machines/dev/forgejo-ci/forgejo-actions-runner.nix

@@ -13,7 +13,6 @@ let
       inherit ((import-flake { src = ../../..; }).inputs) nixops4;
     in
     [
-      pkgs.attic-client
       pkgs.coreutils
       pkgs.findutils
       pkgs.gnugrep
@@ -40,6 +39,9 @@ let
   numInstances = 5;
 in
 
+let
+  user = "gitea-runner";
+in
 {
   _class = "nixos";
 
@@ -49,6 +51,41 @@ in
     "${vars}/backends/on-machine.nix"
   ];
 
+  vars.settings.on-machine.enable = true;
+  vars.generators."templates" = rec {
+    dependencies = [ "attic" ];
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.gnused
+    ];
+    script = lib.concatStringsSep "\n" (
+      lib.mapAttrsToList (template: _: ''
+        cp "$templates/${template}" "$out/${template}"
+        echo "filling placeholders in template ${template}..."
+        sed -i "s/${placeholder}/$(cat "${config.age.secrets.wiki-password.path}")/g" "$out/${template}"
+      '') files
+    );
+
+    files."attic.toml" = {
+      secret = true;
+      template = pkgs.writeText "attic.toml" ''
+        default-server = "fediversity"
+
+        [servers.fediversity]
+        endpoint = "http://localhost:8080"
+        token = "${config.vars.generators.attic.files.token.placeholder}"
+      '';
+    };
+  };
+
+  home-manager = {
+    users.${user}.home = {
+      stateVersion = "25.05";
+      file.".config/attic/config.toml".source =
+        config.vars.generators."templates".files."attic.toml".path;
+    };
+  };
+
   services.gitea-actions-runner = {
     package = pkgs.forgejo-actions-runner;
     instances = lib.genAttrs (builtins.genList (n: "nix${builtins.toString n}") numInstances) (_: {
@@ -64,7 +101,6 @@ in
         "native:host"
       ];
       hostPackages = with pkgs; [
-        attic-client
         bash
         git
         nix