Run Forgejo actions on forge

nix/nixos/ecp-forge.nix

@@ -72,6 +72,16 @@ in
       ];
     };
     groups.conradev = { };
+    groups.forgejo-runner = {
+      gid = 984;
+    };
+    users.forgejo-runner = {
+      uid = 989;
+      isSystemUser = true;
+      group = "forgejo-runner";
+      home = "/var/lib/forgejo-runner-agent";
+      createHome = true;
+    };
   };
 
   boot.loader = {
@@ -203,6 +213,41 @@ in
     };
   };
 
+  systemd.tmpfiles.rules = [
+    "d /var/lib/forgejo-runner-agent 0750 forgejo-runner forgejo-runner -"
+  ];
+
+  systemd.services.forgejo-runner-agent = {
+    description = "Forgejo Actions runner for every.channel";
+    after = [ "network-online.target" "forgejo.service" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    path = with pkgs; [
+      bash
+      coreutils
+      curl
+      git
+      gnugrep
+      gnused
+      gnutar
+      gzip
+      nix
+      which
+      zstd
+    ];
+    environment = {
+      HOME = "/var/lib/forgejo-runner-agent";
+    };
+    serviceConfig = {
+      User = "forgejo-runner";
+      Group = "forgejo-runner";
+      WorkingDirectory = "/var/lib/forgejo-runner-agent";
+      ExecStart = "${pkgs.forgejo-runner}/bin/forgejo-runner --config /var/lib/forgejo-runner-agent/runner.yaml daemon";
+      Restart = "always";
+      RestartSec = "10s";
+    };
+  };
+
   services.caddy = {
     enable = true;
     email = "infra@every.channel";