];
+    };
+  };
+}