diff --git a/terraform/startup.sh b/terraform/startup.sh
new file mode 100644
index 0000000..ef87b53
--- /dev/null
+++ b/terraform/startup.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+set -euo pipefail
+dnf -y update
+dnf -y install git wget curl openssl sqlite firewalld
+systemctl enable --now firewalld
+firewall-cmd --permanent --add-port=3000/tcp
+firewall-cmd --reload
+LATEST_GITEA=$(curl -s https://dl.gitea.io/gitea/ | grep -Eo 'href="[0-9]+\.[0-9]+\.[0-9]+/' | sed 's/href="//;s/\///' | sort -V | tail -1)
+wget -qO /usr/local/bin/gitea "https://dl.gitea.io/gitea/${LATEST_GITEA}/gitea-${LATEST_GITEA}-linux-amd64"
+chmod +x /usr/local/bin/gitea
+LATEST_RUNNER=$(curl -s https://dl.gitea.com/act_runner/ | grep -Eo 'href="[0-9]+\.[0-9]+\.[0-9]+/' | sed 's/href="//;s/\///' | sort -V | tail -1)
+wget -qO /usr/local/bin/act_runner "https://dl.gitea.com/act_runner/${LATEST_RUNNER}/act_runner-${LATEST_RUNNER}-linux-amd64"
+chmod +x /usr/local/bin/act_runner
+mkdir -p /var/lib/gitea/{custom,data,log} /etc/gitea
+EXT_IP="$(curl -fsH 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip || true)"
+cat >/etc/systemd/system/gitea.service <<'EOF'
+[Unit]
+After=network.target
+[Service]
+Type=simple
+User=root
+Group=root
+WorkingDirectory=/var/lib/gitea
+ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini
+Restart=always
+Environment=USER=root HOME=/root GITEA_WORK_DIR=/var/lib/gitea
+[Install]
+WantedBy=multi-user.target
+EOF
+cat >/etc/gitea/app.ini <<EOF
+APP_NAME=Gitea
+RUN_MODE=prod
+[server]
+DOMAIN=${EXT_IP}
+HTTP_PORT=3000
+ROOT_URL=http://${EXT_IP}:3000/
+PROTOCOL=http
+DISABLE_SSH=false
+SSH_PORT=22
+[database]
+DB_TYPE=sqlite3
+PATH=/var/lib/gitea/data/gitea.db
+[log]
+MODE=file
+LEVEL=info
+ROOT_PATH=/var/lib/gitea/log
+[actions]
+ENABLED=true
+EOF
+chmod -R 750 /etc/gitea /var/lib/gitea
+systemctl daemon-reload
+systemctl enable gitea
+systemctl start gitea
+cat >/etc/systemd/system/act-runner.service <<'EOF'
+[Unit]
+After=network.target gitea.service
+Requires=gitea.service
+[Service]
+Type=simple
+User=root
+Group=root
+WorkingDirectory=/root
+ExecStart=/usr/local/bin/act_runner daemon
+Restart=always
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl daemon-reload
+systemctl enable act-runner