diff --git a/machines/urithiru/default.nix b/machines/urithiru/default.nix
index bba260b5..37990798 100644
--- a/machines/urithiru/default.nix
+++ b/machines/urithiru/default.nix
@@ -53,6 +53,7 @@
         enable = true;
         count = 6;
       };
+      git.runner.enable = true;
     };
   };
 
diff --git a/machines/urithiru/hardware.nix b/machines/urithiru/hardware.nix
index b0aaac82..9608313d 100644
--- a/machines/urithiru/hardware.nix
+++ b/machines/urithiru/hardware.nix
@@ -51,6 +51,14 @@
       device = "zdata/data";
       fsType = "zfs";
     };
+    "/var/lib/private/gitlab-runner" = {
+      device = "zdata/big-apps/gitlab-runner";
+      fsType = "zfs";
+    };
+    "/var/lib/docker" = {
+      device = "zdata/big-apps/docker";
+      fsType = "zfs";
+    };
     "/boot/ESP0" = {
       device = "/dev/disk/by-uuid/6ED1-0638";
       fsType = "vfat";
diff --git a/modules/base/network/wireguard.nix b/modules/base/network/wireguard.nix
index 93a4cc0d..75fc14e7 100644
--- a/modules/base/network/wireguard.nix
+++ b/modules/base/network/wireguard.nix
@@ -142,8 +142,8 @@ in
           wantedBy = [ "multi-user.target" ];
           after = [ "network.target" ];
           script = ''
-           ${pkgs.udp2raw}/bin/udp2raw -s -l 0.0.0.0:8080 -r 127.0.0.1:51820 \
-             -k "$(cat ${config.age.secrets."files/wireguard/udp2raw".path})"
+            ${pkgs.udp2raw}/bin/udp2raw -s -l 0.0.0.0:8080 -r 127.0.0.1:51820 \
+              -k "$(cat ${config.age.secrets."files/wireguard/udp2raw".path})"
           '';
         };
         udp2raw-client = lib.mkIf config.chvp.base.network.wireguard.onCorporate {
diff --git a/modules/services/git/default.nix b/modules/services/git/default.nix
index 4397699c..94eae7fb 100644
--- a/modules/services/git/default.nix
+++ b/modules/services/git/default.nix
@@ -1,6 +1,8 @@
 { config, lib, pkgs, ... }:
 
 {
+  imports = [ ./runner.nix ];
+
   options.chvp.services.git.enable = lib.mkOption {
     default = false;
     example = true;
diff --git a/modules/services/git/runner.nix b/modules/services/git/runner.nix
new file mode 100644
index 00000000..ef88a787
--- /dev/null
+++ b/modules/services/git/runner.nix
@@ -0,0 +1,71 @@
+{ config, lib, pkgs, ... }:
+
+{
+  options.chvp.services.git.runner.enable = lib.mkOption {
+    default = false;
+    example = true;
+  };
+
+  config = lib.mkIf config.chvp.services.git.runner.enable {
+    services.gitlab-runner = {
+      enable = true;
+      services = {
+        nix = {
+          registrationConfigFile = config.age.secrets."passwords/services/gitlab-runner/registration".path;
+          dockerImage = "alpine";
+          dockerVolumes = [
+            "/nix/store:/nix/store:ro"
+            "/nix/var/nix/db:/nix/var/nix/db:ro"
+            "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+          ];
+          dockerDisableCache = true;
+          preBuildScript = pkgs.writeScript "setup-container" ''
+            mkdir -p -m 0755 /nix/var/log/nix/drvs
+            mkdir -p -m 0755 /nix/var/nix/gcroots
+            mkdir -p -m 0755 /nix/var/nix/profiles
+            mkdir -p -m 0755 /nix/var/nix/temproots
+            mkdir -p -m 0755 /nix/var/nix/userpool
+            mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+            mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+            mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+            mkdir -p -m 0700 "$HOME/.nix-defexpr"
+
+            . ${pkgs.nix}/etc/profile.d/nix.sh
+
+            ${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [ nix cacert git openssh ])}
+
+            ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
+            ${pkgs.nix}/bin/nix-channel --update nixpkgs
+          '';
+          environmentVariables = {
+            ENV = "/etc/profile";
+            USER = "root";
+            NIX_REMOTE = "daemon";
+            PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+            NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
+          };
+          tagList = [ "nix" ];
+        };
+        docker-images = {
+          registrationConfigFile = config.age.secrets."passwords/services/gitlab-runner/registration".path;
+          dockerImage = "docker:stable";
+          dockerVolumes = [
+            "/var/run/docker.sock:/var/run/docker.sock"
+          ];
+          tagList = [ "docker-images" ];
+        };
+        default = {
+          registrationConfigFile = config.age.secrets."passwords/services/gitlab-runner/registration".path;
+          dockerImage = "debian:stable";
+        };
+      };
+    };
+    virtualisation.docker = {
+      enable = true;
+      storageDriver = "zfs";
+    };
+    age.secrets."passwords/services/gitlab-runner/registration" = {
+      file = ../../../secrets/passwords/services/gitlab-runner/registration.age;
+    };
+  };
+}
diff --git a/secrets.nix b/secrets.nix
index 82f81182..0632562d 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -58,6 +58,7 @@ in
   "secrets/passwords/services/git/jws.age".publicKeys = [ lasting-integrity ] ++ users;
   "secrets/passwords/services/git/otp.age".publicKeys = [ lasting-integrity ] ++ users;
   "secrets/passwords/services/git/secret.age".publicKeys = [ lasting-integrity ] ++ users;
+  "secrets/passwords/services/gitlab-runner/registration.age".publicKeys = [ urithiru ] ++ users;
 
   "secrets/passwords/services/mastodon/otp.age".publicKeys = [ lasting-integrity ] ++ users;
   "secrets/passwords/services/mastodon/key.age".publicKeys = [ lasting-integrity ] ++ users;
diff --git a/secrets/passwords/services/gitlab-runner/registration.age b/secrets/passwords/services/gitlab-runner/registration.age
new file mode 100644
index 00000000..652f6b34
Binary files /dev/null and b/secrets/passwords/services/gitlab-runner/registration.age differ