From ed510001fdcf2853c36f67d8d6af6480abb6ec1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Leonardo=20Eug=C3=AAnio?= <lelgenio@disroot.org>
Date: Sun, 15 Feb 2026 03:29:38 -0300
Subject: [PATCH] secrets: migrate forgejo runner to sops

---
 secrets/monolith-forgejo-runner-token.age | Bin 688 -> 0 bytes
 secrets/secrets.nix                       |   1 -
 system/monolith-forgejo-runner.nix        |   2 +-
 system/secrets.nix                        |   1 -
 4 files changed, 1 insertion(+), 3 deletions(-)
 delete mode 100644 secrets/monolith-forgejo-runner-token.age

diff --git a/secrets/monolith-forgejo-runner-token.age b/secrets/monolith-forgejo-runner-token.age
deleted file mode 100644
index fff63ca77be3834049d16ab0bbac97efd8e6b8a8..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 688
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!*`Do#{zDlf0_NaxCM(=G@#aZmCI
z&Cm9;47W@xHwudg3^0puv-C7H4yy{aaPiGFPxAM3ipmLzDs?u_F?S9r$SSt9$ae|z
zGSBBqbkcTBsc;N(bO{d5%5zH9cXrKj&-8T5Gj%t0^bRl#E%0`AjwsSMDvxq@FY)tC
zOEWajGOuzeD=RWd@~EidDoM{U4=A*V3dnPE4YY7i_l!(04GHxO^)U7}E6&l+HP+6p
zG&VByH8M312}n<O4bKZna`Ezu3U~6*_bR9?<#KWgORjWJak2Cb@~$Wg@(p(iaSBV!
zNhxp*PRY&p4=zjeOn3JSGWBvRj0`Eyh|0(<%kvEI&Ty?V$@g|L@Z-u&PRxlg$|y9;
zw=B(%D0j~?&Mk8@waoM>N_S87&NhxRi8MD%%PB7?_b;~8PcP4NG4?S|cFZphHVR7(
z*EZyGG>mljx2*Cs)ea1ZN;3`4bILSzD^CwiDNf1@at?De&b0J2$n$Z^&h*a7b<fN(
z3(2SqjEvMScg%?N^$G~!^6{(m2n_KuGYk$lbj=KQPc1eKaLIMm_Rb73O>&HKOAJT~
zPOgYFj|?r%cJxa!^DC?{3o~%9D)#oP^zime;z|niD#-Q=sI<&W%5rxJC@#yZ@G1#0
zF3oeTtnkn_2r`e-4yi2iOe>6ZDacAoEHTgy*LSMW*3ZasEKA9C&EVqF)zwun$TyFu
zD$n+HEH0{Ys)%%U4amvJs&o&`%S=o433N0p4|9t0)-N><sIuT<WMq|P_|<$~<y-_)
zh|NcaSJOSCUN{A7<Z4TX+*a8q+AGFaEpsRN=mg7S$5YqvrTx)&t-Hfl&p%P_!iGOT
WW?$UNwj}P13;zzjI*lH|0#N`m2It`b

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 4793a21..b361438 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -2,7 +2,6 @@ let
   main_ssh_public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxR/w+38b2lX90yNBqhq3mUmkn1WGu6GAPhN1tVp2ZjYRJNV/+5gWCnTtOWYtDx35HmK/spQ2Qy8X9ttkzORa24fysNx1Iqn/TiXhD7eIJjbGPnrOpIKTkW5/uB3SD/P5NBSa06//BaqJU4sBlG79hoXRpod052hQtdpTVDiMCIV+iboWPKqopmJJfWdBtVnHXs9rep0htPRExxGslImFk7Z6xjcaHyCpIQZPlOGf+sGsmUU7jRqzvZFV8ucIdbnAlMHrU4pepNFhuraESyZVTa/bi9sw0iozXp5Q5+5thMebEslmT1Z771kI4sieDy+O4r8c0Sx2/VY1UAzcpq1faggc3YB01MTh+tiEC6xdMvZLrQGL1NBWjHleMyL53GU5ERluC0vXJF3Hv3BGGBDfXWbrEm5n06DHr2apRVJGC0LwiQ7Woud1X4V4X1pKSusxCVMjT2lmcOwV6YhKhB2sowJc1OdMx4+tL0UWE+YKSZgBHfolwk6ml0F4EO9nnUHc= lelgenio@i15";
 in
 {
-  "monolith-forgejo-runner-token.age".publicKeys = [ main_ssh_public_key ];
   "monolith-nix-serve-privkey.age".publicKeys = [ main_ssh_public_key ];
   "factorio-settings.age".publicKeys = [ main_ssh_public_key ];
   "phantom-nextcloud.age".publicKeys = [ main_ssh_public_key ];
diff --git a/system/monolith-forgejo-runner.nix b/system/monolith-forgejo-runner.nix
index 3297514..345f861 100644
--- a/system/monolith-forgejo-runner.nix
+++ b/system/monolith-forgejo-runner.nix
@@ -6,7 +6,7 @@
       enable = true;
       name = "monolith";
       url = "https://git.lelgenio.com";
-      tokenFile = config.age.secrets.monolith-forgejo-runner-token.path;
+      tokenFile = config.sops.secrets."forgejo-runners/git.lelgenio.com-default".path;
       labels = [
         # provide a debian base with nodejs for actions
         "debian-latest:docker://node:18-bullseye"
diff --git a/system/secrets.nix b/system/secrets.nix
index 1e738a5..acf4281 100644
--- a/system/secrets.nix
+++ b/system/secrets.nix
@@ -2,7 +2,6 @@
 {
   age = {
     identityPaths = [ "/root/.ssh/id_rsa" ];
-    secrets.monolith-forgejo-runner-token.file = ../secrets/monolith-forgejo-runner-token.age;
     secrets.monolith-nix-serve-privkey.file = ../secrets/monolith-nix-serve-privkey.age;
   };
 }