From 6f81a81020a239ee968ba6eb5c28c3e45185c155 Mon Sep 17 00:00:00 2001
From: Christoph Hollizeck <christoph.hollizeck@hey.com>
Date: Mon, 23 Mar 2026 16:59:35 +0100
Subject: [PATCH] forgejo=actions: add no permissions PAT so runner does not
 get rate limited

---
 modules/server/forgejo-runner.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/server/forgejo-runner.nix b/modules/server/forgejo-runner.nix
index 03fe7bf..e5fa599 100644
--- a/modules/server/forgejo-runner.nix
+++ b/modules/server/forgejo-runner.nix
@@ -13,6 +13,8 @@
         };
       };
 
+      users.groups.secrets-access.members = [ "gitea-runner" ];
+
       services.gitea-actions-runner = {
         package = pkgs.forgejo-runner;
         instances = {