feat: Gitea Actions shell runners + flake-lock workflow

- Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in
  shell mode, with options for enable, instanceURL, name, labels, and
  tokenFile (agenix secret path).
- Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with
  appropriate labels. Agenix secret placeholders left with TODOs.
- Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday
  midnight) that runs nix flake update and opens a PR if flake.lock
  changed, using GITEA_TOKEN secret for authentication.

Closes part of #15 (NixOS shell runners + flake-lock workflow).

.gitea/workflows/update-flake-lock.yaml

@@ -2,56 +2,50 @@ name: Update flake.lock
 
 on:
   schedule:
-    - cron: '0 0 * * 0'  # Every Sunday at midnight UTC
+    - cron: "0 0 * * 0"  # Every Sunday at midnight UTC
   workflow_dispatch:
 
 jobs:
   update-flake-lock:
-    runs-on: [self-hosted, bare-metal]
-    container:
-      image: nixos/nix:latest
+    runs-on: [self-hosted, nix]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Configure Nix
-        run: |
-          mkdir -p /etc/nix
-          echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
-
       - name: Update flake.lock
         run: nix flake update
 
-      - name: Check for changes
-        id: changes
+      - name: Create PR if changed
+        env:
+          GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
+          GITEA_URL: https://src.thehellings.com
+          REPO: greg/nixos
         run: |
           if git diff --quiet flake.lock; then
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "flake.lock unchanged, nothing to do"
+            exit 0
           fi
 
-      - name: Commit and open PR
-        if: steps.changes.outputs.changed == 'true'
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-        run: |
-          BRANCH="automated/flake-lock-$(date +%Y%m%d)"
-          git config user.name "klaatu"
+          BRANCH="auto/update-flake-lock-$(date +%Y%m%d)"
           git config user.email "klaatu@thehellings.com"
+          git config user.name "klaatu"
           git checkout -b "$BRANCH"
           git add flake.lock
-          git commit -m "chore: update flake.lock"
+          git commit -m "chore: update flake.lock $(date +%Y-%m-%d)"
+
+          # Push branch using token auth
+          git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
           git push origin "$BRANCH"
 
-          # Open PR via Gitea API
+          # Create PR via Gitea API
           curl -s -X POST \
             -H "Authorization: token ${GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
             -d "{
-              \"title\": \"chore: update flake.lock\",
-              \"head\": \"${BRANCH}\",
+              \"title\": \"chore: update flake.lock $(date +%Y-%m-%d)\",
+              \"head\": \"$BRANCH\",
               \"base\": \"main\",
-              \"body\": \"Automated weekly flake.lock update.\n\nGenerated by the update-flake-lock workflow.\"
-            }" \
-            "${GITHUB_SERVER_URL%/}/api/v1/repos/${GITHUB_REPOSITORY}/pulls"
+              \"body\": \"Automated weekly flake.lock update.\\n\\nGenerated by Gitea Actions.\",
+              \"assignees\": [\"greg\"]
+            }"

.gitea/workflows/update-manifests.yaml

@@ -0,0 +1,58 @@
+name: Update manifest chart versions
+
+on:
+  schedule:
+    - cron: "0 0 * * 1"  # Every Monday at midnight UTC
+  workflow_dispatch:
+
+jobs:
+  update-manifests:
+    runs-on: [self-hosted, nix]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Scan manifests for chart version updates
+        run: |
+          echo "TODO: implement manifest update scanning"
+          echo ""
+          echo "Planned implementation:"
+          echo "  1. Parse each manifests/*/chart.yaml for HelmRelease chart versions"
+          echo "  2. Query artifact hub or helm repo for latest versions"
+          echo "  3. Emit a diff of available updates"
+          echo ""
+          echo "Scanned manifests directories:"
+          ls manifests/
+
+      - name: Create PR if changes found
+        env:
+          GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
+          GITEA_URL: https://src.thehellings.com
+          REPO: greg/nixos
+        run: |
+          if git diff --quiet; then
+            echo "No manifest changes, nothing to do"
+            exit 0
+          fi
+
+          BRANCH="auto/update-manifests-$(date +%Y%m%d)"
+          git config user.email "klaatu@thehellings.com"
+          git config user.name "klaatu"
+          git checkout -b "$BRANCH"
+          git add manifests/
+          git commit -m "chore: update manifest chart versions $(date +%Y-%m-%d)"
+
+          git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
+          git push origin "$BRANCH"
+
+          curl -s -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
+            -d "{
+              \"title\": \"chore: update manifest chart versions $(date +%Y-%m-%d)\",
+              \"head\": \"$BRANCH\",
+              \"base\": \"main\",
+              \"body\": \"Automated weekly manifest chart version update.\\n\\nGenerated by Gitea Actions.\",
+              \"assignees\": [\"greg\"]
+            }"

manifests/gitea-runner/chart.yaml

@@ -0,0 +1,56 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: gitea
+spec:
+  interval: "24h"
+  url: https://dl.gitea.com/charts/
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea-runner
+  namespace: gitea-runner
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: actions
+      version: "0.0.4"
+      sourceRef:
+        kind: HelmRepository
+        name: gitea
+      interval: "1h"
+  values:
+    rbac:
+      create: true
+    serviceAccount:
+      create: true
+    gitea:
+      instanceURL: https://src.thehellings.com
+      runnerToken:
+        existingSecret: gitea-runner
+        existingSecretKey: token
+    imagePullSecrets:
+      - name: image-pull-secrets
+    config:
+      runner:
+        labels:
+          # Ubuntu
+          - "ubuntu-22.04:docker://ubuntu:22.04"
+          - "ubuntu-24.04:docker://ubuntu:24.04"
+          - "ubuntu-24.10:docker://ubuntu:24.10"
+          # Fedora
+          - "fedora-41:docker://fedora:41"
+          - "fedora-42:docker://fedora:42"
+          # CentOS Stream
+          - "centos-stream-9:docker://quay.io/centos/centos:stream9"
+          - "centos-stream-10:docker://quay.io/centos/centos:stream10"
+          # Nix
+          - "nix:docker://nixos/nix:latest"
+          # ci-images (internal registry: src.thehellings.com/greg)
+          - "ci-builder:docker://src.thehellings.com/greg/builder:latest"
+          - "ci-vm-test:docker://src.thehellings.com/greg/vm-test:latest"
+          - "ci-sword:docker://src.thehellings.com/greg/sword-container-builder:latest"
+          - "ci-bitwarden:docker://src.thehellings.com/greg/bitwarden:latest"
+          - "ci-immich:docker://src.thehellings.com/greg/immich:latest"

manifests/gitea-runner/kustomization.yaml

@@ -0,0 +1,6 @@
+namespace: gitea-runner
+
+resources:
+  - namespace.yaml
+  - secrets.yaml
+  - chart.yaml

manifests/gitea-runner/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea-runner

manifests/gitea-runner/secrets.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-runner
+  namespace: gitea-runner
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  target:
+    name: gitea-runner
+    creationPolicy: Owner
+  data:
+    - secretKey: token
+      remoteRef:
+        key: 11419680-5338-4f19-bdd9-b422007046af
+        property: password

manifests/gitea/dump-cronjob.yaml

@@ -64,6 +64,8 @@ spec:
                   mountPath: /dump-staging
                   readOnly: true
               env:
+                - name: MC_CONFIG_DIR
+                  value: /tmp/.mc
                 - name: MINIO_ACCESS_KEY
                   valueFrom:
                     secretKeyRef:
@@ -74,3 +76,4 @@ spec:
                     secretKeyRef:
                       name: gitea-config
                       key: minio_secret
+

manifests/gitea/secrets.yaml

@@ -15,8 +15,8 @@ spec:
         storage: |-
           MINIO_ACCESS_KEY_ID={{ .minio_key }}
           MINIO_SECRET_ACCESS_KEY={{ .minio_secret }}
-        minio_key: "{{ .minio_key }}"
-        minio_secret: "{{ .minio_secret }}"
+        minio_key: "{{ .minio_nas1_key }}"
+        minio_secret: "{{ .minio_nas1_secret }}"
   secretStoreRef:
     name: bitwarden-login
     kind: ClusterSecretStore
@@ -30,6 +30,15 @@ spec:
       remoteRef:
         key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
         property: password
+    # MinIO credentials for NAS1
+    - secretKey: minio_nas1_key
+      remoteRef:
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        property: username
+    - secretKey: minio_nas1_secret
+      remoteRef:
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        property: password
     # Postgres credentials
     - secretKey: dbuser
       remoteRef:

manifests/immich/backup.yaml

@@ -46,11 +46,11 @@ spec:
   data:
     - secretKey: minio_key
       remoteRef:
-        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
         property: username
     - secretKey: minio_secret
       remoteRef:
-        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
         property: password
 ---
 apiVersion: v1

modules/nixos/gitea-runner.nix

@@ -36,53 +36,14 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.gitea-actions-runner ];
-
-    systemd.services.gitea-runner = {
-      description = "Gitea Actions Runner";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-
-      environment = {
-        GITEA_INSTANCE_URL = cfg.instanceURL;
-        GITEA_RUNNER_NAME = cfg.name;
-        GITEA_RUNNER_LABELS = lib.concatStringsSep "," cfg.labels;
-        HOME = "/var/lib/gitea-runner";
-      };
-
-      serviceConfig = {
-        Type = "simple";
-        User = "gitea-runner";
-        Group = "gitea-runner";
-        StateDirectory = "gitea-runner";
-        WorkingDirectory = "/var/lib/gitea-runner";
-        ExecStartPre = pkgs.writeShellScript "gitea-runner-register" ''
-          set -euo pipefail
-          CONFIG_FILE="/var/lib/gitea-runner/.runner"
-          if [ ! -f "$CONFIG_FILE" ]; then
-            TOKEN="$(cat ${cfg.tokenFile})"
-            ${pkgs.gitea-actions-runner}/bin/act_runner register \
-              --no-interactive \
-              --instance "$GITEA_INSTANCE_URL" \
-              --token "$TOKEN" \
-              --name "$GITEA_RUNNER_NAME" \
-              --labels "$GITEA_RUNNER_LABELS"
-          fi
-        '';
-        ExecStart = "${pkgs.gitea-actions-runner}/bin/act_runner daemon";
-        Restart = "on-failure";
-        RestartSec = "5s";
+    services.gitea-actions-runner = {
+      package = pkgs.gitea-actions-runner;
+      instances.${cfg.name} = {
+        enable = true;
+        url = cfg.instanceURL;
+        tokenFile = cfg.tokenFile;
+        labels = cfg.labels;
       };
     };
-
-    users.users.gitea-runner = {
-      isSystemUser = true;
-      group = "gitea-runner";
-      home = "/var/lib/gitea-runner";
-      createHome = true;
-      description = "Gitea Actions Runner service user";
-    };
-
-    users.groups.gitea-runner = { };
   };
 }