gitea over ssh is working, https in progress

Signed-off-by: ahuston-0 <aliceghuston@gmail.com>

systems/palatine-hill/docker/act-runner.nix

@@ -0,0 +1,65 @@
+{
+  config,
+  ...
+}:
+
+let
+  vars = import ../vars.nix;
+  act_path = vars.primary_act;
+in
+{
+  virtualisation.oci-containers.containers.act-stable-latest-1 =
+
+    {
+      image = "gitea/act_runner:latest";
+      extraOptions = [
+        "--stop-signal=SIGINT"
+      ];
+      labels = {
+        "com.centurylinklabs.watchtower.enable" = "true";
+        "com.centurylinklabs.watchtower.scope" = "act-runner";
+      };
+      volumes = [
+        "${act_path}/stable-latest-1/config.yaml:/config.yaml"
+        "${act_path}/stable-latest-1/data:/data"
+        "/var/run/docker.sock:/var/run/docker.sock"
+      ];
+      environment = {
+        CONFIG_FILE = "/config.yaml";
+        GITEA_RUNNER_NAME = "stable-latest-1";
+      };
+      environmentFiles = [ config.sops.secrets."docker/act-runner".path ];
+      log-driver = "local";
+
+    };
+
+  systemd = {
+    timers."custom-watchtower@act-runner" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = "20m";
+        OnUnitActiveSec = "5m";
+        Unit = "custom-watchtower@act-runner.service";
+      };
+    };
+    services."custom-watchtower@act-runner" = {
+      bindsTo = [ "docker.service" ];
+      after = [ "docker.service" ];
+      description = "a watchtower-esque script for systemd-based oci-containers";
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+        ExecStart = "${config.nix.package}/bin/nix ${./watchtower.bash} 'com.centurylinklabs.watchtower.scope' 'act-runner'";
+      };
+    };
+  };
+
+  sops.secrets = {
+    "docker/act-runner" = {
+      owner = "root";
+      restartUnits = [
+        "docker-act-stable-latest-1.service"
+      ];
+    };
+  };
+}

systems/palatine-hill/docker/default.nix

@@ -7,6 +7,7 @@
 
 {
   imports = [
+    ./act-runner.nix
     ./archiveteam.nix
     # ./books.nix
     #./firefly.nix