@@ -0,0 +1,245 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.gitea-actions;
+  useZfs = builtins.hasAttr "zfs" config.boot.supportedFilesystems && config.boot.supportedFilesystems.zfs;

@@ -0,0 +2,4 @@
+let
+  cfg = config.services.gitea-actions;
+  useZfs = builtins.hasAttr "zfs" config.boot.supportedFilesystems && config.boot.supportedFilesystems.zfs;
+  useKvm = builtins.elem "kvm-amd" config.boot.kernelParams || builtins.elem "kvm-intel" config.boot.kernelParams;

@@ -0,0 +3,4 @@
+  cfg = config.services.gitea-actions;
+  useZfs = builtins.hasAttr "zfs" config.boot.supportedFilesystems && config.boot.supportedFilesystems.zfs;
+  useKvm = builtins.elem "kvm-amd" config.boot.kernelParams || builtins.elem "kvm-intel" config.boot.kernelParams;
+  storeDeps = pkgs.runCommand "store-deps" { } ''

@@ -0,0 +32,4 @@
+    services.gitea-actions = {
+      enable = lib.mkEnableOption "gitea-actions";
+      numInstances = lib.mkOption {
+        type = lib.types.int;

@@ -0,0 +43,4 @@
+        description = "List of packages to symlink into the container";
+      };
+
+      extraPodmanPackages = lib.mkOption {

@@ -0,0 +58,4 @@
+        after = [ "podman.service" ];
+        requires = [ "podman.service" ];
+        script = ''
+          set -eux -o pipefail

@@ -0,0 +66,4 @@
+          groupid=$(cut -d: -f3 < <(getent group nixuser))
+          userid=$(cut -d: -f3 < <(getent passwd nixuser))
+          groupadd --prefix $(pwd) --gid "$groupid" nixuser
+          emptypassword='$6$1ero.LwbisiU.h3D$GGmnmECbPotJoPQ5eoSTD6tTjKnSWZcjHoVTkxFLZP17W9hRi/XkmCiAMOfWruUwy8gMjINrBMNODc7cYEo4K.'

@@ -0,0 +70,4 @@
+          useradd --prefix $(pwd) -p "$emptypassword" -m -d /tmp -u "$userid" -g "$groupid" -G nixuser nixuser
+    
+          cat <<NIX_CONFIG > etc/nix/nix.conf
+          accept-flake-config = true

@@ -0,0 +109,4 @@
+      };
+    
+      users = {
+        groups.nixuser = { };

@@ -0,0 +113,4 @@
+        users.nixuser = {
+          group = "nixuser";
+          description = "Used for running nix ci jobs";
+          home = "/var/empty";

@@ -0,0 +121,4 @@
+    {
+      systemd.services = lib.genAttrs (builtins.genList (n: "gitea-runner-nix${builtins.toString n}-token") cfg.numInstances) (name: {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "gitea.service" ];

@@ -0,0 +145,4 @@
+
+      virtualisation = {
+        podman.enable = true;
+        podman.extraPackages = (lib.optional useZfs pkgs.zfs) ++ cfg.extraPodmanPackages;

@@ -0,0 +147,4 @@
+        podman.enable = true;
+        podman.extraPackages = (lib.optional useZfs pkgs.zfs) ++ cfg.extraPodmanPackages;
+        containers = {
+          containersConf.settings.containers.dns_servers = [ "1.1.1.1" "5.5.5.5" ];

@@ -0,0 +228,4 @@
+        tokenFile = "/var/lib/gitea-registration/gitea-runner-${iname}-token";
+        labels = [ "nix:docker://gitea-runner-nix" ];
+        settings.container = {
+          options = if useKvm then

@@ -0,0 +229,4 @@
+        labels = [ "nix:docker://gitea-runner-nix" ];
+        settings.container = {
+          options = if useKvm then
+            "-e NIX_BUILD_SHELL=/bin/bash -e PAGER=cat -e PATH=/bin -e SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt --device /dev/kvm -v /nix:/nix -v ${storeDeps}/bin:/bin -v ${storeDeps}/etc/ssl:/etc/ssl --user nixuser"