{
  config,
  pkgs,
  lib,
  ...
}:
let
  instance = "hive";
  unit = "gitea-runner-${instance}";
  instanceCfg = config.services.gitea-actions-runner.instances.${instance};

  # The swarm store's `pki` root. fetch it on lpt2:
  #   /var/lib/hive-tls/trust-bundle.pem
  hiveCa = "/etc/hive-ci-runner/ca.pem";

  caBundle = "/run/${unit}/ca-bundle.pem";
  # Same file upstream generates from `settings`.
  configFile = (pkgs.formats.yaml { }).generate "config.yaml" instanceCfg.settings;
in
{
  services.gitea-actions-runner.instances.${instance} = {
    enable = true;
    name = "swarm-ci-runner-pc2";
    url = "https://forge.constellation.darkest.space";
    # TOKEN=<token>, root-only, placed manually. The forge's instance
    # registration token, which the hive also publishes; on lpt2:
    #   sudo cat /var/lib/nixos-containers/swarm-ci-runner/var/lib/swarm-ci-runner/registration-token
    tokenFile = "/etc/hive-ci-runner/registration_token";
    labels = [ "hive-ci:host" ];
    # jobs run on the host, so builds go through pc2's own nix daemon
    hostPackages = with pkgs; [
      bash
      coreutils
      curl
      gawk
      gitMinimal
      gnused
      nodejs
      wget
      config.nix.package
    ];
    settings = {
      runner.capacity = 2;
      runner.timeout = "1h";
    };
  };

  systemd.services.${unit} = {
    environment = {
      # Go daemon, curl and git replace the system store; node adds to it.
      SSL_CERT_FILE = caBundle;
      GIT_SSL_CAINFO = caBundle;
      NODE_EXTRA_CA_CERTS = hiveCa;
    };
    serviceConfig = {
      RuntimeDirectory = unit;
      # Before upstream's register step, which already talks to the forge.
      ExecStartPre = lib.mkBefore [
        (pkgs.writeShellScript "${unit}-ca-bundle" ''
          set -eu
          if [ ! -s ${hiveCa} ]; then
            echo "${hiveCa} is missing or empty; copy lpt2's /var/lib/hive-tls/trust-bundle.pem there" >&2
            exit 1
          fi
          cat ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt ${hiveCa} > ${caBundle}
        '')
      ];
      # Host jobs inherit the daemon's environment; only the register step
      # (ExecStartPre) needs the token, so the daemon drops it.
      ExecStart = lib.mkForce (
        pkgs.writeShellScript "${unit}-daemon" ''
          unset TOKEN
          exec ${lib.getExe config.services.gitea-actions-runner.package} daemon --config ${configFile}
        ''
      );
      # DynamicUser state dir may be mounted noexec; jobs run what they build
      # in their workspace.
      ExecPaths = [
        "-/var/lib/gitea-runner"
        "-/var/lib/private/gitea-runner"
      ];
    };
  };
}