Consolidate Gitea runners on NixOS

Add the docker group to the runner services and allow passwordless
nixos-rebuild for the gitea-runner user.

cloud-pc/gitea-runner/Dockerfile

@@ -1,4 +0,0 @@
-FROM gitea/act_runner:latest
-
-USER root
-RUN apk add --no-cache docker-cli docker-cli-compose

cloud-pc/gitea-runner/docker-compose.yml

@@ -1,13 +0,0 @@
-services:
-  gitea-runner:
-    build: .
-    restart: always
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /opt/services:/opt/services
-      - /opt/data/gitea-runner:/data
-    environment:
-      GITEA_INSTANCE_URL: https://git.ada-dev.ru
-      GITEA_RUNNER_REGISTRATION_TOKEN: ${TOKEN}
-      GITEA_RUNNER_NAME: cloud-pc-runner
-      GITEA_RUNNER_LABELS: cloud-pc

mini-pc/gitea-runner/Dockerfile

@@ -1,4 +0,0 @@
-FROM gitea/act_runner:latest
-
-USER root
-RUN apk add --no-cache docker-cli docker-cli-compose

mini-pc/gitea-runner/docker-compose.yml

@@ -1,13 +0,0 @@
-services:
-  gitea-runner:
-    build: .
-    restart: always
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /opt/services:/opt/services
-      - /opt/data/gitea-runner:/data
-    environment:
-      GITEA_INSTANCE_URL: https://git.ada-dev.ru
-      GITEA_RUNNER_REGISTRATION_TOKEN: ${TOKEN}
-      GITEA_RUNNER_NAME: mini-pc-runner
-      GITEA_RUNNER_LABELS: mini-pc

nixos/hosts/cloud-pc/default.nix

@@ -80,13 +80,27 @@
     "d /mnt/yandex 0755 ada users - -"
   ];
 
-  services.gitea-actions-runner.instances."cloud-pc-nixos" = {
+  services.gitea-actions-runner.instances."cloud-pc" = {
     enable = true;
-    name = "cloud-pc-nixos";
+    name = "cloud-pc";
     url = "https://git.ada-dev.ru";
-    tokenFile = "/etc/gitea-runner/cloud-pc-nixos.token";
+    tokenFile = "/etc/gitea-runner/cloud-pc.token";
-    labels = [ "cloud-pc-nixos" ];
+    labels = [ "cloud-pc" "cloud-pc-nixos" ];
   };
 
+  systemd.services."gitea-runner-cloud-pc".serviceConfig.SupplementaryGroups = [ "docker" ];
+
+  security.sudo.extraRules = [
+    {
+      users = [ "gitea-runner" ];
+      commands = [
+        {
+          command = "/run/current-system/sw/bin/nixos-rebuild";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+
   system.stateVersion = "25.11";
 }

nixos/hosts/mini-pc/default.nix

@@ -75,13 +75,27 @@
     }
   '';
 
-  services.gitea-actions-runner.instances."mini-pc-nixos" = {
+  services.gitea-actions-runner.instances."mini-pc" = {
     enable = true;
-    name = "mini-pc-nixos";
+    name = "mini-pc";
     url = "https://git.ada-dev.ru";
-    tokenFile = "/etc/gitea-runner/mini-pc-nixos.token";
+    tokenFile = "/etc/gitea-runner/mini-pc.token";
-    labels = [ "mini-pc-nixos" ];
+    labels = [ "mini-pc" "mini-pc-nixos" ];
   };
 
+  systemd.services."gitea-runner-mini-pc".serviceConfig.SupplementaryGroups = [ "docker" ];
+
+  security.sudo.extraRules = [
+    {
+      users = [ "gitea-runner" ];
+      commands = [
+        {
+          command = "/run/current-system/sw/bin/nixos-rebuild";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+
   system.stateVersion = "25.11";
 }