feat: Gitea Actions shell runners + flake-lock workflow

- Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in
  shell mode, with options for enable, instanceURL, name, labels, and
  tokenFile (agenix secret path).
- Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with
  appropriate labels. Agenix secret placeholders left with TODOs.
- Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday
  midnight) that runs nix flake update and opens a PR if flake.lock
  changed, using GITEA_TOKEN secret for authentication.

Closes part of #15 (NixOS shell runners + flake-lock workflow).

.gitea/workflows/update-flake-lock.yaml

@@ -0,0 +1,57 @@
+name: Update flake.lock
+
+on:
+  schedule:
+    - cron: '0 0 * * 0'  # Every Sunday at midnight UTC
+  workflow_dispatch:
+
+jobs:
+  update-flake-lock:
+    runs-on: [self-hosted, bare-metal]
+    container:
+      image: nixos/nix:latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure Nix
+        run: |
+          mkdir -p /etc/nix
+          echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
+
+      - name: Update flake.lock
+        run: nix flake update
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet flake.lock; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Commit and open PR
+        if: steps.changes.outputs.changed == 'true'
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          BRANCH="automated/flake-lock-$(date +%Y%m%d)"
+          git config user.name "klaatu"
+          git config user.email "klaatu@thehellings.com"
+          git checkout -b "$BRANCH"
+          git add flake.lock
+          git commit -m "chore: update flake.lock"
+          git push origin "$BRANCH"
+
+          # Open PR via Gitea API
+          curl -s -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"title\": \"chore: update flake.lock\",
+              \"head\": \"${BRANCH}\",
+              \"base\": \"main\",
+              \"body\": \"Automated weekly flake.lock update.\n\nGenerated by the update-flake-lock workflow.\"
+            }" \
+            "${GITHUB_SERVER_URL%/}/api/v1/repos/${GITHUB_REPOSITORY}/pulls"

hosts/unstable/hosea/default.nix

@@ -60,6 +60,12 @@ in
       enable = true;
       tags = [ "home" ];
     };
+    backup.jobs.albyhub = {
+      src = "/chain/alby";
+      dest = "albyhub";
+      pre = "systemctl stop albyhub || true";
+      post = "systemctl start albyhub";
+    };
   };
 
   hardware = {

hosts/unstable/isaiah/default.nix

@@ -13,6 +13,8 @@
     gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age;
     gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
     runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age;
+    # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age
+    # gitea-runner-isaiah.file = ../../../secrets/gitea-runner-isaiah.age;
   };
 
   boot = {
@@ -53,6 +55,12 @@
       enable = true;
       qemu = true;
     };
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "bare-metal" "host:isaiah" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age
+      # tokenFile = config.age.secrets.gitea-runner-isaiah.path;
+    };
   };
 
   networking = {

hosts/unstable/jeremiah/default.nix

@@ -29,6 +29,8 @@ in
     gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age;
     gitea-webhookSecret = mk ../../../secrets/gitea/webhookSecret.age;
     gitea-workerPassword = mk ../../../secrets/gitea/workerPassword.age;
+    # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age
+    # gitea-runner-jeremiah.file = ../../../secrets/gitea-runner-jeremiah.age;
   };
 
   # Bootloader.
@@ -86,13 +88,6 @@ in
       priority = 254;
     };
     nebula.enable = true;
-    proxies = {
-      # Expose Buildbot over HTTP on the LAN so Klaatu (and other internal
-      # tools) can reach it without Tailscale.  Buildbot's own Gitea OAuth
-      # handles authentication.
-      "buildbot.home".target = "http://localhost:8010/";
-      "buildbot.thehellings.lan".target = "http://localhost:8010/";
-    };
     tailscale = {
       enable = true;
       tags = [ "home" ];
@@ -103,6 +98,12 @@ in
       threads = 3;
       qemu = true;
     };
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "bare-metal" "host:jeremiah" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-jeremiah.age
+      # tokenFile = config.age.secrets.gitea-runner-jeremiah.path;
+    };
   };
 
   hardware = {
@@ -123,6 +124,7 @@ in
       interface = "br0";
     };
     firewall.allowedTCPPorts = [
+      8010
       3389
       9989 # buildbot communications port
     ];
@@ -151,7 +153,7 @@ in
             updateOutputs = false;
           };
         };
-        domain = "${config.networking.hostName}.shire-zebra.ts.net:8010";
+        domain = "${config.networking.hostName}.shire-zebra.ts.net";
         evalMaxMemorySize = 8192;
         evalWorkerCount = 4;
         gitea = {

hosts/unstable/linode/default.nix

@@ -23,6 +23,11 @@
     pgloader
   ];
 
+  age.secrets = {
+    # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age
+    # gitea-runner-linode.file = ../../../secrets/gitea-runner-linode.age;
+  };
+
   greg = {
     home = false;
     linode.enable = true;
@@ -36,6 +41,12 @@
       ssl = true;
     };
     tailscale.enable = true;
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "host:linode" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-linode.age
+      # tokenFile = config.age.secrets.gitea-runner-linode.path;
+    };
   };
 
   networking = {

hosts/unstable/zeke/default.nix

@@ -16,6 +16,8 @@
 
   age.secrets = {
     gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
+    # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age
+    # gitea-runner-zeke.file = ../../../secrets/gitea-runner-zeke.age;
   };
 
   boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
@@ -32,6 +34,12 @@
       enable = true;
       vbox = false;
     };
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "bare-metal" "host:zeke" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-zeke.age
+      # tokenFile = config.age.secrets.gitea-runner-zeke.path;
+    };
     tailscale = {
       enable = true;
       tags = [ "home" ];

manifests/gitea/chart.yaml

@@ -92,6 +92,8 @@ spec:
           # MINIO_SECRET_ACCESS_KEY: ""
           MINIO_USE_SSL: "false"
           MINIO_INSECURE_SKIP_VERIFY: "true"
+        webhook:
+          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net
 
       metrics:
         enabled: false

manifests/gitea/dump-cronjob.yaml

@@ -0,0 +1,76 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: gitea-dump
+spec:
+  schedule: "0 3 * * *"
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            fsGroup: 1000
+          volumes:
+            - name: gitea-data
+              persistentVolumeClaim:
+                claimName: gitea-shared-storage
+            - name: dump-staging
+              emptyDir: {}
+          initContainers:
+            - name: gitea-dump
+              image: "gitea/gitea:1.25.4"
+              command:
+                - /bin/sh
+                - "-c"
+                - |
+                  set -e
+                  TIMESTAMP=$(date +%Y%m%d-%H%M%S)
+                  OUTFILE="/dump-staging/gitea-dump-${TIMESTAMP}.zip"
+                  gitea dump \
+                    --config /data/gitea/conf/app.ini \
+                    --file "${OUTFILE}" \
+                    --type zip
+                  echo "Dump written to ${OUTFILE}"
+              volumeMounts:
+                - name: gitea-data
+                  mountPath: /data
+                  readOnly: true
+                - name: dump-staging
+                  mountPath: /dump-staging
+          containers:
+            - name: upload-to-s3
+              image: "minio/mc:latest"
+              command:
+                - /bin/sh
+                - "-c"
+                - |
+                  set -e
+                  # Configure mc alias for MinIO
+                  mc alias set nas1 http://nas1.shire-zebra.ts.net:9000 \
+                    "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
+                  # Upload dump to backup-gitea bucket
+                  DUMP_FILE=$(ls /dump-staging/gitea-dump-*.zip | head -1)
+                  mc cp "${DUMP_FILE}" "nas1/backup-gitea/$(basename ${DUMP_FILE})"
+                  echo "Uploaded $(basename ${DUMP_FILE}) to backup-gitea"
+                  # Set 30-day lifecycle on the bucket (idempotent)
+                  mc ilm rule add --expire-days 30 nas1/backup-gitea 2>/dev/null || true
+              volumeMounts:
+                - name: dump-staging
+                  mountPath: /dump-staging
+                  readOnly: true
+              env:
+                - name: MINIO_ACCESS_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-config
+                      key: minio_key
+                - name: MINIO_SECRET_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-config
+                      key: minio_secret

manifests/gitea/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - chart.yaml
   - ingress.yaml
   - secrets.yaml
+  - dump-cronjob.yaml

manifests/gitea/secrets.yaml

@@ -15,6 +15,8 @@ spec:
         storage: |-
           MINIO_ACCESS_KEY_ID={{ .minio_key }}
           MINIO_SECRET_ACCESS_KEY={{ .minio_secret }}
+        minio_key: "{{ .minio_key }}"
+        minio_secret: "{{ .minio_secret }}"
   secretStoreRef:
     name: bitwarden-login
     kind: ClusterSecretStore

manifests/immich/backup.yaml

@@ -19,23 +19,76 @@ spec:
         key: "dd0de40c-9ad6-4034-9d5c-b311016ebf19"
         property: apikey
 ---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: immich-minio-creds
+spec:
+  target:
+    name: immich-minio-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        access-key: "{{ .minio_key }}"
+        secret-key: "{{ .minio_secret }}"
+        rclone.conf: |
+          [nas1minio]
+          type = s3
+          provider = Minio
+          endpoint = http://nas1.shire-zebra.ts.net:9000
+          access_key_id = {{ .minio_key }}
+          secret_access_key = {{ .minio_secret }}
+          region = us-east-1
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  data:
+    - secretKey: minio_key
+      remoteRef:
+        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
+        property: username
+    - secretKey: minio_secret
+      remoteRef:
+        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
+        property: password
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: immich-backup-staging
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-default
+  resources:
+    requests:
+      storage: 400Gi
+---
 apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: backup
 spec:
   schedule: "0 4 * * *" # At 4am each day
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
   jobTemplate:
     spec:
       template:
         spec:
           restartPolicy: Never
           volumes:
-            - name: nas1
-              nfs:
-                path: /mnt/all/backups/immich
-                server: nas1.shire-zebra.ts.net
-          containers:
+            - name: staging
+              persistentVolumeClaim:
+                claimName: immich-backup-staging
+            - name: rclone-config
+              secret:
+                secretName: immich-minio-creds
+                items:
+                  - key: rclone.conf
+                    path: rclone.conf
+          initContainers:
             - name: immich-go
               image: "src.thehellings.com/greg/immich:latest"
               imagePullPolicy: "Always"
@@ -46,18 +99,38 @@ spec:
                   immich-go
                   archive
                   "--write-to-folder"
-                  /nas1
+                  /staging
                   from-immich
                   "--from-api-key"
                   "$IMMICH_API_KEY"
                   "--from-server"
                   "http://immich-server:2283"
               volumeMounts:
-                - name: nas1
-                  mountPath: /nas1
+                - name: staging
+                  mountPath: /staging
               env:
                 - name: IMMICH_API_KEY
                   valueFrom:
                     secretKeyRef:
                       name: immich-login
                       key: apikey
+          containers:
+            - name: rclone-sync
+              image: "rclone/rclone:1.68"
+              command:
+                - /bin/sh
+                - "-c"
+                - |
+                  rclone sync \
+                    --config /rclone-config/rclone.conf \
+                    --checksum \
+                    --progress \
+                    --transfers 4 \
+                    --checkers 8 \
+                    /staging nas1minio:immich
+              volumeMounts:
+                - name: staging
+                  mountPath: /staging
+                - name: rclone-config
+                  mountPath: /rclone-config
+                  readOnly: true

modules/nixos/default.nix

@@ -8,6 +8,7 @@
     ./backup.nix
     ./ceph.nix
     ./db.nix
+    ./gitea-runner.nix
     ./gitlab-runner.nix
     ./gnome.nix
     ./home.nix

modules/nixos/gitea-runner.nix

@@ -0,0 +1,88 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.greg.gitea-runner;
+in
+{
+  options.greg.gitea-runner = {
+    enable = lib.mkEnableOption "Enable Gitea act_runner (shell mode)";
+
+    instanceURL = lib.mkOption {
+      type = lib.types.str;
+      default = "https://src.thehellings.com";
+      description = "URL of the Gitea instance to connect to";
+    };
+
+    name = lib.mkOption {
+      type = lib.types.str;
+      default = config.networking.hostName;
+      description = "Name of the runner (defaults to hostname)";
+    };
+
+    labels = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ "self-hosted" ];
+      description = "Labels to assign to this runner";
+    };
+
+    tokenFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to a file containing the runner registration token (from agenix)";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.gitea-actions-runner ];
+
+    systemd.services.gitea-runner = {
+      description = "Gitea Actions Runner";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      environment = {
+        GITEA_INSTANCE_URL = cfg.instanceURL;
+        GITEA_RUNNER_NAME = cfg.name;
+        GITEA_RUNNER_LABELS = lib.concatStringsSep "," cfg.labels;
+        HOME = "/var/lib/gitea-runner";
+      };
+
+      serviceConfig = {
+        Type = "simple";
+        User = "gitea-runner";
+        Group = "gitea-runner";
+        StateDirectory = "gitea-runner";
+        WorkingDirectory = "/var/lib/gitea-runner";
+        ExecStartPre = pkgs.writeShellScript "gitea-runner-register" ''
+          set -euo pipefail
+          CONFIG_FILE="/var/lib/gitea-runner/.runner"
+          if [ ! -f "$CONFIG_FILE" ]; then
+            TOKEN="$(cat ${cfg.tokenFile})"
+            ${pkgs.gitea-actions-runner}/bin/act_runner register \
+              --no-interactive \
+              --instance "$GITEA_INSTANCE_URL" \
+              --token "$TOKEN" \
+              --name "$GITEA_RUNNER_NAME" \
+              --labels "$GITEA_RUNNER_LABELS"
+          fi
+        '';
+        ExecStart = "${pkgs.gitea-actions-runner}/bin/act_runner daemon";
+        Restart = "on-failure";
+        RestartSec = "5s";
+      };
+    };
+
+    users.users.gitea-runner = {
+      isSystemUser = true;
+      group = "gitea-runner";
+      home = "/var/lib/gitea-runner";
+      createHome = true;
+      description = "Gitea Actions Runner service user";
+    };
+
+    users.groups.gitea-runner = { };
+  };
+}