@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 knHzXw qyUYJJsJa/bejZxyGphz0Zuqu0ns9q1V/i9He+vmKyA
+he21Qt5x+V9XabkiatrwCOj0HxI4cTcKZrHuum/1qAA
+-> piv-p256 VBDKjg AwZIxUdvwWVcO0mjd9dO7TaYQAwf9pGTcE1N+dSrlAqr
+mTQDuFxKBsRsdMttSig79u2uyv/N3mQwLKrB17b1zTw
+--- 1W39QjSZm0q0s9fym3mfiwsW9Rrfa6N7ch6L32/hxOA
+������x����H�ٵ��5p1�w�wFb1M��8s�(;�g��5IJ�F�G�V_������P��Q�K?�Ϲ
[

@@ -27,6 +27,7 @@ ntfy = [ smrk ];
     readeck = [ smrk ];
     open-webui = [ smrk ];
     codeberg-runner = [ smrk ];
+    opia-codeberg-runner = [ smrk ];
     vpsfreectl = [
       smrk
     ];

@@ -36,6 +36,7 @@
     ../roles/opia/archive.nix
     ../roles/opia/auth.nix
     ../roles/opia/calendar.nix
+    ../roles/opia/ci.nix
     ../roles/opia/wiki.nix
   ];
   system.stateVersion = "25.11";

@@ -0,0 +1,38 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  nodeMajorVersion = lib.versions.major pkgs.nodejs.version;
+in
+{
+  age.secrets.opia-codeberg.file = ../../../secrets/opia-codeberg-runner.age;
+
+  services.gitea-actions-runner = {
+    instances.opia = {
+      name = config.networking.hostName;
+      enable = true;
+      url = "https://codeberg.org";
+      tokenFile = config.age.secrets.opia-codeberg.path;
+      labels = [
+        "docker:docker://node:${nodeMajorVersion}-alpine"
+        "alpine-latest:docker://node:${nodeMajorVersion}-alpine"
+        "nixos:host"
+      ];
+
+      hostPackages = with pkgs; [
+        bash
+        coreutils
+        curl
+        gawk
+        config.programs.git.package
+        gnused
+        nix
+        nodejs
+        wget
+      ];
+    };
+  };
+}