From 65205d9a62edadef94ae89c5cc0a8cf018b8526e Mon Sep 17 00:00:00 2001
From: Noah Pederson <noah@packetlost.dev>
Date: Tue, 14 Jul 2026 20:24:32 -0500
Subject: [PATCH] Add buildkit, move firefox-dev-edition to stable

---
 host-specific/odin/gui.nix        |   2 +-
 host-specific/odin/services.nix   |  26 ++++++++++++++++++++++++++
 secrets/buildkite-agent-token.age | Bin 0 -> 1069 bytes
 secrets/secrets.nix               |   1 +
 4 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 secrets/buildkite-agent-token.age

diff --git a/host-specific/odin/gui.nix b/host-specific/odin/gui.nix
index a822d0a..ded8e00 100644
--- a/host-specific/odin/gui.nix
+++ b/host-specific/odin/gui.nix
@@ -148,7 +148,7 @@ in
     configure-gtk
     dbus-sway-environment
     dbus
-    unstable.firefox-devedition
+    firefox-devedition
     unstable.ghostty
   ];
 }
diff --git a/host-specific/odin/services.nix b/host-specific/odin/services.nix
index 921a66c..4be3a2a 100644
--- a/host-specific/odin/services.nix
+++ b/host-specific/odin/services.nix
@@ -111,4 +111,30 @@ in
       pkgs.git-lfs
     ];
   };
+
+  age.secrets.buildkite-agent-token = {
+    file = ../../secrets/buildkite-agent-token.age;
+    owner = "buildkite-agent-default";
+  };
+  services.buildkite-agents.default = {
+    tokenPath = config.age.secrets.buildkite-agent-token.path;
+    name = "%hostname-%n";
+    tags = {
+      queue = "default";
+      nixos = "true";
+      docker = "true";
+    };
+    extraGroups = [ "docker" ];
+    runtimePackages = with pkgs; [
+      bash
+      docker-client
+      git
+      git-lfs
+      gnutar
+      gzip
+      nix
+    ];
+  };
+
+  nix.settings.trusted-users = [ "buildkite-agent-default" ];
 }
diff --git a/secrets/buildkite-agent-token.age b/secrets/buildkite-agent-token.age
new file mode 100644
index 0000000000000000000000000000000000000000..5a147e5e67a7f86a050d0a6166cad50390e98550
GIT binary patch
literal 1069
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCUl57RaZ3{)t|u5ivX
zOASu4bW1EY&@T)!Gc0g5b2P6sDll+OuJUm$H%kjIcgzfNE$2$J^r$e;^!BfaDt6B(
zNscmbiE_^OHuW(mb$8D72nY^vG%=|xG%rmxFGja5&?za^w_L#^r7)+W!o|rYF+JVb
z(j>#L#M>l4Pd~_4+t@v-tfI`%t01SsC@aLLGMy_q%|$;jF()LTINv2K*CNp}Cpq2C
z+@&NfHP<O4$s{LJKe9YBDz(zz6T`OfGK0{fa)ofi>;m)rg6zud{0P6$M5i+U<jBZ^
zN`ut=r11RksQk>#>_~UZAT#|CU#=3vVl$JX{H!oPkEE<H&oZ}Ecf-7ttQ;dZAESI9
zGyQTC4=?9%_tK=wP;|eAhxs{2I4Y#2L}a>FB}chh`s;fK<(LNs7MB$J8WtJ{RV7+z
zS9w%a_$GOJq=)*4m~eSoga;J36*#(PmRAKwMVc5?_(gcS1bSwq<a&7pXuIS_1!Z}s
zo4XqXVAvK^=ALF)u8?09RhDAru3a9G>lIOEmYA>akrC>a=$dZi9g*mp?eA3@UYX<M
zXYS(R$mJSpn3tR#RpD6@mXTVJWn58UoLyPw9uS_UZ|bj|Zkny_T~cmrkYDL$f$q1o
z+(IY!bcK-YVmDX644)E5H^;p2NK?NEkBs~zPw%L_?BJ3rGt+RRP-8>iVq*(~axO=2
zgOr>MkJ1qTh{&XzB%^%C@G^^_Vzcz10>8YR0`D9P--@!zT#vw%e01BQqFfyP(iNQi
zi+qz)A|g#3^NjS}(;|yQ(=#HX0!;n={R_>ia{c{+%6-era*X_(1G%(A3c><|{oI_&
zj4b@Bf;=Ph@(O*bJY6FSBGWB1J&g37gMtb|y$W1QF>DKR$<Ol)RLJr&$j>$|@w4<P
zu87b!GxT$E()P+tP4&%Ach3v-w=Ao4ipnVs^hpVE<jOa)$S4kvOb@CocdRtA%=WM-
zFbxmLFf&Uljmpn-4ybf0&kpb_@Ni5o=F-*GRq%{(DRK--&nXJ3NKZHMiEyfltSYSt
zuFNY<POtKC$#IVIP14V*%1zUD<tp0Se<AAm=KK#6)SoSQuxOLI`Yo-8dRpu+4eH(G
zMP*&5H)kKx*mJPfX1?;R@WpMbxJ*RqtX2rx?fB2|RBHGAy9<~bCf?lfG%naFME*fd
vd6To*eCcN=j&&RS30(H!=|Y}$ObX!~j=$`Axa}+@*rV!<k9`$+vu*_dKx}Gu

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index e249569..833f51b 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -43,6 +43,7 @@ in
   "pocket-id-encryption-key.age".publicKeys = [ misaki ] ++ noah;
   "tranquil-pds-env.age".publicKeys = [ misaki ] ++ noah;
   "github-actions-token.age".publicKeys = [ odin ] ++ noah;
+  "buildkite-agent-token.age".publicKeys = [ odin ] ++ noah;
   "influxdb-user-password.age".publicKeys = [ misaki ] ++ noah;
   "influxdb-admin-password.age".publicKeys = [ misaki ] ++ noah;
   "influxdb-admin-token.age".publicKeys = [ misaki ] ++ noah;
-- 
2.51.2