{ config, pkgs, ... }:

{
  services.gitea-actions-runner = {
    package = pkgs.forgejo-runner;
    instances.snowden = {
      enable = true;
      name = "snowden";
      url = "https://git.berlin.ccc.de";
      labels = [
        "debian-stable:docker://docker.io/debian:stable-slim"
        "alpine-latest:docker://docker.io/alpine:latest"
        "buildkit:docker://docker.io/moby/buildkit:rootless"
      ];
      tokenFile = config.age.secrets.forgejo-runner-token-env.path;
      settings = {
        runner.labels = {
          debian-stable = {
            backend = "docker";
            backend-options = {
              image = "docker.io/debian:stable-slim";
              platform = "linux/amd64";
            };
          };
          alpine-latest = {
            backend = "docker";
            backend-options = {
              image = "docker.io/alpine:latest";
              platform = "linux/amd64";
            };
          };
          buildkit = {
            backend = "docker";
            backend-options = {
              image = "docker.io/moby/buildkit:rootless";
              platform = "linux/amd64";
            };
          };
        };
        server.connections.forgejo = {
          url = "https://git.berlin.ccc.de/";
          uuid = "78cbc26a-09d3-4226-b239-9c2ee146a63f";
          token_url = "file://${config.age.secrets.forgejo-runner-token.path}";
        };
        container = {
          enable_ipv6 = true;
          docker_host = "unix:///run/podman/podman.sock";
        };
      };
    };
  };

  systemd = {
    services."forgejo-runner-container-updater" = {
      description = "Update forgejo runner container images";
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      serviceConfig.Type = "oneshot";
      script = ''
        set -uo pipefail
        failed=0
        images=(
          docker.io/library/debian:stable-slim
          docker.io/library/alpine:latest
          docker.io/moby/buildkit:latest
        )
        for image in "''${images[@]}"; do
          echo "Pulling $image..."
          if ! ${pkgs.podman}/bin/podman pull "$image"; then
            echo "Failed to pull $image"
            failed=1
          fi
        done
        exit $failed
      '';
    };
    timers."forgejo-runner-container-updater" = {
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnCalendar = "daily";
        RandomizedDelaySec = "30m";
        Persistent = true;
      };
    };
  };
}