fix: streamline Gitea runners

hosts/unstable/isaiah/default.nix

@@ -9,14 +9,6 @@
     ./hardware-configuration.nix
   ];
 
-  age.secrets = {
-    gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age;
-    gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
-    runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age;
-    # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age
-    # gitea-runner-isaiah.file = ../../../secrets/gitea-runner-isaiah.age;
-  };
-
   boot = {
     binfmt.emulatedSystems = [ "aarch64-linux" ];
     extraModprobeConfig = "options kvm_amd nested=1";
@@ -57,9 +49,7 @@
     };
     gitea-runner = {
       enable = true;
-      labels = [ "self-hosted" "bare-metal" "host:isaiah" ];
-      # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age
-      # tokenFile = config.age.secrets.gitea-runner-isaiah.path;
+      extraLabels = [ "bare-metal:host" ];
     };
   };
 
@@ -75,41 +65,6 @@
   };
 
   services = {
-    gitea-actions-runner.instances.podman = {
-      enable = true;
-      labels = [
-        "debian-latest:docker://node:25-trixie"
-
-        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
-        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
-        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
-
-        "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
-        "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
-        "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
-
-        "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
-        "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
-        "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
-
-        "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
-        "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
-        "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
-
-        "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
-        "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
-        "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
-
-        "nix-latest:docker://src.thehellings.com/greg/builder:latest"
-      ];
-      name = "isaiah-podman";
-      settings = {
-        container.force_pull = true;
-        runner.capacity = 7;
-      };
-      tokenFile = config.age.secrets.gitea-runner-isaiah-podman.path;
-      url = "https://gitea.shire-zebra.ts.net";
-    };
     k3s.clusterInit = true; # This is the first node in the cluster
     openssh = {
       enable = true;

hosts/unstable/jeremiah/default.nix

@@ -29,8 +29,6 @@ in
     gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age;
     gitea-webhookSecret = mk ../../../secrets/gitea/webhookSecret.age;
     gitea-workerPassword = mk ../../../secrets/gitea/workerPassword.age;
-    # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age
-    # gitea-runner-jeremiah.file = ../../../secrets/gitea-runner-jeremiah.age;
   };
 
   # Bootloader.
@@ -80,6 +78,10 @@ in
   };
 
   greg = {
+    gitea-runner = {
+      enable = true;
+      extraLabels = [ "bare-metal:host" ];
+    };
     home = true;
     kubernetes = {
       enable = true;
@@ -98,12 +100,6 @@ in
       threads = 3;
       qemu = true;
     };
-    gitea-runner = {
-      enable = true;
-      labels = [ "self-hosted" "bare-metal" "host:jeremiah" ];
-      # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age
-      # tokenFile = config.age.secrets.gitea-runner-jeremiah.path;
-    };
   };
 
   hardware = {

hosts/unstable/linode/default.nix

@@ -23,12 +23,14 @@
     pgloader
   ];
 
-  age.secrets = {
-    # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age
-    # gitea-runner-linode.file = ../../../secrets/gitea-runner-linode.age;
-  };
-
   greg = {
+    gitea-runner = {
+      enable = true;
+      extraLabels = [
+        "vps:host"
+        "blog:host"
+      ];
+    };
     home = false;
     linode.enable = true;
     nebula = {
@@ -41,12 +43,6 @@
       ssl = true;
     };
     tailscale.enable = true;
-    gitea-runner = {
-      enable = true;
-      labels = [ "self-hosted" "host:linode" ];
-      # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age
-      # tokenFile = config.age.secrets.gitea-runner-linode.path;
-    };
   };
 
   networking = {

hosts/unstable/zeke/default.nix

@@ -14,15 +14,13 @@
     top.nix-hardware.nixosModules.system76
   ];
 
-  age.secrets = {
-    gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
-    # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age
-    # gitea-runner-zeke.file = ../../../secrets/gitea-runner-zeke.age;
-  };
-
   boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
 
   greg = {
+    gitea-runner = {
+      enable = true;
+      extraLabels = [ "bare-metal:host" ];
+    };
     kubernetes = {
       enable = true;
       vipInterface = "enp12s0";
@@ -34,12 +32,6 @@
       enable = true;
       vbox = false;
     };
-    gitea-runner = {
-      enable = true;
-      labels = [ "self-hosted" "bare-metal" "host:zeke" ];
-      # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age
-      # tokenFile = config.age.secrets.gitea-runner-zeke.path;
-    };
     tailscale = {
       enable = true;
       tags = [ "home" ];

modules/nixos/gitea-runner.nix

@@ -6,6 +6,8 @@
 }:
 let
   cfg = config.greg.gitea-runner;
+  host = config.networking.hostName;
+  labels = cfg.labels ++ cfg.extraLabels;
 in
 {
   options.greg.gitea-runner = {
@@ -23,26 +25,80 @@ in
       description = "Name of the runner (defaults to hostname)";
     };
 
+    capacity = lib.mkOption {
+      type = lib.types.int;
+      default = 5;
+      description = "Number of concurrent jobs the runner can handle";
+    };
+
+    extraLabels = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+    };
+
     labels = lib.mkOption {
       type = lib.types.listOf lib.types.str;
-      default = [ "self-hosted" ];
+      default = [
+        "self-hosted:host"
+        "nixos-${host}:host"
+
+        "debian-latest:docker://node:25-trixie"
+
+        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+
+        "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
+        "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
+        "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
+
+        "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+        "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
+        "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
+
+        "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
+        "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
+        "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
+
+        "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
+        "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
+        "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
+
+        "nix-latest:docker://src.thehellings.com/greg/builder:latest"
+      ];
       description = "Labels to assign to this runner";
     };
 
     tokenFile = lib.mkOption {
       type = lib.types.path;
       description = "Path to a file containing the runner registration token (from agenix)";
+      default = ../../secrets/gitea/runner-isaiah-podman.age;
     };
   };
 
   config = lib.mkIf cfg.enable {
+    age.secrets."gitea-runner-${host}-podman".file = cfg.tokenFile;
+
+    environment.systemPackages = with pkgs; [
+      bash
+      git
+      nodejs
+    ];
+
+    greg.podman.enable = true;
+
     services.gitea-actions-runner = {
       package = pkgs.gitea-actions-runner;
       instances.${cfg.name} = {
+        inherit labels;
+        inherit (cfg) name;
         enable = true;
         url = cfg.instanceURL;
-        tokenFile = cfg.tokenFile;
-        labels = cfg.labels;
+        tokenFile = config.age.secrets."gitea-runner-${host}-podman".path;
+        settings = {
+          container.force_pull = true;
+          runner.capacity = cfg.capacity;
+        };
       };
     };
   };

secrets/secrets.nix

@@ -100,7 +100,7 @@ in
   "gitea/oauthToken.age".publicKeys = everyone;
   "gitea/webhookSecret.age".publicKeys = everyone;
   "gitea/workerPassword.age".publicKeys = everyone;
-  "gitea/runner-podman-isaiah.age".publicKeys = users ++ [ hosts.isaiah.pubkey ];
+  "gitea/runner-isaiah-podman.age".publicKeys = everyone;
 
   "gitlab/secret.age".publicKeys = everyone;
   "gitlab/otp.age".publicKeys = everyone;