I just wasted most of my evening debugging my server's nftables, which I was trying to set up to not ever send container traffic to my tailnet. Turns out I misread the required packet mark 0x80000 as 0x800000. I should really look into network namespaces, and just stuff Tailscale and the relevant services in one of those (is that how it works?)
Anyway, at last I have a Forgejo actions runner set up on my NixOS homelab. I think the best part is that the container in which workflows run is just 94 kB, and it's essentially all administrative overhead: the filesystem itself is just a bunch of symlinks to /nix/store, *which isn't there*. I'm mounting the host's nix directory, which means automatic caching for derivations across runs, and it's even potentially warmed up on projects for which I use the homelab as a remote build farm. This took some finagling to get right, so I might write a blog post about the setup