chore: split nixos and opentofu

nixos/modules/services/actions/default.nix

@@ -0,0 +1,49 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.homelab.services.actions;
+in {
+  options.homelab.services.actions.enable = lib.mkEnableOption "Actions runner";
+
+  config = lib.mkIf cfg.enable {
+    homelab.virtualisation.containers.enable = true;
+
+    services.gitea-actions-runner = {
+      instances.depeuter-dev = {
+        enable = true;
+        url = "https://git.depeuter.dev";
+        tokenFile = "/etc/runner/depeuter-dev";
+        name = config.networking.hostName;
+        labels = [
+          "debian-11:docker://debian:11"
+          "debian-12:docker://debian:12"
+          "debian-latest:docker://debian:latest"
+          "docker:host"
+          "Linux:host"
+          "self-hosted:host"
+          "ubuntu-22.04:docker://ubuntu:22.04"
+          "ubuntu-24.04:docker://ubuntu:24.04"
+          "ubuntu-latest:docker://ubuntu:latest"
+        ];
+        settings = {
+          cache.enabled = true;
+          container.privileged = true;
+        };
+        hostPackages = with pkgs; [
+          bash
+          cmake
+          coreutils
+          curl
+          docker
+          gawk
+          git
+          gnused
+          nodejs
+          openssh
+          wget
+        ];
+      };
+    };
+  };
+}
+

nixos/modules/services/default.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./actions
+    ./openssh
+  ];
+}

nixos/modules/services/openssh/default.nix

@@ -0,0 +1,20 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.homelab.services.openssh;
+in {
+  options.homelab.services.openssh.enable = lib.mkEnableOption "OpenSSH daemon";
+
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
+      # Enable the OpenSSH daemon.
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        PermitRootLogin = "no";
+        # Disable keyboard-interactive authentication.
+        KbdInteractiveAuthentication = false;
+      };
+    };
+  };
+}