{config, ...}: let
  registrationConfigFile = config.age.secrets."services/gitlab/runner-registration".path;
in {
  services.gitlab-runner = {
    enable = true;
    services = {
      docker = {
        inherit registrationConfigFile;
        dockerImage = "docker:stable";
        dockerVolumes = ["/var/run/docker.sock:/var/run/docker.sock"];
        tagList = ["docker-images"];
      };
    };
  };

  virtualisation.docker.enable = true;
}