Commit 9811eee

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> piv-p256 xCEwtQ A2xZQI2fXTNqYlgTSj2R0DuocSEbeDirfwN+W/5hpFoQ
+iS7WS5phlBfxWdBbzSNeBuwcdi5kXZvQQIguwKqKwWI
+-> &PQ-grease 8zJ, _$[ N1,xZ,zi
+vGRs9JfG4q4pmlm7Ml/r9c2dru3+HtcgbBYe1mCRK2DT2I9E4wxHpTyej3aD9mkA
+XnnxjuW1KttsRLhpZwhRswj2RVgo1BnakKRjc+0TmSbA
+--- RuujIYnmPBiGXfRBP8Mg1V1v1y7bleUtRjFUTVclj1s
+%�ٳt�GlcD����61h
^�=H�������J��E����›�FI�d��&L,� ���G�)w�
\ No newline at end of file

@@ -4,6 +4,28 @@
       services.webserver.external = false;
       services.webserver.caddy.tailscaleUseHttps = true;
 
+      services.forgejo = {
+        domain = "git.net.trin.one";
+      };
+      services.forgejo.runner = {
+        instances.internal = {
+          name = "runner-internal";
+          servers = {
+            gateOfInfinity = {
+              url = "https://git.net.trin.one";
+              uuid = "53fa1df5-f0dd-423c-91a7-afee2488f253";
+              tokenFileAged = ./forgejo-runner-goi-token.age;
+            };
+          };
+          labels = [
+            "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+            "nixos-latest:docker://git.net.trin.one/hpcesia/nix-act-image:latest-x86_64-linux"
+          ];
+          extraSettings = {
+            container.network = "host";
+          };
+        };
+      };
       services.navidrome = {
         domain = "navidrome.net.trin.one";
       };
@@ -24,6 +46,8 @@
       services.webserver
       services.tailscale-nginx-auth
 
+      services.forgejo
+      services.forgejo.runner
       services.navidrome
       services.woodpecker.agent
 

@@ -10,12 +10,12 @@
       instances = lib.mkOption {
         type = lib.types.attrsOf (lib.types.submodule ({name, ...}: {
           options = {
-            name = lib.mkoption {
+            name = lib.mkOption {
               type = lib.types.str;
               default = name;
             };
             servers = lib.mkOption {
-              type = lib.attrsOf (lib.types.submodule {
+              type = lib.types.attrsOf (lib.types.submodule {
                 options = {
                   url = lib.mkOption {
                     type = lib.types.str;
@@ -53,6 +53,17 @@
       };
     };
 
+    persist = {
+      directoies = [
+        {
+          directory = "/var/lib/private/forgejo-runner";
+          user = "nobody";
+          group = "nogroup";
+          mode = "0700";
+        }
+      ];
+    };
+
     nixos = {
       host,
       config,
@@ -88,7 +99,10 @@
             {
               cache = {
                 enabled = true;
-                host = "172.17.0.1";
+                # See https://forgejo.org/docs/latest/user/actions/advanced-features/#cache
+                # ONLY for podman backend
+                proxy_port = 4000;
+                actions_cache_url_override = "http://host.containers.internal:4000";
               };
               container = {
                 enable_ipv6 = true;
@@ -116,7 +130,8 @@
               lib.nameValuePair (mkServerTokenSecretName instance server) {
                 file = serverCfg.tokenFileAged;
               }
-          ))
+          )
+          instanceCfg.servers)
         cfg.instances
       );
     };