diff --git a/flake.nix b/flake.nix
index c420aae..b6e3e26 100644
--- a/flake.nix
+++ b/flake.nix
@@ -123,6 +123,7 @@
           modules = [
             ./hosts/monolith.nix
             ./system/monolith-gitlab-runner.nix
+            ./system/monolith-forgejo-runner.nix
             ./system/nix-serve.nix
             ./system/steam.nix
           ] ++ common_modules;
diff --git a/hosts/phantom/default.nix b/hosts/phantom/default.nix
index 47b8757..782b783 100644
--- a/hosts/phantom/default.nix
+++ b/hosts/phantom/default.nix
@@ -12,6 +12,7 @@
     ./writefreely.nix
     ./renawiki.nix
     ./email.nix
+    ./forgejo.nix
   ];
 
   # # Enable networking
diff --git a/hosts/phantom/email.nix b/hosts/phantom/email.nix
index 8d3021b..fbe33d7 100644
--- a/hosts/phantom/email.nix
+++ b/hosts/phantom/email.nix
@@ -9,13 +9,21 @@
   mailserver = {
     enable = true;
     fqdn = "mail.lelgenio.xyz";
-    domains = [ "lelgenio.xyz" ];
+    domains = [
+      "lelgenio.xyz"
+      "git.lelgenio.xyz"
+    ];
     certificateScheme = "acme-nginx";
+    # Create passwords with
+    # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
     loginAccounts = {
       "lelgenio@lelgenio.xyz" = {
         hashedPassword = "$2y$05$z5s7QCXcs5uTFsfyYpwNJeWzb3RmzgWxNgcPCr0zjSytkLFF/qZmS";
         aliases = [ "postmaster@lelgenio.xyz" ];
       };
+      "noreply@git.lelgenio.xyz" = {
+        hashedPassword = "$2b$05$TmR1R7ZwXfec7yrOfeBL7u3ZtyXf0up5dEO6uMWSvb/O7LPEm.j0.";
+      };
     };
   };
 
diff --git a/hosts/phantom/forgejo.nix b/hosts/phantom/forgejo.nix
new file mode 100644
index 0000000..94b7169
--- /dev/null
+++ b/hosts/phantom/forgejo.nix
@@ -0,0 +1,56 @@
+{ lib, pkgs, config, ... }:
+let
+  cfg = config.services.forgejo;
+  srv = cfg.settings.server;
+in
+{
+  services.nginx = {
+    virtualHosts.${cfg.settings.server.DOMAIN} = {
+      forceSSL = true;
+      enableACME = true;
+      extraConfig = ''
+        client_max_body_size 512M;
+      '';
+      locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
+    };
+  };
+
+  services.openssh = {
+    authorizedKeysFiles = [
+      "${config.services.forgejo.stateDir}/.ssh/authorized_keys"
+    ];
+    # Recommended by forgejo: https://forgejo.org/docs/latest/admin/recommendations/#git-over-ssh
+    settings.AcceptEnv = "GIT_PROTOCOL";
+  };
+
+  services.forgejo = {
+    enable = true;
+    database.type = "postgres";
+    lfs.enable = true;
+    settings = {
+      service.DISABLE_REGISTRATION = true;
+      actions = {
+        ENABLED = true;
+        DEFAULT_ACTIONS_URL = "github";
+      };
+      server = {
+        DOMAIN = "git.lelgenio.xyz";
+        HTTP_PORT = 3000;
+        ROOT_URL = "https://${srv.DOMAIN}/";
+      };
+      mailer = {
+        ENABLED = true;
+        SMTP_ADDR = "mail.lelgenio.xyz";
+        FROM = "noreply@git.lelgenio.xyz";
+        USER = "noreply@git.lelgenio.xyz";
+      };
+    };
+    mailerPasswordFile = config.age.secrets.phantom-forgejo-mailer-password.path;
+  };
+
+  age.secrets.phantom-forgejo-mailer-password = {
+    file = ../../secrets/phantom-forgejo-mailer-password.age;
+    mode = "400";
+    owner = "forgejo";
+  };
+}
diff --git a/hosts/phantom/mastodon.nix b/hosts/phantom/mastodon.nix
index 3e629d7..adfaf0d 100644
--- a/hosts/phantom/mastodon.nix
+++ b/hosts/phantom/mastodon.nix
@@ -6,5 +6,6 @@
     smtp.fromAddress = "lelgenio@disroot.org";
     streamingProcesses = 2;
     extraConfig.SINGLE_USER_MODE = "true";
+    mediaAutoRemove.olderThanDays = 10;
   };
 }
diff --git a/hosts/phantom/users.nix b/hosts/phantom/users.nix
index 5cc853a..75aee27 100644
--- a/hosts/phantom/users.nix
+++ b/hosts/phantom/users.nix
@@ -2,7 +2,7 @@
   security.rtkit.enable = true;
   services.openssh = {
     enable = true;
-    ports = [ 9022 ];
+    ports = [ 9022 22 ];
     settings = {
       PasswordAuthentication = false;
       KbdInteractiveAuthentication = false;
diff --git a/hosts/phantom/vpsadminos.nix b/hosts/phantom/vpsadminos.nix
index 070017e..40401cd 100644
--- a/hosts/phantom/vpsadminos.nix
+++ b/hosts/phantom/vpsadminos.nix
@@ -13,7 +13,8 @@ let
     "1.1.1.1"
     "2606:4700:4700::1111"
   ];
-in {
+in
+{
   networking.nameservers = mkDefault nameservers;
   services.resolved = mkDefault { fallbackDns = nameservers; };
   networking.dhcpcd.extraConfig = "noipv4ll";
@@ -21,7 +22,7 @@ in {
   systemd.services.systemd-sysctl.enable = false;
   systemd.services.systemd-oomd.enable = false;
   systemd.sockets."systemd-journald-audit".enable = false;
-  systemd.mounts = [ {where = "/sys/kernel/debug"; enable = false;} ];
+  systemd.mounts = [{ where = "/sys/kernel/debug"; enable = false; }];
   systemd.services.rpc-gssd.enable = false;
 
   # Due to our restrictions in /sys, the default systemd-udev-trigger fails
diff --git a/overlays/sway.nix b/overlays/sway.nix
index 4de4395..c6d8d5e 100644
--- a/overlays/sway.nix
+++ b/overlays/sway.nix
@@ -11,7 +11,7 @@
     executable = true;
     text = ''
       systemctl --user import-environment
-      dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway
+      dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway SWAYSOCK
       # systemctl --user stop pipewire wireplumber xdg-desktop-portal xdg-desktop-portal-wlr
       # systemctl --user start pipewire wireplumber xdg-desktop-portal xdg-desktop-portal-wlr
     '';
diff --git a/secrets/monolith-forgejo-runner-token.age b/secrets/monolith-forgejo-runner-token.age
new file mode 100644
index 0000000..aa3deb8
Binary files /dev/null and b/secrets/monolith-forgejo-runner-token.age differ
diff --git a/secrets/phantom-forgejo-mailer-password.age b/secrets/phantom-forgejo-mailer-password.age
new file mode 100644
index 0000000..90fbe73
Binary files /dev/null and b/secrets/phantom-forgejo-mailer-password.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 9bc7c27..07ed876 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -5,9 +5,11 @@ in
   "rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.age".publicKeys = [ main_ssh_public_key ];
   "monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.age".publicKeys = [ main_ssh_public_key ];
   "gitlab-runner-thoreb-telemetria-registrationConfigFile.age".publicKeys = [ main_ssh_public_key ];
+  "monolith-forgejo-runner-token.age".publicKeys = [ main_ssh_public_key ];
   "lelgenio-cachix.age".publicKeys = [ main_ssh_public_key ];
   "monolith-nix-serve-privkey.age".publicKeys = [ main_ssh_public_key ];
   "phantom-nextcloud.age".publicKeys = [ main_ssh_public_key ];
   "phantom-writefreely.age".publicKeys = [ main_ssh_public_key ];
   "phantom-renawiki.age".publicKeys = [ main_ssh_public_key ];
+  "phantom-forgejo-mailer-password.age".publicKeys = [ main_ssh_public_key ];
 }
diff --git a/switch-phantom b/switch-phantom
new file mode 100755
index 0000000..c824b0c
--- /dev/null
+++ b/switch-phantom
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+nix fmt
+
+git diff
+
+nixos-rebuild switch --flake .#phantom \
+  --update-input nixpkgs \
+  --no-write-lock-file \
+  --build-host phantom \
+  --target-host phantom \
+  "$@"
diff --git a/system/configuration.nix b/system/configuration.nix
index 189fa1c..93d828c 100644
--- a/system/configuration.nix
+++ b/system/configuration.nix
@@ -59,7 +59,7 @@
 
   security.rtkit.enable = true;
   services.openssh = {
-    enable = true;
+    enable = false;
     ports = [ 9022 ];
     settings = {
       PermitRootLogin = "no";
diff --git a/system/monolith-forgejo-runner.nix b/system/monolith-forgejo-runner.nix
new file mode 100644
index 0000000..2fa82b4
--- /dev/null
+++ b/system/monolith-forgejo-runner.nix
@@ -0,0 +1,19 @@
+{ pkgs, config, ... }: {
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-actions-runner;
+    instances.default = {
+      enable = true;
+      name = "monolith";
+      url = "https://git.lelgenio.xyz";
+      tokenFile = config.age.secrets.monolith-forgejo-runner-token.path;
+      labels = [
+        # provide a debian base with nodejs for actions
+        "debian-latest:docker://node:18-bullseye"
+        # fake the ubuntu name, because node provides no ubuntu builds
+        "ubuntu-latest:docker://node:18-bullseye"
+        # provide native execution on the host
+        #"native:host"
+      ];
+    };
+  };
+}
diff --git a/system/secrets.nix b/system/secrets.nix
index 0d0870b..c94581c 100644
--- a/system/secrets.nix
+++ b/system/secrets.nix
@@ -6,9 +6,13 @@
       ../secrets/monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.age;
     secrets.gitlab-runner-thoreb-telemetria-registrationConfigFile.file =
       ../secrets/gitlab-runner-thoreb-telemetria-registrationConfigFile.age;
+    secrets.monolith-forgejo-runner-token.file =
+      ../secrets/monolith-forgejo-runner-token.age;
     secrets.rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.file =
       ../secrets/rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.age;
     secrets.monolith-nix-serve-privkey.file =
       ../secrets/monolith-nix-serve-privkey.age;
+    secrets.phantom-forgejo-mailer-password.file =
+      ../secrets/phantom-forgejo-mailer-password.age;
   };
 }