fix(forgejo): add gitea-runner to Nix allowed & trusted users

services/forgejo/runner.nix

@@ -18,12 +18,28 @@ in
       tokenFile = ""; # dynamically retrieved from Forgejo (see further below)
       name = config.networking.hostName;
       labels = [ "native:host" ];
+      hostPackages = with pkgs; [
+        # default
+        bash
+        coreutils
+        curl
+        gawk
+        gitMinimal
+        gnused
+        nodejs
+        wget
+
+        nix
+      ];
       settings = {
         container.network = "host";
       };
     };
   };
 
+  nix.settings.allowed-users = [ "gitea-runner" ];
+  nix.settings.trusted-users = [ "gitea-runner" ];
+
   # automatically get registration token from forgejo
   systemd.services.forgejo.postStart = lib.mkBefore ''
     ${pkgs.bash}/bin/bash -c '(while ! ${pkgs.netcat-openbsd}/bin/nc -z -U ${forgejoCfg.settings.server.HTTP_ADDR}; do echo "Waiting for unix ${forgejoCfg.settings.server.HTTP_ADDR} to open..."; sleep 2; done); sleep 2'