Add the docker group to the runner services and allow passwordless nixos-rebuild for the gitea-runner user.