{ pkgs, ... }:
{
  networking.firewall.trustedInterfaces = [ "br-+" ];

  services.gitea-actions-runner = {
    package = pkgs.forgejo-runner;
    instances.default = {
      enable = true;
      name = "ci.sinerva.eu";
      url = "https://forgejo.sinerva.eu";
      tokenFile = "/persist/secrets/forgejo_token";
      labels = [
        "ubuntu-24.04-lts:docker://ubuntu:24.04"
        "ubuntu-22.04:docker://node:24-bullseye"
        "nixos-latest:docker://nixos/nix"
      ];
    };
  };

  virtualisation.docker = {
    enable = true;
    daemon.settings = {
      fixed-cidr-v6 = "fd00::/80";
      ipv6 = true;
    };
  };
}