{
  config,
  lib,
  pkgs,
  ...
}:
pkgs.testers.runNixOSTest {
  name = "gitea-runner";
  nodes.machine =
    { pkgs, ... }:
    {
      services.gitea = {
        enable = true;
        database.type = "sqlite3";
        settings = {
          server = {
            HTTP_PORT = 3000;
            ROOT_URL = "http://localhost:3000";
            DOMAIN = "localhost";
          };
          actions.ENABLED = true;
          service.DISABLE_REGISTRATION = true;
        };
      };

      specialisation.runner = {
        inheritParentConfig = true;
        configuration.services.gitea-actions-runner.instances.test = {
          enable = true;
          name = "ci";
          url = "http://localhost:3000";
          labels = [ "native:host" ];
          tokenFile = "/var/lib/gitea/runner_token";
        };
      };
    };

  testScript = ''
    start_all()

    machine.wait_for_unit("gitea.service")
    machine.wait_for_open_port(3000)

    # Generate runner token
    machine.succeed(
        "su -l gitea -s /bin/sh -c '${pkgs.gitea}/bin/gitea actions generate-runner-token --work-path /var/lib/gitea' | tail -1 | sed 's/^/TOKEN=/' > /var/lib/gitea/runner_token"
    )

    # Switch to runner specialisation
    machine.succeed(
        "/run/current-system/specialisation/runner/bin/switch-to-configuration test"
    )

    # Start the runner (specialisation switch doesn't auto-start new services)
    machine.succeed("systemctl start gitea-runner-test.service")
    machine.wait_for_unit("gitea-runner-test.service")
    machine.succeed("sleep 5")
    machine.succeed("test -f /var/lib/gitea-runner/test/.runner")
  '';
}