From f72966f229cef1377b273fed397bd03c5a7d9173 Mon Sep 17 00:00:00 2001
From: Alex Mickelson <alexmickelson96@gmail.com>
Date: Wed, 18 Feb 2026 21:00:32 -0700
Subject: [PATCH] automated garbage collection

---
 .gitea/workflows/cleanup-nixos.yml | 33 ++++++++++++++++++++++++++++++
 nix/modules/gitea-runner.nix       | 12 +++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 .gitea/workflows/cleanup-nixos.yml

diff --git a/.gitea/workflows/cleanup-nixos.yml b/.gitea/workflows/cleanup-nixos.yml
new file mode 100644
index 0000000..384683f
--- /dev/null
+++ b/.gitea/workflows/cleanup-nixos.yml
@@ -0,0 +1,33 @@
+name: Cleanup NixOS Generations
+on:
+  schedule:
+    - cron: '0 2 * * 0'  # Every Sunday at 2am
+  workflow_dispatch:
+
+jobs:
+  cleanup-generations:
+    runs-on: [home-server]
+    steps:
+      - name: Cleanup old NixOS generations
+        run: |
+          echo "Deleting generations older than 7 days..."
+          sudo nix-collect-garbage --delete-older-than 7d
+
+  notify-on-failure:
+    runs-on: home-server
+    needs: cleanup-generations
+    if: failure()
+    uses: ./.gitea/workflows/notify-ntfy.yml
+    secrets:
+      NTFY_CHANNEL: ${{ secrets.NTFY_CHANNEL }}
+    with:
+      title: "NixOS Cleanup Failed"
+      message: |
+        Failed to cleanup old NixOS generations
+        Workflow: ${{ gitea.workflow }}
+        Repository: ${{ gitea.repository }}
+        Job: cleanup-generations
+        Status: ${{ needs.cleanup-generations.result }}
+      action_url: "https://git.alexmickelson.guru/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }}"
+      priority: "high"
+      tags: "rotating_light,nixos"
diff --git a/nix/modules/gitea-runner.nix b/nix/modules/gitea-runner.nix
index 3076e3d..b6794ac 100644
--- a/nix/modules/gitea-runner.nix
+++ b/nix/modules/gitea-runner.nix
@@ -54,6 +54,18 @@
 
   users.groups.gitea-runner = { };
 
+  security.sudo.extraRules = [
+    {
+      users = [ "gitea-runner" ];
+      commands = [
+        {
+          command = "${pkgs.nix}/bin/nix-collect-garbage";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+
   system.activationScripts.zfs-delegate-gitea-runner = {
     text = 
       let