feat(koi): forgejo runners

hosts/koi/configuration.nix

@@ -22,6 +22,7 @@
     ./services/postgresql.nix
     ./services/landing
     ./services/geesefs.nix
+    ./services/actions-runner
 
     ./containers/torrent.nix
     ./containers/soulseek

hosts/koi/services/actions-runner/Dockerfile.dind

@@ -0,0 +1,12 @@
+FROM node:23.4.0-alpine AS node
+
+FROM docker:27-dind
+
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+COPY --from=node /usr/local/include/node /usr/local/include/node
+
+RUN apk add libstdc++ bash && \
+    ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \
+    ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx && \
+    ln -s /usr/local/lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack

hosts/koi/services/actions-runner/default.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, ... }: 
+
+{
+  desu.secrets.forgejo-runners-token = {};
+
+  systemd.services.actions-runner-build-dind = {
+    description = "dind image builder for actions runner";
+    after = [ "docker.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.docker}/bin/docker build -t local/actions-runner-dind -f ${./Dockerfile.dind} .";
+    };
+  };
+
+  systemd.services.gitea-runner-koi.requires = [ "actions-runner-build-dind.service" ];
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.koi = {
+      name = "koi";
+      enable = true;
+      url = "https://codeberg.org";
+      tokenFile = config.desu.secrets.forgejo-runners-token.path;
+      labels = [
+        "node18:docker://node:18-bullseye"
+        "node20:docker://node:20-bullseye"
+        "node22:docker://node:22-bullseye"
+        "docker:docker://local/actions-runner-dind"
+      ];
+      settings = {
+        runner.capacity = 8;
+      };
+    };
+  };
+}