# Forgejo Actions runner — deploy this on the FORGEJO HOST alongside the Forgejo stack.
#
# The runner connects outbound to git.fabledsword.com to receive jobs.
# No inbound connections from Forgejo are needed.
# The host Docker socket is mounted so the build job can use Docker Buildx.
#
# One-time setup on the Forgejo host:
#
#   1. Get a registration token:
#      Forgejo → Site Administration → Runners → Create Runner
#      (or per-repo: repo → Settings → Actions → Runners)
#
#   2. Create an env file (keep this off git):
#      echo 'RUNNER_TOKEN=your_token_here' > /nfs/data/fabledsword/act_runner/.env
#
#   3. Deploy:
#      docker stack deploy -c runner-swarm.yml act-runner
#      (or: docker compose -f runner-swarm.yml up -d  if not using swarm mode for this)
#
# Note: docker stack deploy does not support `volumes.driver_opts` or bind mounts
# in the same way as compose. If you hit swarm limitations with the socket bind mount,
# run this with plain `docker compose` instead of `docker stack deploy` — the runner
# doesn't need swarm-specific features.

networks:
  fabled_backend:
    external: true

volumes:
  act_runner_data:

services:
  act_runner:
    image: gitea/act_runner:latest
    restart: unless-stopped
    environment:
      - GITEA_INSTANCE_URL=https://git.fabledsword.com
      - GITEA_RUNNER_REGISTRATION_TOKEN=${RUNNER_TOKEN}
      - GITEA_RUNNER_NAME=forgejo-host-runner
      # Labels control which `runs-on:` values this runner accepts.
      # ubuntu-latest is the label used in all workflow files.
      - GITEA_RUNNER_LABELS=ubuntu-latest:docker://node:20-bullseye,ubuntu-22.04:docker://node:20-bullseye
      - CONFIG_FILE=/data/config.yml
    volumes:
      # Host Docker socket — required for the build job (docker buildx).
      - /var/run/docker.sock:/var/run/docker.sock
      - act_runner_data:/data
      # act_runner creates job containers as siblings on the host docker daemon.
      # The config file (written below by the init container) tells act_runner
      # which host paths job containers are allowed to mount.
      # See the init service below for how config.yml is created.
    networks:
      - fabled_backend
    depends_on:
      - act_runner_init
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure

  # One-shot container that writes the act_runner config file before the runner starts.
  # Runs once, exits, and the runner service picks up /data/config.yml.
  act_runner_init:
    image: busybox
    volumes:
      - act_runner_data:/data
    command: >
      sh -c "
        if [ ! -f /data/config.yml ]; then
          cat > /data/config.yml << 'EOF'
log:
  level: info

runner:
  # How many jobs to run concurrently on this runner.
  capacity: 2
  # Timeout for each job.
  timeout: 30m

cache:
  enabled: true
  dir: /data/.cache

container:
  # Job containers are created on the host Docker daemon (via mounted socket).
  # They share the host network so they can reach Forgejo and the registry directly.
  network: host
  # Paths the runner is allowed to bind-mount into job containers.
  # Add any paths here that workflow steps need to access on the host.
  valid_volumes:
    - /var/run/docker.sock
EOF
          echo 'config.yml written'
        else
          echo 'config.yml already exists, skipping'
        fi
      "
    deploy:
      restart_policy:
        condition: none