Run Forgejo actions on forge

evolution/proposals/ECP-0123-instant-station-guide-and-player-warmup.md

@@ -48,6 +48,7 @@ Ship the static web change with the existing Worker asset deploy and roll the pu
 binary to the LA nodes so their catalogs match the current watcher schema. Validate with clean-cache
 desktop/mobile browser loads and check the app's `window.__ecPerf` marks plus a live tune through the
 public relay. The Forgejo workflows use the locally registered `namespace-profile-linux-medium`
-runner label so the Cloudflare deploy can actually leave the queue on the self-hosted forge.
-Teardown is removing the HTML seed/cache/warmup path, returning to live-API-only station rendering,
-and explicitly passing `--passthrough=false` only if an older watcher path is restored.
+runner label and ecp-forge runs a persistent `forgejo-runner-agent` service with a normal shell
+tool PATH so the Cloudflare deploy can actually leave the queue on the self-hosted forge. Teardown is
+removing the HTML seed/cache/warmup path, returning to live-API-only station rendering, and
+explicitly passing `--passthrough=false` only if an older watcher path is restored.

nix/nixos/ecp-forge.nix

@@ -72,6 +72,16 @@ in
       ];
     };
     groups.conradev = { };
+    groups.forgejo-runner = {
+      gid = 984;
+    };
+    users.forgejo-runner = {
+      uid = 989;
+      isSystemUser = true;
+      group = "forgejo-runner";
+      home = "/var/lib/forgejo-runner-agent";
+      createHome = true;
+    };
   };
 
   boot.loader = {
@@ -203,6 +213,41 @@ in
     };
   };
 
+  systemd.tmpfiles.rules = [
+    "d /var/lib/forgejo-runner-agent 0750 forgejo-runner forgejo-runner -"
+  ];
+
+  systemd.services.forgejo-runner-agent = {
+    description = "Forgejo Actions runner for every.channel";
+    after = [ "network-online.target" "forgejo.service" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    path = with pkgs; [
+      bash
+      coreutils
+      curl
+      git
+      gnugrep
+      gnused
+      gnutar
+      gzip
+      nix
+      which
+      zstd
+    ];
+    environment = {
+      HOME = "/var/lib/forgejo-runner-agent";
+    };
+    serviceConfig = {
+      User = "forgejo-runner";
+      Group = "forgejo-runner";
+      WorkingDirectory = "/var/lib/forgejo-runner-agent";
+      ExecStart = "${pkgs.forgejo-runner}/bin/forgejo-runner --config /var/lib/forgejo-runner-agent/runner.yaml daemon";
+      Restart = "always";
+      RestartSec = "10s";
+    };
+  };
+
   services.caddy = {
     enable = true;
     email = "infra@every.channel";