jupiter: enable gitea Actions + register a jupiter runner

Runner registers against the same gitea instance and runs jobs in podman
containers (services/containers.nix), one image per runs-on label using the
catthehacker act-compatible images. Registration token comes from gitea
itself (gitea actions generate-runner-token) and is stored in
secrets/jupiter.yaml, rendered into a TOKEN=... env file via sops.templates
since gitea-actions-runner takes an EnvironmentFile, not a raw secret path.

hosts/jupiter/secrets.nix

@@ -34,4 +34,12 @@
   # sops default of root:root 0400 is correct — do NOT set `owner`.
   sops.secrets.immich_oauth_client_secret = { };
 
+  # Gitea Actions runner registration token (services/dev/gitea.nix). Gitea
+  # generates this itself once Actions is enabled — it is not a password
+  # chosen up front. Rendered into a `TOKEN=...` env file because
+  # gitea-actions-runner takes an EnvironmentFile, not a raw secret path.
+  sops.secrets.gitea_runner_token = { };
+  sops.templates."gitea-runner.env".content =
+    "TOKEN=${config.sops.placeholder.gitea_runner_token}";
+
 }

secrets/jupiter.yaml

@@ -6,6 +6,7 @@ sabnzbd_api_key: ENC[AES256_GCM,data:6UW1u2Ikmnq34t4H4k/4C44SJeFHRlaPjWwUjEfH1GQ
 prowlarr_api_key: ENC[AES256_GCM,data:ab1QACaagI8ACJXFUy8r9X9lgYwRo1byUmhBPSRWwKk=,iv:EcuF6EN/4mWxlXi6R1qDzv4rOw6AT+OGSNQaaBwjJHg=,tag:hixHrbQWU6QQZNMM5rNDsg==,type:str]
 cinephage_better_auth_secret: ENC[AES256_GCM,data:S1ilcQeC2HmXe/4xdLi6wm5RNz954SL3qVur6JCn5ekBVCbXMd1DGCafjhU=,iv:9rS5gDuazMOAq/hWp0onvHZPzKJgQM3oWIrtplJN/9I=,tag:xNqf/unY2v/98p4v52vUqw==,type:str]
 immich_oauth_client_secret: ENC[AES256_GCM,data:+NbUnwImwFTYNjz3luzczpCf7oMetzYBkj5ZnuG2QQf0Wpm6OtYS3amTC8dwoh9F/DAos5224etncfEgEu2k2iMUACLADnlCGppIx0F7Gl1Ve7UF2VzKJ3xQpgCDrXklU+o5NxfU/YBn1Vfa3580wT3tr2++SCSrcKq1XGtfhv4=,iv:tjaPDQbrA6TxsDebgNOtO/ITfXzU5wTKU9SkfC0TQcY=,tag:AnlJR0tLExkB7Aeo/ZVTng==,type:str]
+gitea_runner_token: ENC[AES256_GCM,data:8ji4Nia7GMCBBsemUeGZRqzhlk1RnzzOLLdo7+to85KIC5Kz4AtDsQ==,iv:2wotlB1B/Co/NrZVcIVB4AlwL7DF9KnEVKe32FJNErU=,tag:zLzKPgGmXCkGfK7P/74pyw==,type:str]
 sops:
     age:
         - enc: |
@@ -26,7 +27,7 @@ sops:
             CzjSDQZTcseEXZNwuzZcfB5Mvq0BQvjOj7lGuxzuE4qwWkdJWGfVLQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
-    lastmodified: "2026-07-24T23:31:21Z"
-    mac: ENC[AES256_GCM,data:u9n7XVFXX7Ujlz2UrHVqFTNl8OyVdmcIkAQM3khEotdfGRqlIU+L9exvhoPHTacQlPWKm8CkmrMbkDyURG/I4plQZATumw2aVawaB5R8NDnuL8+sya64jsISNPkCWYU9kqSHbvFsGuCIkHYvBXannqpkKxTtGaleV6BLbUfykFs=,iv:x1qg+qfeqTie2Dy4xmF/MZ6jBrVEgU7DSXOp6z3/5lc=,tag:O1GVWEtliEGrb+W+FEgfiw==,type:str]
+    lastmodified: "2026-07-29T19:00:26Z"
+    mac: ENC[AES256_GCM,data:D5FLrembFUqs5yC2bHuhw2w8XUhF46LWpN5LF/VJKtLOo3A3KUdGV0HhA9k6gaTWyn5Zd7O9YSuJLknI62fbOtJkqOhMVUgj/VZXgrcQg4hlU53gDppryYNGi/7Vc9lxLfsJU4Yvk6yQfh7Gt19U+Mj6s7ETn6lJxC5FBnIkS3I=,iv:EJAM1cCD4rTq0XjIbo66di73hnOoklx5UoTrpdyKHq0=,tag:wEhFnwlXiYKyu/k/ED75TA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2

services/dev/gitea.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 
 # Gitea — self-hosted git. stateDir/repositories were migrated from the old
 # ZimaOS docker instance straight into stateDir's default layout, so no
@@ -34,10 +34,36 @@
       service = {
         DISABLE_REGISTRATION = true;
       };
+      actions = {
+        ENABLED = true;
+      };
     };
   };
 
   networking.firewall.allowedTCPPorts = [ 2222 ];
 
   users.users.gitea.extraGroups = [ "users" ];
+
+  # Runner instance registered against this same gitea. Jobs run in containers
+  # (podman, via services/containers.nix — already enabled on jupiter), one
+  # image per requested `runs-on` label using the catthehacker act-compatible
+  # images (same ones upstream `act`/Forgejo docs recommend).
+  #
+  # tokenFile points at an env file rendered by sops (TOKEN=<registration
+  # token>, see hosts/jupiter/secrets.nix) rather than a plain `token`, so the
+  # secret never lands in the Nix store. The registration token itself is NOT
+  # generated by this module — it comes from gitea once Actions is enabled:
+  #   su gitea -s /bin/sh -c \
+  #     'GITEA_WORK_DIR=/mnt/data/AppData/gitea gitea actions generate-runner-token'
+  # then written into secrets/jupiter.yaml as gitea_runner_token.
+  services.gitea-actions-runner.instances.jupiter = {
+    enable = true;
+    name = "jupiter";
+    url = "https://git.mgaction.town/";
+    tokenFile = config.sops.templates."gitea-runner.env".path;
+    labels = [
+      "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+      "ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
+    ];
+  };
 }