split forgejo-runner into own service file for staged deployment

- Extract forgejo-runner config from forgejo.nix into forgejo-runner.nix
- Move forgejo-runner to stage 2 (requires running Forgejo for token)
- Remove all stage-2 secrets from sops.nix (each service file owns its secrets)
- Update first-install docs with corrected staged deployment flow
- Fixes deployment failure caused by runner crashing with placeholder token

hosts/cryodev-main/services/default.nix

@@ -1,13 +1,17 @@
 {
   imports = [
+    # Stufe 1: Services ohne externe Abhaengigkeiten
     ./forgejo.nix
-    ./headplane.nix
     ./headscale.nix
     ./mailserver.nix
     ./netdata.nix
     ./nginx.nix
     ./openssh.nix
     ./sops.nix
-    ./tailscale.nix
+
+    # Stufe 2: Erst aktivieren wenn Headscale/Forgejo laufen und echte Secrets existieren
+    # ./forgejo-runner.nix  # braucht: forgejo-runner/token (Forgejo)
+    # ./headplane.nix       # braucht: headplane/agent_pre_authkey (Headscale)
+    # ./tailscale.nix       # braucht: tailscale/auth-key (Headscale)
   ];
 }

hosts/cryodev-main/services/forgejo-runner.nix

@@ -0,0 +1,22 @@
+{
+  config,
+  outputs,
+  constants,
+  ...
+}:
+
+{
+  imports = [
+    outputs.nixosModules.forgejo-runner
+  ];
+
+  services.forgejo-runner = {
+    enable = true;
+    url = "https://${constants.services.forgejo.fqdn}";
+    tokenFile = config.sops.secrets."forgejo-runner/token".path;
+  };
+
+  sops.secrets."forgejo-runner/token" = {
+    mode = "0400";
+  };
+}

hosts/cryodev-main/services/forgejo.nix

@@ -8,7 +8,6 @@
 {
   imports = [
     outputs.nixosModules.forgejo
-    outputs.nixosModules.forgejo-runner
   ];
 
   services.forgejo = {
@@ -32,17 +31,6 @@
     };
   };
 
-  services.forgejo-runner = {
-    enable = true;
-    url = "https://${constants.services.forgejo.fqdn}";
-    tokenFile = config.sops.secrets."forgejo-runner/token".path;
-  };
-
-  sops.secrets."forgejo-runner/token" = {
-    # gitea-runner user is created by gitea-actions-runner service
-    mode = "0400";
-  };
-
   services.nginx.virtualHosts."${constants.services.forgejo.fqdn}" = {
     forceSSL = true;
     enableACME = true;

hosts/cryodev-main/services/sops.nix

@@ -13,9 +13,9 @@
   sops = {
     defaultSopsFile = ../secrets.yaml;
     # age.keyFile is not set, sops-nix defaults to using /etc/ssh/ssh_host_ed25519_key
-    secrets = {
-      "forgejo-runner/token" = { };
-      "tailscale/auth-key" = { };
-    };
+
+    # Secrets fuer Stufe-2-Services werden in deren eigenen Dateien definiert:
+    # forgejo-runner/token -> forgejo-runner.nix
+    # tailscale/auth-key   -> tailscale.nix (via Modul)
   };
 }