feat: Gitea Actions shell runners + flake-lock workflow

- Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in
  shell mode, with options for enable, instanceURL, name, labels, and
  tokenFile (agenix secret path).
- Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with
  appropriate labels. Agenix secret placeholders left with TODOs.
- Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday
  midnight) that runs nix flake update and opens a PR if flake.lock
  changed, using GITEA_TOKEN secret for authentication.

Closes part of #15 (NixOS shell runners + flake-lock workflow).

hosts/unstable/isaiah/default.nix

@@ -13,6 +13,8 @@
     gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age;
     gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
     runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age;
+    # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age
+    # gitea-runner-isaiah.file = ../../../secrets/gitea-runner-isaiah.age;
   };
 
   boot = {
@@ -53,6 +55,12 @@
       enable = true;
       qemu = true;
     };
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "bare-metal" "host:isaiah" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age
+      # tokenFile = config.age.secrets.gitea-runner-isaiah.path;
+    };
   };
 
   networking = {

hosts/unstable/jeremiah/default.nix

@@ -29,6 +29,8 @@ in
     gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age;
     gitea-webhookSecret = mk ../../../secrets/gitea/webhookSecret.age;
     gitea-workerPassword = mk ../../../secrets/gitea/workerPassword.age;
+    # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age
+    # gitea-runner-jeremiah.file = ../../../secrets/gitea-runner-jeremiah.age;
   };
 
   # Bootloader.
@@ -96,6 +98,12 @@ in
       threads = 3;
       qemu = true;
     };
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "bare-metal" "host:jeremiah" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age
+      # tokenFile = config.age.secrets.gitea-runner-jeremiah.path;
+    };
   };
 
   hardware = {

hosts/unstable/linode/default.nix

@@ -23,6 +23,11 @@
     pgloader
   ];
 
+  age.secrets = {
+    # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age
+    # gitea-runner-linode.file = ../../../secrets/gitea-runner-linode.age;
+  };
+
   greg = {
     home = false;
     linode.enable = true;
@@ -36,6 +41,12 @@
       ssl = true;
     };
     tailscale.enable = true;
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "host:linode" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age
+      # tokenFile = config.age.secrets.gitea-runner-linode.path;
+    };
   };
 
   networking = {

hosts/unstable/zeke/default.nix

@@ -16,6 +16,8 @@
 
   age.secrets = {
     gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
+    # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age
+    # gitea-runner-zeke.file = ../../../secrets/gitea-runner-zeke.age;
   };
 
   boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
@@ -32,6 +34,12 @@
       enable = true;
       vbox = false;
     };
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "bare-metal" "host:zeke" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age
+      # tokenFile = config.age.secrets.gitea-runner-zeke.path;
+    };
     tailscale = {
       enable = true;
       tags = [ "home" ];

modules/nixos/default.nix

@@ -8,6 +8,7 @@
     ./backup.nix
     ./ceph.nix
     ./db.nix
+    ./gitea-runner.nix
     ./gitlab-runner.nix
     ./gnome.nix
     ./home.nix

modules/nixos/gitea-runner.nix

@@ -6,59 +6,43 @@
 }:
 let
   cfg = config.greg.gitea-runner;
-  hostname = config.networking.hostName;
-
-  # Determine extra labels based on host role
-  roleLabels =
-    if builtins.elem hostname [ "isaiah" "jeremiah" "zeke" ] then
-      [ "bare-metal" ]
-    else if hostname == "linode" then
-      [ "linode" ]
-    else
-      [ ];
 in
 {
   options.greg.gitea-runner = {
-    enable = lib.mkEnableOption "Enable Gitea Actions runner (exec/shell mode)";
+    enable = lib.mkEnableOption "Enable Gitea act_runner (shell mode)";
 
-    hostnameLabel = lib.mkOption {
+    instanceURL = lib.mkOption {
+      type = lib.types.str;
+      default = "https://src.thehellings.com";
+      description = "URL of the Gitea instance to connect to";
+    };
+
+    name = lib.mkOption {
       type = lib.types.str;
       default = config.networking.hostName;
-      description = "Label identifying this host in the runner pool (defaults to hostname)";
+      description = "Name of the runner (defaults to hostname)";
+    };
+
+    labels = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ "self-hosted" ];
+      description = "Labels to assign to this runner";
     };
 
     tokenFile = lib.mkOption {
       type = lib.types.path;
-      description = ''
-        Path to the file containing the runner registration token.
-        Wire in your agenix secret path here, e.g.:
-          config.age.secrets.gitea-runner-token.path
-      '';
-    };
-
-    threads = lib.mkOption {
-      type = lib.types.int;
-      default = 4;
-      description = "Maximum number of concurrent jobs";
+      description = "Path to a file containing the runner registration token (from agenix)";
     };
   };
 
   config = lib.mkIf cfg.enable {
     services.gitea-actions-runner = {
       package = pkgs.gitea-actions-runner;
-      instances.${hostname} = {
+      instances.${cfg.name} = {
         enable = true;
-        url = "https://src.thehellings.com";
+        url = cfg.instanceURL;
         tokenFile = cfg.tokenFile;
-        labels =
-          [
-            "self-hosted"
-            cfg.hostnameLabel
-          ]
-          ++ roleLabels;
-        settings = {
-          runner.capacity = cfg.threads;
-        };
+        labels = cfg.labels;
       };
     };
   };