Move NixOS switches to SSH runners

.gitea/workflows/nixos-switch-cloud-pc.yml

@@ -12,7 +12,7 @@ on:
 
 jobs:
   switch:
-    runs-on: cloud-pc-nixos
+    runs-on: cloud-pc
     steps:
       - name: Sync repo
         run: |
@@ -20,4 +20,13 @@ jobs:
           git -C /opt/services pull --ff-only
 
       - name: Switch NixOS generation
-        run: sudo /run/current-system/sw/bin/nixos-rebuild switch --flake /opt/services/nixos#cloud-pc
+        env:
+          NIXOS_DEPLOY_KEY: ${{ secrets.NIXOS_DEPLOY_KEY }}
+        run: |
+          KEY=$(mktemp)
+          echo "$NIXOS_DEPLOY_KEY" > "$KEY"
+          chmod 600 "$KEY"
+          trap "rm -f $KEY" EXIT
+          ssh -i "$KEY" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            ada@192.168.1.5 \
+            "sudo /run/current-system/sw/bin/nixos-rebuild switch --flake /opt/services/nixos#cloud-pc"

.gitea/workflows/nixos-switch-mini-pc.yml

@@ -12,7 +12,7 @@ on:
 
 jobs:
   switch:
-    runs-on: mini-pc-nixos
+    runs-on: mini-pc
     steps:
       - name: Sync repo
         run: |
@@ -20,4 +20,13 @@ jobs:
           git -C /opt/services pull --ff-only
 
       - name: Switch NixOS generation
-        run: sudo /run/current-system/sw/bin/nixos-rebuild switch --flake /opt/services/nixos#mini-pc
+        env:
+          NIXOS_DEPLOY_KEY: ${{ secrets.NIXOS_DEPLOY_KEY }}
+        run: |
+          KEY=$(mktemp)
+          echo "$NIXOS_DEPLOY_KEY" > "$KEY"
+          chmod 600 "$KEY"
+          trap "rm -f $KEY" EXIT
+          ssh -i "$KEY" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            ada@192.168.1.10 \
+            "sudo /run/current-system/sw/bin/nixos-rebuild switch --flake /opt/services/nixos#mini-pc"

cloud-pc/gitea-runner/Dockerfile

@@ -0,0 +1,4 @@
+FROM gitea/act_runner:latest
+
+USER root
+RUN apk add --no-cache docker-cli docker-cli-compose

cloud-pc/gitea-runner/docker-compose.yml

@@ -0,0 +1,13 @@
+services:
+  gitea-runner:
+    build: .
+    restart: always
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /opt/services:/opt/services
+      - /opt/data/gitea-runner:/data
+    environment:
+      GITEA_INSTANCE_URL: https://git.ada-dev.ru
+      GITEA_RUNNER_REGISTRATION_TOKEN: ${TOKEN}
+      GITEA_RUNNER_NAME: cloud-pc-runner
+      GITEA_RUNNER_LABELS: cloud-pc

mini-pc/gitea-runner/Dockerfile

@@ -0,0 +1,4 @@
+FROM gitea/act_runner:latest
+
+USER root
+RUN apk add --no-cache docker-cli docker-cli-compose

mini-pc/gitea-runner/docker-compose.yml

@@ -0,0 +1,13 @@
+services:
+  gitea-runner:
+    build: .
+    restart: always
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /opt/services:/opt/services
+      - /opt/data/gitea-runner:/data
+    environment:
+      GITEA_INSTANCE_URL: https://git.ada-dev.ru
+      GITEA_RUNNER_REGISTRATION_TOKEN: ${TOKEN}
+      GITEA_RUNNER_NAME: mini-pc-runner
+      GITEA_RUNNER_LABELS: mini-pc

nixos/hosts/cloud-pc/default.nix

@@ -80,30 +80,5 @@
     "d /mnt/yandex 0755 ada users - -"
   ];
 
-  services.gitea-actions-runner.instances."cloud-pc" = {
-    enable = true;
-    name = "cloud-pc";
-    url = "https://git.ada-dev.ru";
-    tokenFile = "/etc/gitea-runner/cloud-pc.token";
-    labels = [ "cloud-pc" "cloud-pc-nixos" ];
-  };
-
-  systemd.services."gitea-runner-cloud-pc".serviceConfig = {
-    SupplementaryGroups = [ "docker" ];
-    Environment = [ "PATH=/run/current-system/sw/bin:/bin" ];
-  };
-
-  security.sudo.extraRules = [
-    {
-      users = [ "gitea-runner" ];
-      commands = [
-        {
-          command = "/run/current-system/sw/bin/nixos-rebuild";
-          options = [ "NOPASSWD" ];
-        }
-      ];
-    }
-  ];
-
   system.stateVersion = "25.11";
 }

nixos/hosts/mini-pc/default.nix

@@ -75,30 +75,5 @@
     }
   '';
 
-  services.gitea-actions-runner.instances."mini-pc" = {
-    enable = true;
-    name = "mini-pc";
-    url = "https://git.ada-dev.ru";
-    tokenFile = "/etc/gitea-runner/mini-pc.token";
-    labels = [ "mini-pc" "mini-pc-nixos" ];
-  };
-
-  systemd.services."gitea-runner-mini-pc".serviceConfig = {
-    SupplementaryGroups = [ "docker" ];
-    Environment = [ "PATH=/run/current-system/sw/bin:/bin" ];
-  };
-
-  security.sudo.extraRules = [
-    {
-      users = [ "gitea-runner" ];
-      commands = [
-        {
-          command = "/run/current-system/sw/bin/nixos-rebuild";
-          options = [ "NOPASSWD" ];
-        }
-      ];
-    }
-  ];
-
   system.stateVersion = "25.11";
 }