diff --git a/.forgejo/workflows/deploy.yaml b/.forgejo/workflows/deploy.yaml
new file mode 100644
index 0000000..37544d6
--- /dev/null
+++ b/.forgejo/workflows/deploy.yaml
@@ -0,0 +1,11 @@
+on: [ push ]
+jobs:
+  blog-pim:
+    runs-on: docker
+    container:
+      image: git.kun.is/home/forgejo-nix-action:687d16c49ea7936068bac64ec68c480a9d681962
+      options: "-v /var/run/secrets/kubernetes.io/serviceaccount:/var/run/secrets/kubernetes.io/serviceaccount"
+    steps:
+      - name: Clone repository
+        run: git clone ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git src
+      - run: ls -alh /var/run/secrets/kubernetes.io/serviceaccount
diff --git a/kubenix-modules/forgejo/runner-config.nix b/kubenix-modules/forgejo/runner-config.nix
new file mode 100644
index 0000000..2f636f3
--- /dev/null
+++ b/kubenix-modules/forgejo/runner-config.nix
@@ -0,0 +1,34 @@
+{
+  log.level = "info";
+  host.workdir_parent = { };
+
+  runner = {
+    file = ".runner";
+    capacity = 1;
+    env_file = ".env";
+    timeout = "3h";
+    insecure = false;
+    fetch_timeout = "5s";
+    fetch_interval = "2s";
+    labels = [ ];
+    envs = { };
+  };
+
+  cache = {
+    enabled = true;
+    dir = "";
+    host = "";
+    port = 0;
+    external_server = "";
+  };
+
+  container = {
+    network = "";
+    privileged = false;
+    options = { };
+    workdir_parent = { };
+    valid_volumes = [ ];
+    docker_host = "";
+    force_pull = false;
+  };
+}