Cleanup age secrets and install forgejo runner

modules/nixos/caddy.nix

@@ -1,6 +1,6 @@
 {
   systemd.tmpfiles.rules = [
-    "d /var/www/jankremer.de 755 jan users -"
+    "d /var/www/jankremer.de 755 forgejo-runner users -"
   ];
 
   services.caddy = {

modules/nixos/copyparty.nix

@@ -6,7 +6,6 @@
 {
   age.secrets."copyparty-jan" = {
     file = ../secrets/copyparty-jan.age;
-    mode = "400";
     owner = "copyparty";
   };
 

modules/nixos/forgejo.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, lib, ... }:
 let
   domain = "git.jankremer.de";
 in
@@ -7,6 +7,7 @@ in
     file = ../../modules/secrets/forgejo-mailer.age;
     owner = "forgejo";
   };
+  age.secrets.forgejo-runner.file = ../../modules/secrets/forgejo-runner.age;
 
   services = {
     forgejo = {
@@ -19,7 +20,7 @@ in
           DOMAIN = domain;
           ROOT_URL = "https://${domain}";
           START_SSH_SERVER = false;
-          SSH_PORT = 22;
+          SSH_PORT = lib.head config.services.openssh.ports;
         };
         mailer = {
           ENABLED = true;
@@ -28,14 +29,24 @@ in
           FROM = "git@jankremer.de";
           USER = "janurskremer@me.com";
         };
-        # actions = {
-        #   ENABLED = true;
-        #   DEFAULT_ACTIONS_URL = "github";
-        # };
+        actions = {
+          ENABLED = true;
+          DEFAULT_ACTIONS_URL = "github";
+        };
       };
       secrets = {
         mailer.PASSWD = config.age.secrets.forgejo-mailer.path;
       };
     };
+
+    gitea-actions-runner.instances.nimbus = {
+      enable = true;
+      url = "https://${domain}";
+      tokenFile = config.age.secrets.forgejo-runner.path;
+      name = "nimbus";
+      labels = [
+        "native:host"
+      ];
+    };
   };
 }

modules/nixos/matrix.nix

@@ -2,7 +2,6 @@
 {
   age.secrets."matrix-registration-token" = {
     file = ../secrets/matrix-registration-token.age;
-    mode = "400";
     owner = "tuwunel";
   };