fix: remove files before re-upload in Immich backup

- Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in
  shell mode, with options for enable, instanceURL, name, labels, and
  tokenFile (agenix secret path).
- Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with
  appropriate labels. Agenix secret placeholders left with TODOs.
- Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday
  midnight) that runs nix flake update and opens a PR if flake.lock
  changed, using GITEA_TOKEN secret for authentication.

Closes part of #15 (NixOS shell runners + flake-lock workflow).

hosts/unstable/isaiah/default.nix

@@ -9,12 +9,6 @@
     ./hardware-configuration.nix
   ];
 
-  age.secrets = {
-    gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age;
-    gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
-    runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age;
-  };
-
   boot = {
     binfmt.emulatedSystems = [ "aarch64-linux" ];
     extraModprobeConfig = "options kvm_amd nested=1";
@@ -53,6 +47,10 @@
       enable = true;
       qemu = true;
     };
+    gitea-runner = {
+      enable = true;
+      extraLabels = [ "bare-metal:host" ];
+    };
   };
 
   networking = {
@@ -67,41 +65,6 @@
   };
 
   services = {
-    gitea-actions-runner.instances.podman = {
-      enable = true;
-      labels = [
-        "debian-latest:docker://node:25-trixie"
-
-        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
-        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
-        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
-
-        "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
-        "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
-        "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
-
-        "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
-        "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
-        "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
-
-        "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
-        "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
-        "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
-
-        "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
-        "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
-        "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
-
-        "nix-latest:docker://src.thehellings.com/greg/builder:latest"
-      ];
-      name = "isaiah-podman";
-      settings = {
-        container.force_pull = true;
-        runner.capacity = 7;
-      };
-      tokenFile = config.age.secrets.gitea-runner-isaiah-podman.path;
-      url = "https://gitea.shire-zebra.ts.net";
-    };
     k3s.clusterInit = true; # This is the first node in the cluster
     openssh = {
       enable = true;

hosts/unstable/jeremiah/default.nix

@@ -78,6 +78,10 @@ in
   };
 
   greg = {
+    gitea-runner = {
+      enable = true;
+      extraLabels = [ "bare-metal:host" ];
+    };
     home = true;
     kubernetes = {
       enable = true;

hosts/unstable/linode/default.nix

@@ -24,6 +24,13 @@
   ];
 
   greg = {
+    gitea-runner = {
+      enable = true;
+      extraLabels = [
+        "vps:host"
+        "blog:host"
+      ];
+    };
     home = false;
     linode.enable = true;
     nebula = {

hosts/unstable/zeke/default.nix

@@ -14,13 +14,13 @@
     top.nix-hardware.nixosModules.system76
   ];
 
-  age.secrets = {
-    gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
-  };
-
   boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
 
   greg = {
+    gitea-runner = {
+      enable = true;
+      extraLabels = [ "bare-metal:host" ];
+    };
     kubernetes = {
       enable = true;
       vipInterface = "enp12s0";

manifests/immich/backup.yaml

@@ -96,6 +96,7 @@ spec:
                 - /bin/sh
                 - "-c"
                 - >-
+                  rm -r /staging/*;
                   immich-go
                   archive
                   "--write-to-folder"

modules/nixos/default.nix

@@ -8,6 +8,7 @@
     ./backup.nix
     ./ceph.nix
     ./db.nix
+    ./gitea-runner.nix
     ./gitlab-runner.nix
     ./gnome.nix
     ./home.nix

modules/nixos/gitea-runner.nix

@@ -6,58 +6,98 @@
 }:
 let
   cfg = config.greg.gitea-runner;
-  hostname = config.networking.hostName;
-
-  # Determine extra labels based on host role
-  roleLabels =
-    if builtins.elem hostname [ "isaiah" "jeremiah" "zeke" ] then
-      [ "bare-metal" ]
-    else if hostname == "linode" then
-      [ "linode" ]
-    else
-      [ ];
+  host = config.networking.hostName;
+  labels = cfg.labels ++ cfg.extraLabels;
 in
 {
   options.greg.gitea-runner = {
-    enable = lib.mkEnableOption "Enable Gitea Actions runner (exec/shell mode)";
+    enable = lib.mkEnableOption "Enable Gitea act_runner (shell mode)";
 
-    hostnameLabel = lib.mkOption {
+    instanceURL = lib.mkOption {
+      type = lib.types.str;
+      default = "https://src.thehellings.com";
+      description = "URL of the Gitea instance to connect to";
+    };
+
+    name = lib.mkOption {
       type = lib.types.str;
       default = config.networking.hostName;
-      description = "Label identifying this host in the runner pool (defaults to hostname)";
+      description = "Name of the runner (defaults to hostname)";
+    };
+
+    capacity = lib.mkOption {
+      type = lib.types.int;
+      default = 5;
+      description = "Number of concurrent jobs the runner can handle";
+    };
+
+    extraLabels = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+    };
+
+    labels = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [
+        "self-hosted:host"
+        "nixos-${host}:host"
+
+        "debian-latest:docker://node:25-trixie"
+
+        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+
+        "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
+        "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
+        "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
+
+        "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+        "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
+        "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
+
+        "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
+        "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
+        "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
+
+        "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
+        "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
+        "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
+
+        "nix-latest:docker://src.thehellings.com/greg/builder:latest"
+      ];
+      description = "Labels to assign to this runner";
     };
 
     tokenFile = lib.mkOption {
       type = lib.types.path;
-      description = ''
-        Path to the file containing the runner registration token.
-        Wire in your agenix secret path here, e.g.:
-          config.age.secrets.gitea-runner-token.path
-      '';
-    };
-
-    threads = lib.mkOption {
-      type = lib.types.int;
-      default = 4;
-      description = "Maximum number of concurrent jobs";
+      description = "Path to a file containing the runner registration token (from agenix)";
+      default = ../../secrets/gitea/runner-isaiah-podman.age;
     };
   };
 
   config = lib.mkIf cfg.enable {
+    age.secrets."gitea-runner-${host}-podman".file = cfg.tokenFile;
+
+    environment.systemPackages = with pkgs; [
+      bash
+      git
+      nodejs
+    ];
+
+    greg.podman.enable = true;
+
     services.gitea-actions-runner = {
       package = pkgs.gitea-actions-runner;
-      instances.${hostname} = {
+      instances.${cfg.name} = {
+        inherit labels;
+        inherit (cfg) name;
         enable = true;
-        url = "https://src.thehellings.com";
-        tokenFile = cfg.tokenFile;
-        labels =
-          [
-            "self-hosted"
-            cfg.hostnameLabel
-          ]
-          ++ roleLabels;
+        url = cfg.instanceURL;
+        tokenFile = config.age.secrets."gitea-runner-${host}-podman".path;
         settings = {
-          runner.capacity = cfg.threads;
+          container.force_pull = true;
+          runner.capacity = cfg.capacity;
         };
       };
     };

secrets/secrets.nix

@@ -100,7 +100,7 @@ in
   "gitea/oauthToken.age".publicKeys = everyone;
   "gitea/webhookSecret.age".publicKeys = everyone;
   "gitea/workerPassword.age".publicKeys = everyone;
-  "gitea/runner-podman-isaiah.age".publicKeys = users ++ [ hosts.isaiah.pubkey ];
+  "gitea/runner-isaiah-podman.age".publicKeys = everyone;
 
   "gitlab/secret.age".publicKeys = everyone;
   "gitlab/otp.age".publicKeys = everyone;