forgejo nix runner

nixos vm used as a native forgejo actions runner

the host and runner are both named sakari

netbird is enabled so jobs can deploy to private peers instead of using the public internet

the runner exposes the nixos:host label and keeps /nix/store between jobs, mostly so the netboot repo does not rebuild plasma from scratch every time

install

put the registration token on the vm without adding it to nix or git:

install -d -m 0700 /var/lib/secrets
printf 'TOKEN=your-token\n' > /var/lib/secrets/forgejo-runner.env
chmod 0600 /var/lib/secrets/forgejo-runner.env

then rebuild:

nixos-rebuild switch --flake .#forgejo-runner

this runner uses host execution and should only run trusted repositories