nix/os/devices/CFB4ED74: add gitlab-runner

nix/os/devices/CFB4ED74/configuration.nix

@@ -1,9 +1,13 @@
 { ... }:
 
 {
+  disabledModules = [
+    "services/continuous-integration/gitlab-runner.nix"
+  ];
   imports = [
     ../../profiles/common/configuration.nix
     ../../modules/encryptedDisk.nix
+    ../../modules/gitlab-runner.nix
 
     ./system.nix
     ./hw.nix

nix/os/devices/CFB4ED74/pkg.nix

@@ -1,5 +1,7 @@
-{
-...
+{ config
+, pkgs
+, lib
+, ...
 }:
 
 {
@@ -9,4 +11,30 @@
     enable = true;
     openDefaultPorts = true;
   };
+
+  services.gitlab-runner = {
+    enable = true;
+
+    packages = with pkgs; [
+      bash
+      gitlab-runner
+      nix
+      gitFull
+      git-crypt
+    ];
+
+    configFile = let
+      nixRunnerToken = "/etc/secrets/gitlab-runner/nix-runner.token";
+    in pkgs.writeText "config.toml" ''
+        concurrent = 2
+        check_interval = 0
+        [[runners]]
+          name = "nix-runner"
+          url = "https://gitlab.com"
+          token = "<% sed -z 's/[\n\s]//g' ${nixRunnerToken} %>"
+          executor = "shell"
+          shell = "bash"
+          [runners.cache]
+      '';
+  };
 }