refactor: Move sw into properly nested modules with unconditional import

sw/builders/default.nix

@@ -11,21 +11,111 @@
   ...
 }:
 
-lib.mkMerge [
-  (import ./programs.nix {
-    inherit
-      config
-      lib
-      pkgs
-      inputs
-      ;
-  })
-  (import ./services.nix {
-    inherit
-      config
-      lib
-      pkgs
-      inputs
-      ;
-  })
-]
+with lib;
+
+let
+  cfg = config.athenix.sw.builders;
+in
+{
+  options.athenix.sw.builders = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable build server configuration.
+
+        Includes:
+        - SSH host keys for common Git servers (factory.uga.edu, github.com)
+        - Gitea Actions runner support (optional)
+        - Build tools and dependencies
+
+        Recommended for: CI/CD servers, build containers, development infrastructure
+      '';
+      example = true;
+    };
+
+    giteaRunner = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable Gitea Actions self-hosted runner.
+
+          This runner will connect to a Gitea instance and execute CI/CD workflows.
+          Requires manual setup of the token file before the service will start.
+        '';
+        example = true;
+      };
+
+      url = mkOption {
+        type = types.str;
+        description = ''
+          URL of the Gitea instance to connect to.
+          This should be the base URL without any path components.
+        '';
+        example = "https://git.factory.uga.edu";
+      };
+
+      tokenFile = mkOption {
+        type = types.path;
+        default = "/var/lib/gitea-runner-token";
+        description = ''
+          Path to file containing Gitea runner registration token.
+
+          To generate:
+          1. Go to your Gitea repository settings
+          2. Navigate to Actions > Runners
+          3. Click "Create new Runner"
+          4. Save the token to this file:
+             echo "TOKEN=your-token-here" | sudo tee /var/lib/gitea-runner-token > /dev/null
+
+          The service will not start until this file exists.
+        '';
+        example = "/var/secrets/gitea-runner-token";
+      };
+
+      extraLabels = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        description = ''
+          Additional labels to identify this runner in workflow files.
+          Use labels to target specific runners for different job types.
+        '';
+        example = [
+          "self-hosted"
+          "nix"
+          "x86_64-linux"
+        ];
+      };
+
+      name = mkOption {
+        type = types.str;
+        default = "athenix";
+        description = ''
+          Unique name for this runner instance.
+          Shown in Gitea's runner list and logs.
+        '';
+        example = "nix-builder-1";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    (import ./programs.nix {
+      inherit
+        config
+        lib
+        pkgs
+        inputs
+        ;
+    })
+    (import ./services.nix {
+      inherit
+        config
+        lib
+        pkgs
+        inputs
+        ;
+    })
+  ]);
+}

sw/builders/programs.nix

@@ -1,8 +1,6 @@
 {
   config,
   lib,
-  pkgs,
-  inputs,
   ...
 }:
 
@@ -10,7 +8,7 @@ with lib;
 
 let
   cfg = config.athenix.sw;
-  basePackages = with pkgs; [
+  basePackages = [
     # Build-related packages can be added here if needed
   ];
 in