github-agent-runner: self-hosted GitHub runner for rocket-sense

Add a `myModules.githubAgentRunner` module wrapping services.github-runners
for the rlrml/rocket-sense repo, with an agenix-encrypted registration token
(github-rocket-sense-runner-token.age) and a toolchain (cargo, claude-code,
codex, gh, git-lfs, ...) available to jobs via extraPackages/labels.

Enabled on railbird-sf.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nixos/configuration.nix

@@ -23,6 +23,7 @@
     ./extra.nix
     ./games.nix
     ./git-sync.nix
+    ./github-agent-runner.nix
     ./gitea-runner.nix
     ./gitea.nix
     ./gnome.nix

nixos/github-agent-runner.nix

@@ -0,0 +1,63 @@
+{
+  pkgs,
+  config,
+  makeEnable,
+  ...
+}:
+makeEnable config "myModules.githubAgentRunner" false {
+  age.secrets.github-rocket-sense-runner-token = {
+    file = ./secrets/github-rocket-sense-runner-token.age;
+    mode = "0400";
+  };
+
+  services.github-runners.rocket-sense-agent = {
+    enable = true;
+    url = "https://github.com/rlrml/rocket-sense";
+    name = "${config.networking.hostName}-rocket-sense-agent";
+    tokenFile = config.age.secrets.github-rocket-sense-runner-token.path;
+    tokenType = "registration";
+    replace = true;
+    ephemeral = false;
+    user = "imalison";
+    extraLabels = [
+      "rocket-sense-agent"
+      "nixos"
+      "codex"
+      "claude-code"
+    ];
+    extraPackages = with pkgs; [
+      bashInteractive
+      cargo
+      claude-code
+      codex
+      coreutils
+      curl
+      direnv
+      gh
+      git-lfs
+      gitFull
+      gnugrep
+      gnused
+      jq
+      just
+      nixVersions.stable
+      nodejs
+      openssh
+      pkg-config
+      ripgrep
+      rustc
+      zsh
+    ];
+    extraEnvironment = {
+      CODEX_HOME = "/home/imalison/.codex";
+      NIX_CONFIG = "experimental-features = nix-command flakes";
+    };
+    serviceOverrides = {
+      ProtectHome = false;
+      ProtectSystem = "full";
+      PrivateTmp = false;
+      PrivateUsers = false;
+      RestrictNamespaces = false;
+    };
+  };
+}

nixos/machines/railbird-sf.nix

@@ -74,6 +74,7 @@
   myModules.fonts.enable = true;
   myModules.plasma.enable = true;
   myModules.nvidia.enable = true;
+  myModules.githubAgentRunner.enable = true;
   myModules.gitea-runner.enable = true;
   myModules.railbird-k3s = {
     enable = true;

nixos/secrets/github-rocket-sense-runner-token.age

@@ -0,0 +1,58 @@
+age-encryption.org/v1
+-> ssh-ed25519 ZgrTqA WERjrEhQkZC1Wu2gSY7SoVDMZdTWJ2k9WQExDtA5riI
+r4yivcKhZhQODeJkVVJuoLRvNjLPFfV+KNrZ7PYv47o
+-> ssh-ed25519 ZaBdSg yQ1c0p0/eJU9waYihNDFFaBM8rbHXrSu0CFz8CAF9hE
+bKdWQPYqSQR1cugbiOtGLuXhQSml1dQHc8YhtMp/JzY
+-> ssh-ed25519 MHZylw yqQekgwLz5/1obj8vpc4HODwnykQf4kOVbHB6eMezVc
+9scmCrQU79lSU2435ao/s786/vO5Y0W32wCiXEh6wNQ
+-> ssh-ed25519 sIUg6g iWNPvErqIHHPLWf/R31tz0qF1qIHEoNeEqsyjjsQU1Q
+GufkttH169CPbhsp03v362xNa/3AtBaFBq0teW2Tfm4
+-> ssh-ed25519 TnanwQ qorZCvMeVJxRlcxBw2in3JPRxNf3ZKtLJPf8kC8NnCM
+nAUKlhy7hGBLTeGadh21CJ308s5PKlaT3a2+nX8axek
+-> ssh-ed25519 cH4aug Z8vFonGcmfSuPx7u0+msXvm66k0xmf3wf3IDj7jvkw8
+vRxernJUERfgL2fhtmAtgiKBiCKrOD3MGpx4Xg9BCik
+-> ssh-ed25519 ggrAFQ BG5WcUGH644XV00rRayimXACIny8UdxpXGtURfTRWxM
+WGmlHmiiU4JPcwAjE6Y8y5WHZ6BFuToJxlbhnbbho5I
+-> ssh-rsa gwJx0Q
+ZjAWj6xZIY0/zIUWBEHsqRqxgeULBhF/v5ubzVNDLGdfju5qHDE3F0qatVFZRLq9
+LZGFfCjwPHsmvfcLtQ/MmH1Wsa2DfQbbnaiR1kEAoAFhCjC6f9kPK45wIiOQzVvz
+s6rVpaC0DFMRk9vKh0ciS1JCSGd1bT5ZsrAVi5IbnuiiGxZAyObuiMtXJOQ0QOZD
+04yX2WDmu+aFSBisO+OFjuKtYni8PYsUEOOSjI9NgT1nx7NgmPvI0axbsQmz0xoc
+k7tbMDZuxGwWI4exoJivOqHpPIU8/iQjEdx2FRSHSajlO8AHY7JZFa1KHp/oTTaA
+hxyljPOAScLzRvcTqU+TYw
+-> ssh-ed25519 YFIoHA 1A1qyn9cnso0P1kOSLoCcpdWAJ3HfxRYooROhEPTNCE
+h2gSpQvqQZfjPK/66iqGhSp0Klk/HE1o1oIuizu6u08
+-> ssh-ed25519 KQfiow iZGuI7/6XNlMtIRzfoWy0LPEMPDkfCV66GRM6ust70g
+lvA3zITgsALb9Qm3Lrjb+Y/PDSXYW6zsXqoAr3lnNKg
+-> ssh-ed25519 kScIxg 19WlRcl6IYl037WestDI9U2SGQoTYauzWj+vmBK1fXU
+Fdw0dAzHF98AV5uDtViA4zLZZuOQeAKTUn/XXSfBsQ4
+-> ssh-ed25519 HzX1zw hGb+4dT1BFf20BrLCit4PMCyQdmxkm/Oy0IRLVZ1iQw
+TAVcLePJHrMPydTt8nSViDv1T5NiyiCG9ABdeUDE2dw
+-> ssh-ed25519 KQfiow EFnkacINh0/bWP0B5qVNqNnXYPUeFl6j8UuDAKyvD1U
+2+UJuDTNfhgsPd1WKfSOrUgM2ScgC4au9v25GsJOtUY
+-> ssh-ed25519 1o2X0w icmVK1ZtpLup7zHH4dED4ds0lVjOR1T00JdF1NjIcU4
+guLk1p5/YR0QltciMkIGsl0BqcPV1j2YR5gQ5HHlAY0
+-> ssh-ed25519 KQ5iUA Ijy9wIN4OzySvVA7YGiQAy3NExm5F8Z1dLRnAOie/jM
+hZUzWH2Yeie0nspmdCKAqTzSSHCcANeMhfTCmBSsAkg
+-> ssh-ed25519 AKGkDw qLesp11W4TAt+LeBHyLCsi2T1VXBEeWFfaBlj2qKsDM
+Y/nQ+lf0D/Wzr+FGoKbScpUVa0xDqYBvIphW6APNEYs
+-> ssh-ed25519 0eS5+A R6JNu3CztGJSgS0NUdfiF89x7C95BtJQ8vuVVmqR7UA
+xzNr/3RsvEfKb2CweUPDzSBMMTpJ2T9JmUaS1MqI8t4
+-> ssh-ed25519 9/4Prw FOyELXDK4iobCr7/tb5HTFrc/bDFukCho/ULSIRqwSo
+eplhJs8GFWPJBM8C4QgAlGUTUROPvFcf1MO0thxZhKY
+-> ssh-ed25519 gAk3+Q No2SVzHVmaC+CgdAWFpjvUhsqvTtoTzMQyImh12IwHE
+aro58KYwDOr06F1gJy9wG7GFYkNc9op8jcz+5Zb54Go
+-> ssh-ed25519 X6eGtQ LWGGUoSCA3O9LCyu6Xzcpuo59mPRV8R8mC3hDWvroQw
+q7yObsvilwcixL6HwCgMhdm2ua8cNsP6ok3niCdGXrw
+-> ssh-ed25519 0ma8Cw TeF/FmOUSXJsH83pPmR9m5h4GEOj/n6WSmTMjJ9nvhg
+Nq8T7jBkmwPrOdiX3VYT8JlmrxrHt1f8sQ9JXdib7Nc
+-> ssh-ed25519 Tp0Z1Q FaRC6yfjNBMKtX5OpbmdCmsKBdk0E0UUVae9TGZD8Rs
+gMB2rZDaeUFbulwhYX8NNJrIQwpZNL9k/FjsgsPNUB0
+-> ssh-ed25519 ePNWZQ fph2Vx6Bk0XW9L8ee5bt8NHrlW8iyl6p76IiPNk7IQc
+aPq3APEZYyh3UvRzqlDD7bMiYKSrtpT/ufu/C/bSbS4
+-> ssh-ed25519 hILzzA X1C8BysK863h1F+P8vLeWU+3IX2Pblh/dwaU2aCkIjs
+c7x0aMakpPNHYQtJcInrwNeyLQXWHjFPIX/qc5zJXeE
+-> ssh-ed25519 qQi7yA ZAiSmB/bC3kE/RzI0GAqQ2AWeFIs2lfhCQrUGP2TaFU
+M4Eq2l+WW68VABlT+gnNkwd0cYdW+rdqNUEXHcEomPE
+--- WOcsddprP2N9bBhfjomyRoOezhOIwEk+0xWJokcRIpw
+<EFBFBD><EFBFBD><EFBFBD>%A<>4=qfײ<66>-*Q<><51><EFBFBD>n<EFBFBD><6E>=<3D><>H.<2E>qo<71><6F>?W<7F><57>W<EFBFBD>Ԫ֊<D4AA><D68A><EFBFBD>aQ<61><51>^Z<><5A>Y<EFBFBD>s>IV

nixos/secrets/secrets.nix

@@ -11,6 +11,7 @@ in {
   "gitea-runner-token.jimi-hendnix.age".publicKeys = keys.agenixKeys;
   "gitea-runner-token.adele.age".publicKeys = keys.agenixKeys;
   "gitea-runner-token.railbird-sf.age".publicKeys = keys.agenixKeys ++ keys.railbird-sf;
+  "github-rocket-sense-runner-token.age".publicKeys = keys.agenixKeys ++ keys.railbird-sf;
   "gitea-runner-token.mac-demarco-mini.age".publicKeys = keys.agenixKeys ++ keys.railbird-sf;
   "gitea-runner-token.age".publicKeys = keys.agenixKeys ++ keys.railbird-sf;
   "nextcloud-admin.age".publicKeys = keys.agenixKeys;