diff --git a/flake.nix b/flake.nix
index 989ca94..b31dcbf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -273,14 +273,24 @@
           ./hosts/git
         ];
       };
-      nixosConfigurations."mqtt" = nixpkgs.lib.nixosSystem {
+      nixosConfigurations."forgejo-runner" = nixpkgs.lib.nixosSystem {
         #system = "x86_64-linux";
         #pkgs = import nixpkgs { inherit system; };
         inherit system;
         modules = [
           agenix.nixosModules.default
           { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
-          ./hosts/mqtt
+          {
+            age.secrets = {
+              forgejo-runner-token-snowden = {
+                file = ./secrets/forgejo-runner-token-snowden.age;
+                owner = "root";
+                group = "root";
+                mode = "0444";
+              };
+            };
+          }
+          ./hosts/forgejo-runner
         ];
       };
     };
diff --git a/hosts/forgejo-runner/default.nix b/hosts/forgejo-runner/default.nix
new file mode 100644
index 0000000..774d39a
--- /dev/null
+++ b/hosts/forgejo-runner/default.nix
@@ -0,0 +1,34 @@
+{ ... }:
+
+{
+  imports = [
+    ../common.nix
+    ../../services/openssh.nix
+    ../../services/prometheus-node.nix
+    ./forgejo-runner.nix
+  ];
+
+  networking = {
+    hostName = "forgejo-runner";
+    firewall = {
+      allowedTCPPorts = [
+        22 # SSH
+      ];
+    };
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto"
+  ];
+
+  environment.etc."ssh/banner".text = ''
+     _ __   __  __    ___     ___      __   _ __
+    /\`'__\/\ \/\ \ /' _ `\ /' _ `\  /'__`\/\`'__\
+    \ \ \/ \ \ \_\ \/\ \/\ \/\ \/\ \/\  __/\ \ \/
+     \ \_\  \ \____/\ \_\ \_\ \_\ \_\ \____\\ \_\
+      \/_/   \/___/  \/_/\/_/\/_/\/_/\/____/ \/_/
+  '';
+  services.openssh.settings.Banner = "/etc/ssh/banner";
+
+  system.stateVersion = "26.05";
+}
diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix
new file mode 100644
index 0000000..bc17c77
--- /dev/null
+++ b/hosts/forgejo-runner/forgejo-runner.nix
@@ -0,0 +1,52 @@
+{ config, pkgs, ... }:
+
+{
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.snowden = {
+      enable = true;
+      name = "snowden";
+      url = "https://git.berlin.ccc.de";
+      labels = [
+        "debian-stable:docker://docker.io/debian:stable-slim"
+        "alpine-latest:docker://docker.io/alpine:latest"
+        "buildkit:docker://docker.io/moby/buildkit:rootless"
+      ];
+      tokenFile = config.age.secrets.forgejo-runner-token-env.path;
+      settings = {
+        runner.labels = {
+          debian-stable = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/debian:stable-slim";
+              platform = "linux/amd64";
+            };
+          };
+          alpine-latest = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/alpine:latest";
+              platform = "linux/amd64";
+            };
+          };
+          buildkit = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/moby/buildkit:rootless";
+              platform = "linux/amd64";
+            };
+          };
+        };
+        server.connections.forgejo = {
+          url = "https://git.berlin.ccc.de/";
+          uuid = "7fd3683e-1bc1-429f-8467-e6d27044eb91";
+          token_url = "file://${config.age.secrets.forgejo-runner-token.path}";
+        };
+        container = {
+          enable_ipv6 = true;
+          docker_host = "unix:///run/podman/podman.sock";
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/mqtt/default.nix b/hosts/mqtt/default.nix
deleted file mode 100644
index d21dfdc..0000000
--- a/hosts/mqtt/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ../common.nix
-    ../../services/openssh.nix
-    ../../services/prometheus-node.nix
-    ./mqtt.nix
-  ];
-
-  networking = {
-    hostName = "mqtt";
-    firewall = {
-      allowedTCPPorts = [
-        22 # SSH
-        80 # HTTP/1
-        443 # HTTP/2
-      ];
-      allowedUDPPorts = [
-        443 # HTTP/3
-      ];
-    };
-  };
-
-  environment.etc."ssh/banner".text = ''
-                      __    __
-                     /\ \__/\ \__
-      ___ ___      __\ \ ,_\ \ ,_\
-    /' __` __`\  /'__`\ \ \/\ \ \/
-    /\ \/\ \/\ \/\ \L\ \ \ \_\ \ \_
-    \ \_\ \_\ \_\ \___, \ \__\\ \__\
-     \/_/\/_/\/_/\/___/\ \/__/ \/__/
-                      \ \_\
-                       \/_/
-  '';
-  services.openssh.settings.Banner = "/etc/ssh/banner";
-
-  system.stateVersion = "26.05";
-}
diff --git a/hosts/mqtt/mosquitto.nix b/hosts/mqtt/mosquitto.nix
deleted file mode 100644
index 862f93d..0000000
--- a/hosts/mqtt/mosquitto.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ ... }:
-
-{
-  services.mosquitto = {
-    enable = true;
-    listeners = [
-      {
-        port = 1883;
-        settings = {
-          ptotocol = "mqtt";
-        };
-      }
-      {
-        port = 8083;
-        settings = {
-          protocol = "websockets";
-        };
-      }
-    ];
-    settings = {
-      allow_zero_length_clientid = true;
-      autosave_interval = 1800;
-      autosave_on_changes = true;
-      connection_messages = true;
-      allow_anonymous = true;
-    };
-    logDest = "stdout";
-    logType = [
-      "error"
-      "warning"
-      "notice"
-      "information"
-    ];
-  };
-}
-
diff --git a/secrets/forgejo-runner-token-snowden.age b/secrets/forgejo-runner-token-snowden.age
index 33ec88e..cbe40ad 100644
Binary files a/secrets/forgejo-runner-token-snowden.age and b/secrets/forgejo-runner-token-snowden.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 14e5f9c..42f11a6 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -24,6 +24,7 @@ let
   _monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring";
   _dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav";
   _git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git";
+  _runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFC7hGJC7cZ2NlrPEP9dhX1+vBNpoTFVNTKcyJX+EVP root@forgejo-runner";
 in
 {
   "matrix_admin_password.age".publicKeys = xengi;
@@ -66,7 +67,7 @@ in
   "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ];
   "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
   "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
-  "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
+  "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ];
   "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
   "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
 }