From 6628ed9789202a722d0e0456f4a573ba293c0a69 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Thu, 20 Aug 2026 22:54:48 +0200
Subject: [PATCH] add forgejo runner

---
 flake.nix                                |  14 +++++-
 hosts/forgejo-runner/default.nix         |  34 +++++++++++++++
 hosts/forgejo-runner/forgejo-runner.nix  |  52 +++++++++++++++++++++++
 hosts/mqtt/default.nix                   |  39 -----------------
 hosts/mqtt/mosquitto.nix                 |  36 ----------------
 secrets/forgejo-runner-token-snowden.age | Bin 1023 -> 1133 bytes
 secrets/secrets.nix                      |   3 +-
 7 files changed, 100 insertions(+), 78 deletions(-)
 create mode 100644 hosts/forgejo-runner/default.nix
 create mode 100644 hosts/forgejo-runner/forgejo-runner.nix
 delete mode 100644 hosts/mqtt/default.nix
 delete mode 100644 hosts/mqtt/mosquitto.nix

diff --git a/flake.nix b/flake.nix
index 989ca94..b31dcbf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -273,14 +273,24 @@
           ./hosts/git
         ];
       };
-      nixosConfigurations."mqtt" = nixpkgs.lib.nixosSystem {
+      nixosConfigurations."forgejo-runner" = nixpkgs.lib.nixosSystem {
         #system = "x86_64-linux";
         #pkgs = import nixpkgs { inherit system; };
         inherit system;
         modules = [
           agenix.nixosModules.default
           { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
-          ./hosts/mqtt
+          {
+            age.secrets = {
+              forgejo-runner-token-snowden = {
+                file = ./secrets/forgejo-runner-token-snowden.age;
+                owner = "root";
+                group = "root";
+                mode = "0444";
+              };
+            };
+          }
+          ./hosts/forgejo-runner
         ];
       };
     };
diff --git a/hosts/forgejo-runner/default.nix b/hosts/forgejo-runner/default.nix
new file mode 100644
index 0000000..774d39a
--- /dev/null
+++ b/hosts/forgejo-runner/default.nix
@@ -0,0 +1,34 @@
+{ ... }:
+
+{
+  imports = [
+    ../common.nix
+    ../../services/openssh.nix
+    ../../services/prometheus-node.nix
+    ./forgejo-runner.nix
+  ];
+
+  networking = {
+    hostName = "forgejo-runner";
+    firewall = {
+      allowedTCPPorts = [
+        22 # SSH
+      ];
+    };
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto"
+  ];
+
+  environment.etc."ssh/banner".text = ''
+     _ __   __  __    ___     ___      __   _ __
+    /\`'__\/\ \/\ \ /' _ `\ /' _ `\  /'__`\/\`'__\
+    \ \ \/ \ \ \_\ \/\ \/\ \/\ \/\ \/\  __/\ \ \/
+     \ \_\  \ \____/\ \_\ \_\ \_\ \_\ \____\\ \_\
+      \/_/   \/___/  \/_/\/_/\/_/\/_/\/____/ \/_/
+  '';
+  services.openssh.settings.Banner = "/etc/ssh/banner";
+
+  system.stateVersion = "26.05";
+}
diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix
new file mode 100644
index 0000000..bc17c77
--- /dev/null
+++ b/hosts/forgejo-runner/forgejo-runner.nix
@@ -0,0 +1,52 @@
+{ config, pkgs, ... }:
+
+{
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.snowden = {
+      enable = true;
+      name = "snowden";
+      url = "https://git.berlin.ccc.de";
+      labels = [
+        "debian-stable:docker://docker.io/debian:stable-slim"
+        "alpine-latest:docker://docker.io/alpine:latest"
+        "buildkit:docker://docker.io/moby/buildkit:rootless"
+      ];
+      tokenFile = config.age.secrets.forgejo-runner-token-env.path;
+      settings = {
+        runner.labels = {
+          debian-stable = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/debian:stable-slim";
+              platform = "linux/amd64";
+            };
+          };
+          alpine-latest = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/alpine:latest";
+              platform = "linux/amd64";
+            };
+          };
+          buildkit = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/moby/buildkit:rootless";
+              platform = "linux/amd64";
+            };
+          };
+        };
+        server.connections.forgejo = {
+          url = "https://git.berlin.ccc.de/";
+          uuid = "7fd3683e-1bc1-429f-8467-e6d27044eb91";
+          token_url = "file://${config.age.secrets.forgejo-runner-token.path}";
+        };
+        container = {
+          enable_ipv6 = true;
+          docker_host = "unix:///run/podman/podman.sock";
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/mqtt/default.nix b/hosts/mqtt/default.nix
deleted file mode 100644
index d21dfdc..0000000
--- a/hosts/mqtt/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ../common.nix
-    ../../services/openssh.nix
-    ../../services/prometheus-node.nix
-    ./mqtt.nix
-  ];
-
-  networking = {
-    hostName = "mqtt";
-    firewall = {
-      allowedTCPPorts = [
-        22 # SSH
-        80 # HTTP/1
-        443 # HTTP/2
-      ];
-      allowedUDPPorts = [
-        443 # HTTP/3
-      ];
-    };
-  };
-
-  environment.etc."ssh/banner".text = ''
-                      __    __
-                     /\ \__/\ \__
-      ___ ___      __\ \ ,_\ \ ,_\
-    /' __` __`\  /'__`\ \ \/\ \ \/
-    /\ \/\ \/\ \/\ \L\ \ \ \_\ \ \_
-    \ \_\ \_\ \_\ \___, \ \__\\ \__\
-     \/_/\/_/\/_/\/___/\ \/__/ \/__/
-                      \ \_\
-                       \/_/
-  '';
-  services.openssh.settings.Banner = "/etc/ssh/banner";
-
-  system.stateVersion = "26.05";
-}
diff --git a/hosts/mqtt/mosquitto.nix b/hosts/mqtt/mosquitto.nix
deleted file mode 100644
index 862f93d..0000000
--- a/hosts/mqtt/mosquitto.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ ... }:
-
-{
-  services.mosquitto = {
-    enable = true;
-    listeners = [
-      {
-        port = 1883;
-        settings = {
-          ptotocol = "mqtt";
-        };
-      }
-      {
-        port = 8083;
-        settings = {
-          protocol = "websockets";
-        };
-      }
-    ];
-    settings = {
-      allow_zero_length_clientid = true;
-      autosave_interval = 1800;
-      autosave_on_changes = true;
-      connection_messages = true;
-      allow_anonymous = true;
-    };
-    logDest = "stdout";
-    logType = [
-      "error"
-      "warning"
-      "notice"
-      "information"
-    ];
-  };
-}
-
diff --git a/secrets/forgejo-runner-token-snowden.age b/secrets/forgejo-runner-token-snowden.age
index 33ec88e84957aa7ee8eebc00cbdb1e8e14538528..cbe40ad0d258e2e3abc2f8a444107c7c6021b579 100644
GIT binary patch
literal 1133
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSH_0Y~UELX@6FH7@w
zDR473Oi#=<%c^uTG<DVXt4eeZ@$xE6jw-ecbxAKN4s)@{bL9#*E6Yss4>JwT@$fUv
z^w-aEN%0K~FEjCrN)9p$NjJ_8ODhS>E%h?12t~Kewah0eyj;O3BFtYqFfrHI)HgIe
z*F-x%yEHpH-7(2A&$&Fs$1gm@$5-3WGAzQ_z?I9zBhRHEy~NqqwJg)Myu>X#!$3dE
z)ZNsgG}J9CImI`<qR^wNJjbXk+XCIT6kqK$pFo9_Lhanp5a*1{j0kPNRBioA*TQ7y
z#G>>9<M6bg@M52W%;G40qsofRTwksnZ~ZjOqTq5TZKI5WoGO<rW8b8p(xT+Bq{4DX
z3zwV_PcyS9<EYAlAYXLbvMR!TjRF-)14_**0`!ASi;IGtQp23noH9Z!-JP9t11vHM
z1AW5G+#-xU-2x5ELQJ@vGlD|AL(*N%@{$W9vMT%ooB|Ef3X`%+qH-g{42%7JER9?u
zTtj_4Q<Bkb)30<6bxv0>cK7u0)h{nLH_?vDHFx*)%t>;qD98;6@Gf;V3r@{-PI50#
zEYx-~3NPle@H95_a0|%}H7+#v%uOoysz}Ys4~Q~z&Gypwa}UbbP6;ZC2rDis$}2{<
z&CR{Q)G%Ek)Xcx!Dc3v5INUud+qKj^D!I%x)zv8?%QB_X$RpIqFWkqoAj-2MxYC5n
zKfBPSBFU{FpfbbLC(EED&^sbODI%kw(l;p2tR&bX*;L=NTstY)xXb|Ewj@*k%#c8Z
zh(L44B#&}$qudI|0>khUN0&;I$VdxsmwdOh$RbN)!^)_jw5*T-{q$_E;4(7{!|?K4
zOV<ehv}Aq%0B?Pxl8~U%689oAH-DGH>@wp*{Su>$&~!(1+dLBeoD<U(+|48XDyn=U
z0+NHBLnA%RQVfE^jDpNU{EdUkJe-RSLc=XQ-JFWUje{(>T!NxPGmX>o5)<A1Dzsfq
zjmiq03NkZ73PX&&LQ@TMlERZhBRmp|jY3V(ZA%WxkMeX>$W5y74RJH8D9s6qNDIk!
z_c5(3H?~Z7in7oS&oNHQ_Af0hu*|6{DM~NrGRbl;GBDFOvo!EDaW(TW%?&E{Gz`qh
zsY*4=ws4AcbM`eZF!6Q`@u`gD($&>faEi<*t+a3}_6P~C2rc$Cs&uT#cMQub@Tn{e
zcXtla4-78L3lB*T^QemC%1Hg2?(@Z~ce?P}DJj)+W9LWs^0vMe+E{V%yqY05>kqA0
tyiSf~7iB`u*JaIhzWd-dYlPQSw{L=F=?BFa`fK%E?mw2zIilWE4gg_IaTx#r

delta 936
zcmaFM@t=KyPJL*Jv6ok*p>~c@g}Zk~d5M8<vR7$HX-1+;X;!+oscVT@MsQS6c7%79
z30I<9cw|v>d0<&kuA6UqXlY`Vv1wj;a;c}8c6d^dS7oYEaaNgUq_=xnAeXM4LUD11
zZfc5=si~o*f@_&iQh2#Sj&``eML}+ue^zLLftPbdhFd{Vo@b(|Wnhp;sdGwdq=|Q6
zK~kQ(ky}nSmqm6-wz+FrrbT2xVnAl8WoE8Ps9$7$dQwSbN?AmSYjT!$K}mQ)M7U|_
z#E;_PsfAvth2`Z*Nv;;*nIZb+9;v})g_-__Rff6cY5K+aiDenyj>Sf<X%V4ZF1g_)
zCOKhVSzg{Q1^U|FMHTsZ7U@|gkshfjnP%CQ{zmRuE@_?t?!KOr;~B-n1D(QCO>#1f
zf=vv}$|~HQ{GD8ltFpBX^_`2%UA0XN142^V)4Ymv!_r;3%#9;_vx3dNz1*FW9Mkjk
zjs3E7Ow05`eO!Hlf^&R*LY<;ae0@Em%%V&tpJf!U&+{$PkFp3X^+-!ib1E^>PRdKS
zG|ves&q{VQE(=diw1~<HPBzahO$&D9$|?6UG4}}6E_1i=F$oCJcT3I>D0j^)Fith`
z^hozN%J=m!bSW$F&Uf}ij{!IL0#n0ug}k)nV1v?-z(VKTM19LN-@<y=u*ia-$mEJ*
z!w9ovuf$x>GGFrwkBC&KWG=(VAP=JeUw!RTBNP3?vShPtbMMRw{SYIsj0%rT!vZgF
z6OZ(a^o&qL19a<>O#L%M0u{1?ee(T-Eh{~XJcC`lOLDVKJ$;gs^OHk@^UVzOOT4Q}
z>O<XKDyxDcvWmGv3iJFu%gwVR(~`pdef%;_{T;J?qEftyvkXFtvQxvuLW2`SoJ!Ji
zgDudl^GNh_PE1$Gu}IYRODQkUb;<K{^9nJ|GIGs{$a6N(whSyU^fxX@OLob%G$~8-
z4YuI&3o%d5@-nQ~F7Qf;@-!{-a4!gO_VSJ}x6ltSh{!N<GxrEBt_&~B(>6@!($&>f
zNOf~HNJ&d~G0e;|_o?*rt~84Z*Y+?9D9S1_4^MLT@-Q<o^~nkH3^O<2Dt)$uiBlu|
zt!uKxG^Z0q*Otfn1S~RZ;h*?=W%Trh39J^&j{TZ&T0z%WUcSS>yV7c{;)MU|GnzCx
X#OD0o`#E3EX$9l#&C^^~3orrz*5Ef&

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 14e5f9c..42f11a6 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -24,6 +24,7 @@ let
   _monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring";
   _dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav";
   _git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git";
+  _runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFC7hGJC7cZ2NlrPEP9dhX1+vBNpoTFVNTKcyJX+EVP root@forgejo-runner";
 in
 {
   "matrix_admin_password.age".publicKeys = xengi;
@@ -66,7 +67,7 @@ in
   "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ];
   "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
   "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
-  "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
+  "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ];
   "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
   "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
 }