Updates.

hosts/hub/apps/dev.nix

@@ -1,42 +1,81 @@
+{ pkgs, config, ... }:
+
+let
+  name = "dev";
+  domain = "dev.thewordnerd.info";
+  appName = "Nolan's Projects";
+in
 {
+  age.secrets."${name}_runner_linux".file = ../../../secrets/${name}_runner_linux.age;
+
   services = {
     postgresql = {
-      ensureDatabases = [ "dev" ];
+      ensureDatabases = [ name ];
       ensureUsers = [
         {
-          name = "dev";
+          name = name;
           ensureDBOwnership = true;
         }
       ];
     };
     authelia.instances.main.settings.access_control.rules = [
       {
-        domain = "dev.thewordnerd.info";
+        domain = domain;
         policy = "bypass";
       }
     ];
+
+    caddy.virtualHosts.${domain}.extraConfig = ''
+      forward_auth localhost:9091 {
+        uri /api/authz/forward-auth
+        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+      }
+      reverse_proxy ${name}:3000
+    '';
+
+    gitea-actions-runner = {
+      package = pkgs.unstable.forgejo-runner;
+      instances."${name}-linux" = {
+        name = "Linux";
+        enable = true;
+        url = "https://${domain}";
+        labels = [
+          "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
+          "native:host"
+        ];
+        tokenFile = config.age.secrets."${name}_runner_linux".path;
+      };
+    };
   };
 
-  containers.dev = {
+  environment.systemPackages = with pkgs; [ unstable.forgejo-runner ];
+
+  networking.firewall.trustedInterfaces = [ "br-+" ];
+
+  containers."${name}" = {
     autoStart = true;
     privateNetwork = true;
     hostAddress = "192.168.0.1";
     localAddress = "192.168.0.2";
     config =
+      let
+        hostPkgs = pkgs;
+      in
       {
-        config,
-        pkgs,
         lib,
         ...
       }:
       {
-        services.gitea = {
+        services.forgejo = {
           enable = true;
-          appName = "Nolan's projects";
+          package = hostPkgs.unstable.forgejo;
           settings = {
+            DEFAULT = {
+              APP_NAME = appName;
+            };
             server = {
-              ROOT_URL = "https://dev.thewordnerd.info";
-              DOMAIN = "dev.thewordnerd.info";
+              ROOT_URL = "https://${domain}";
+              DOMAIN = domain;
               DISABLE_SSH = true;
               LANDING_PAGE = "explore";
             };
@@ -55,8 +94,8 @@
           lfs.enable = true;
           database = {
             type = "postgres";
-            name = "dev";
-            user = "dev";
+            name = name;
+            user = name;
             socket = "/run/postgresql";
             createDatabase = false;
           };
@@ -67,7 +106,7 @@
         };
         services.resolved.enable = true;
         environment.sessionVariables = {
-          PATH = [ "${pkgs.gitea}/bin" ];
+          PATH = [ "${pkgs.forgejo}/bin" ];
           GITEA_WORK_DIR = "/var/lib/gitea";
         };
       };
@@ -77,12 +116,4 @@
       };
     };
   };
-
-  services.caddy.virtualHosts."dev.thewordnerd.info".extraConfig = ''
-    forward_auth localhost:9091 {
-      uri /api/authz/forward-auth
-      copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
-    }
-    reverse_proxy dev:3000
-  '';
 }