Add Github Actions support to the build machine.

flake.lock

@@ -68,10 +68,48 @@
         "type": "github"
       }
     },
+    "nixpkgs_26_05": {
+      "locked": {
+        "lastModified": 1791143449,
+        "narHash": "sha256-9+n3ReS2y9xS199LoJjKUWHwZrISGHWgkD/LUZTDZyA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "0d9e9b832d03ac387417e16ce1febf73b2e631e1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "nix-minecraft": "nix-minecraft",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_2",
+        "nixpkgs_26_05": "nixpkgs_26_05",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs_26_05"
+        ]
+      },
+      "locked": {
+        "lastModified": 1791103873,
+        "narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "dcd241ba97088c22569d1573286e1b9daad340c0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {

flake.nix

@@ -3,12 +3,17 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs_26_05.url = "github:NixOS/nixpkgs/nixos-26.05";
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs_26_05";
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
   };
 
   outputs = inputs @ {
     self,
     nixpkgs,
+    nixpkgs_26_05,
+    sops-nix,
     nix-minecraft,
     ...
   }: let
@@ -55,9 +60,12 @@
         modules = [./nix-system-configs/modules/system/traefik.nix];
       };
 
-      "nixos-build-machine" = nixpkgs.lib.nixosSystem {
+      "nixos-build-machine" = nixpkgs_26_05.lib.nixosSystem {
         inherit system;
-        modules = [./nix-system-configs/modules/system/build_machine.nix];
+        modules = [
+          sops-nix.nixosModules.sops
+          ./nix-system-configs/modules/system/build_machine.nix
+        ];
       };
 
       "nixos-logs" = nixpkgs.lib.nixosSystem {

nix-system-configs/modules/secrets-config/sops-build-machine.nix

@@ -4,18 +4,7 @@
   lib,
   ...
 }: {
-  imports = let
+  # This will add secrets.yml to the Nix store
-    # replace this with an actual commit id or tag
-    commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
-  in [
-    "${builtins.fetchTarball {
-      url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
-      # replace this with an actual hash
-      sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
-    }}/modules/sops"
-  ];
-
-  # This will add secrets.yml to the nix store
   # You can avoid this by adding a string to the full path instead, i.e.
   # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
   sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml;
@@ -34,4 +23,12 @@
     owner = "root";
     mode = "0400";
   };
+
+  sops.secrets."github_runner_token" = {
+    format = "yaml";
+    sopsFile = ../../secrets/build_machine/secrets.yaml;
+    owner = "root";
+    mode = "0400";
+    restartUnits = ["github-runner-build-machine.service"];
+  };
 }

nix-system-configs/modules/system/build_machine.nix

@@ -191,6 +191,7 @@ in {
       }
     ];
     networking.defaultGateway = "10.1.1.1";
+    networking.resolvconf.enable = false;
     environment.etc."resolv.conf".text = ''
       nameserver 10.1.1.2
     '';
@@ -218,6 +219,52 @@ in {
       };
     };
 
+    users.groups.github-runner = {};
+    users.users.github-runner = {
+      isSystemUser = true;
+      group = "github-runner";
+      home = "/var/lib/github-runner";
+      createHome = true;
+    };
+
+    services.github-runners.build-machine = {
+      enable = true;
+      user = "github-runner";
+      group = "github-runner";
+      name = "nixos-build-machine";
+      url = "https://github.com/bitcoin-dev-tools";
+      tokenFile = "/run/github-runner-token";
+      ephemeral = true;
+      replace = true;
+      extraLabels = ["nixos" "build-machine"];
+    };
+
+    systemd.services.github-runner-build-machine = {
+      requires = ["sops-nix.service"];
+      after = ["sops-nix.service"];
+      serviceConfig.ExecStartPre = lib.mkBefore [
+        "+${pkgs.writeShellScript "prepare-github-runner-token" ''
+          set -eu
+          token="$(<${config.sops.secrets.github_runner_token.path})"
+          case "$token" in
+            TOKEN=*) token="''${token#TOKEN=}" ;;
+            *)
+              echo "GitHub runner token secret must use TOKEN=<token> format" >&2
+              exit 1
+              ;;
+          esac
+          if [ -z "$token" ] || [[ "$token" == *$'\n'* ]]; then
+            echo "GitHub runner token secret must contain one non-empty token" >&2
+            exit 1
+          fi
+          token_file=/run/github-runner-token
+          printf '%s' "$token" > "$token_file.tmp"
+          chmod 0400 "$token_file.tmp"
+          mv -f "$token_file.tmp" "$token_file"
+        ''}"
+      ];
+    };
+
     # This value determines the NixOS release from which the default
     # settings for stateful data, like file locations and database versions
     # on your system were taken. It‘s perfectly fine and recommended to leave

nix-system-configs/secrets/build_machine/secrets.yaml

@@ -1,8 +1,8 @@
 runner_token: ENC[AES256_GCM,data:SEN4lL2cxkM/cExdasB2zIV3EDJcBIZOAr1ab6aLagPVReZ8UTaFKgMctnLIkA==,iv:EMUQW8ufCnbCeN3PmSoxBsHLukwS4yNSA3xor89uNxE=,tag:V8RDaeGMI4ReZrGTw9V2Qw==,type:str]
+github_runner_token: ENC[AES256_GCM,data:zu1nICWyNdZF5om9Mi3sRbaeBWPfB/J52sSTDeSii5sVVZg=,iv:CZE/TXVX3NfYfj9xCTTHkiqTN50sEISRhypGAPQdzEg=,tag:uqq9IYbYuKIcLPm4BMkT6A==,type:str]
 sops:
     age:
-        - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+        - enc: |
-          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WEE5MUJiK0tUSmZMMXVq
             LzdON0trT0NYbXZXdkluak9xQVlHM0F2OVI4CnFmaEpEdEVMalgxQjJMalp3Mjl3
@@ -10,8 +10,8 @@ sops:
             TFZpeGwrM2V3aWRybGE2WVNQRW5QV0kKdJb7svK5k5rYMtfiTsJy5QE3+1MP04jz
             zadKKK+kDaK+h4AmkFGLRoKLpJoEU2nEUo2FD4LxiGOOvSXmeOUxbw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
+          recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUEdoMkVyMjVsOG1LYkRW
             M08xemlxRHU4THRidWZXZFhEdXFBV05YUFZRCjlpeERUbWVjY0cxMlk5elk1VHFn
@@ -19,7 +19,8 @@ sops:
             U3hva2JqWUdjR2JzTmpFanppUk5MTmsKwD8rlnddUQkgtuZLTgpmS4jGRmgNReUN
             mEx0pxnWIIrLUGRgwE3WDbBVRTqVo1ai6BZY3FzBCnXU6zbNwYhqIg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-12T17:12:42Z"
+          recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
-    mac: ENC[AES256_GCM,data:Z888IrMcNO0VwoliGoLS8SsZPffXvH2yY6w9y3i7laepvrq2dW2a3fx+urwzgYfpJBLMJQNJ10SauBINlgIYp5KYf1dMRSsLBbwIsJi90lmqmRSNmNdQmkJdwi4MhmQxbZmHpwrxwFrx9EAkWdWXKlMBCkO2WJxNVQdYVty2bNs=,iv:FssN2HByfcbgFY5NKEyadyrrdidFx5iHaEXX2rDLYvw=,tag:bRGpOVzv26kjOswlQC7aoA==,type:str]
+    lastmodified: "2026-10-05T09:26:20Z"
+    mac: ENC[AES256_GCM,data:oM69M815SR0TDzUOrMbXanXd5vikDgADhFmXvY6VrhWSoRwweApiLsKjT1IxdH3yQCQVLdsGIhU8/0+Ke3ZZ64TBYYi8cBp+7Uua4UHqCz1ouwXVSO7/aVOQciySMxV2+fftZu0tUn8rdvAdpdPrucadgYLGmF9vJM4hSo7xy+4=,iv:Y19E6AftjLw3FRmxC2LykwSgVnv6UOK6K+3UyVaBTZg=,tag:D7AFDR5+hxm4YSFydLetVg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.13.3