feat: implement github-actions mixin and actions-runner ami

.github/workflows/flake.yaml

@@ -35,6 +35,7 @@ jobs:
         profile:
           - gc-fwd
           - ecs-node
+          - actions-runner
     steps:
       - uses: cachix/install-nix-action@v25
         with:

flake.nix

@@ -48,6 +48,21 @@
             ];
             format = "amazon"; # ami
           };
+
+          actions-runner = inputs.nixos-generators.nixosGenerate {
+            inherit system;
+            modules = [
+              ({...}: { amazonImage.sizeMB = 6 * 1024; })
+              inputs.srvos.nixosModules.server
+              inputs.srvos.nixosModules.hardware-amazon
+              ./modules/profiles/common.nix
+              ./modules/mixins/github-actions
+            ];
+            specialArgs = {
+              diskSize = 6 * 1024; # 6GB
+            };
+            format = "amazon"; # ami
+          };
         };
       };
     };

modules/mixins/github-actions/default.nix

@@ -0,0 +1,81 @@
+# GitHub Actions runner mixin
+# In theory, compatible with x86_64-linux and aarch64-linux.
+{ pkgs, ... }:
+let
+  name = "altf4llc-${pkgs.stdenv.system}";
+in
+{
+  imports = [
+    ../alloy
+    ../docker
+  ];
+
+  nix = {
+    extraOptions = ''
+      min-free = ${toString (5 * 1024 * 1024 * 1024)}
+      max-free = ${toString (5 * 1024 * 1024 * 1024)}
+      extra-experimental-features = flakes nix-command
+    '';
+    settings = {
+      cores = 4;
+      trusted-users = [ "root" "github-runner" ];
+    };
+  };
+
+  users.groups.github-runner = {};
+  users.users.github-runner = {
+    group = "github-runner";
+    extraGroups = [ "docker" ];
+    isNormalUser = true;
+    home = "/run/github-runner/${name}";
+  };
+
+  services.github-runners.${name} = {
+    enable = true;
+    url = "https://github.com/ALT-F4-LLC";
+    user = "github-runner";
+    tokenFile = "/run/keys/github-runner";
+    serviceOverrides = {
+      ReadWritePaths = [ "/nix/var/nix/profiles/per-user/" ];
+      ProtectHome = "tmpfs";
+    };
+
+    extraLabels = [ "nixos" "nix" pkgs.stdenv.system ];
+
+    extraPackages = with pkgs; [
+      awscli2
+      bashInteractive
+      bzip2
+      cachix
+      coreutils-full
+      cpio
+      curl
+      diffutils
+      docker
+      findutils
+      gawk
+      getconf
+      getent
+      gnugrep
+      gnupatch
+      gnused
+      gnutar
+      gzip
+      jq
+      just
+      less
+      mkpasswd
+      ncurses
+      netcat
+      nixos-rebuild
+      openssh
+      procps
+      stdenv.cc.libc
+      time
+      util-linux
+      which
+      xz
+      zstd
+    ];
+  };
+}