feat: set forgejo runner and cachix

modules/forgejo.nix

@@ -52,6 +52,11 @@ in
         ENABLE_SWAGGER = false;
       };
 
+      actions = {
+        ENABLED = true;
+        DEFAULT_ACTIONS_URL = "https://code.forgejo.org";
+      };
+
       openid = {
         ENABLE_OPENID_SIGNIN = false;
         ENABLE_OPENID_SIGNUP = false;
@@ -63,6 +68,31 @@ in
 
   services.postgresql.enable = true;
 
+  # Forgejo Actions runner (native shell executor for Nix builds)
+  services.gitea-actions-runner.package = pkgs.forgejo-runner;
+  services.gitea-actions-runner.instances.nix-builder = {
+    enable = true;
+    name = "nix-builder";
+    url = "https://git.extremist.software";
+    tokenFile = config.age.secrets.forgejo-runner-token.path;
+    labels = [ "native:host" ];
+    hostPackages = with pkgs; [
+      bash
+      coreutils
+      curl
+      gawk
+      git
+      gnused
+      nix
+      nodejs
+      wget
+    ];
+    settings = {
+      runner.capacity = 1;
+      cache.enabled = true;
+    };
+  };
+
   # Deploy custom theme CSS to Forgejo's custom directory
   systemd.tmpfiles.rules = [
     "d ${customDir}/public 0755 forgejo forgejo -"