{
  lib,
  config,
  pkgs,
  self,
  ...
}:
with lib; let
  psCfg = config.pub-solar;
  cfg = config.pub-solar.ci-runner;
in {
  options.pub-solar.ci-runner = {
    enable = mkEnableOption "Enables a systemd service that runs drone-ci-runner";
  };

  config = mkIf cfg.enable {
    systemd.user.services.ci-runner = {
      enable = true;

      description = "CI runner for the PubSolarOS repository that can run test VM instances with KVM.";

      serviceConfig = {
        Type = "simple";
        Restart = "always";
      };

      path = [
        pkgs.git
        pkgs.nix
        pkgs.libvirt
      ];

      wantedBy = ["multi-user.target"];
      after = ["network.target" "libvirtd.service"];

      script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
    };

    age.secrets."drone-runner-exec-config" = {
      file = "${self}/secrets/drone-runner-exec-config";
      mode = "700";
      owner = psCfg.user.name;
    };
  };
}