{
  config,
  lib,
  pkgs,
  ...
}: let
  cfg = config.frajul.gitea-runner;
in {
  options = {
    frajul.gitea-runner = {
      enable = lib.mkEnableOption "gitea-runner";
      secretsFile = lib.mkOption {
        type = lib.types.path;
        description = "A sops encrpyted file containing a 'gitea_token' secret";
      };
    };
  };

  config = lib.mkIf cfg.enable {
    virtualisation.docker.enable = true;

    sops.secrets."gitea_token" = {
      owner = config.users.users.nix.name;
      sopsFile = cfg.secretsFile;
    };

    services.gitea-actions-runner.instances."builder" = {
      enable = true;
      url = "https://gitlab.julian-mutter.de";
      name = "builder";
      tokenFile = config.sops.secrets."gitea_token".path;
      labels = [
        # fake the ubuntu name, because node provides no ubuntu builds
        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
        # my custom nix+devenv ci container
        "nix-ci:docker://gitlab.julian-mutter.de/julian/nix-ci-container:latest"
        # devenv
        "devenv:docker://ghcr.io/cachix/devenv/devenv:latest"
        # provide native execution on the host
        "nixos:host"
      ];
      # Packages are intjected into PATH for "nixos:host"
      hostPackages = with pkgs; [
        bash
        coreutils
        curl
        gawk
        gitMinimal
        nodejs # Required by many standard actions (like actions/checkout)
        docker
        devenv
        wget
        nix
      ];
    };
  };
}