runner

1---
2# Runner Services - Forgejo Git Server
3
4- name: Create Forgejo configuration directories
5  file:
6    path: "{{ item }}"
7    state: directory
8    owner: "{{ runner_user }}"
9    group: "users"
10    mode: '2775'  # setgid bit for inheritance, group writable (umask 002)
11  loop:
12    - "{{ forgejo_config_dir }}"
13    - "{{ forgejo_config_dir }}/data"
14    - "{{ forgejo_config_dir }}/forgejo-runner-data"
15    - "{{ forgejo_config_dir }}/forgejo-ansible-runner-data"
16
17- name: Create Forgejo NFS directories
18  file:
19    path: "{{ item }}"
20    state: directory
21    owner: "{{ runner_user }}"
22    group: "users"
23    mode: '2775'  # setgid bit for inheritance, group writable (umask 002)
24  loop:
25    - "{{ forgejo_data_dir }}"
26    - "{{ forgejo_data_dir }}/git"
27    - "{{ forgejo_data_dir }}/lfs"
28
29- name: Generate Forgejo environment file
30  template:
31    src: forgejo.env.j2
32    dest: "{{ forgejo_config_dir }}/.env"
33    owner: "{{ runner_user }}"
34    group: "users"
35    mode: '0664'
36  notify: restart forgejo
37
38- name: Create Forgejo runner config
39  template:
40    src: forgejo-runner-config.yaml.j2
41    dest: "{{ forgejo_config_dir }}/forgejo-runner-data/config.yaml"
42    owner: "{{ runner_user }}"
43    group: "{{ runner_group }}"
44    mode: '0664'
45
46- name: Create Forgejo Dockerfile
47  template:
48    src: forgejo-Dockerfile.j2
49    dest: "{{ forgejo_config_dir }}/Dockerfile"
50    owner: "{{ runner_user }}"
51    group: "{{ runner_group }}"
52    mode: '0664'
53
54- name: Create Forgejo Ansible Runner Dockerfile
55  template:
56    src: forgejo-Dockerfile.ansible.j2
57    dest: "{{ forgejo_config_dir }}/Dockerfile.ansible"
58    owner: "{{ runner_user }}"
59    group: "{{ runner_group }}"
60    mode: '0664'
61  when: forgejo_ansible_runner_enabled | default(false)
62
63- name: Create Forgejo Ansible Runner config
64  template:
65    src: forgejo-runner-config.yaml.j2
66    dest: "{{ forgejo_config_dir }}/forgejo-ansible-runner-data/config.yaml"
67    owner: "{{ runner_user }}"
68    group: "{{ runner_group }}"
69    mode: '0664'
70  when: forgejo_ansible_runner_enabled | default(false)
71
72- name: Create Forgejo Docker Compose file
73  template:
74    src: forgejo-compose.yml.j2
75    dest: "{{ forgejo_config_dir }}/docker-compose.yml"
76    owner: "{{ runner_user }}"
77    group: "{{ runner_group }}"
78    mode: '0664'
79  notify: restart forgejo
80
81- name: Check if Forgejo is already running
82  community.docker.docker_compose_v2:
83    project_src: "{{ forgejo_config_dir }}"
84    state: present
85    restarted: false
86  register: forgejo_running
87  changed_when: false
88  failed_when: false
89
90- name: Start Forgejo service
91  community.docker.docker_compose_v2:
92    project_src: "{{ forgejo_config_dir }}"
93    state: present
94  register: forgejo_start_result
95  check_mode: no
96
97- name: Wait for Forgejo to be healthy
98  uri:
99    url: "http://localhost:{{ forgejo_http_port }}/api/v1/version"
100    method: GET
101    status_code: 200
102  register: forgejo_health
103  until: forgejo_health.status == 200
104  retries: 30
105  delay: 10
106  when: forgejo_start_result is changed
107  check_mode: no
108
109- name: Create SSH key directory for git operations
110  file:
111    path: "{{ forgejo_config_dir }}/ssh"
112    state: directory
113    owner: "{{ runner_user }}"
114    group: "{{ runner_group }}"
115    mode: '0700'
116
117- name: Generate SSH host keys for Forgejo
118  command: ssh-keygen -t {{ item.type }} -f {{ forgejo_config_dir }}/ssh/ssh_host_{{ item.type }}_key -N ""
119  args:
120    creates: "{{ forgejo_config_dir }}/ssh/ssh_host_{{ item.type }}_key"
121  loop:
122    - { type: "rsa" }
123    - { type: "ecdsa" }
124    - { type: "ed25519" }
125  check_mode: no
126
127- name: Set proper permissions on SSH keys
128  file:
129    path: "{{ forgejo_config_dir }}/ssh/ssh_host_{{ item.type }}_key"
130    owner: "{{ runner_user }}"
131    group: "{{ runner_group }}"
132    mode: '0664'
133  loop:
134    - { type: "rsa" }
135    - { type: "ecdsa" }
136    - { type: "ed25519" }
137
138
139- name: Create Forgejo Git hooks directory
140  file:
141    path: "{{ forgejo_config_dir }}/git/hooks"
142    state: directory
143    owner: "{{ runner_user }}"
144    group: "{{ runner_group }}"
145    mode: '0755'
146
147# The runners mount the host's docker socket rather than running their own
148# daemon, so builds execute against the host's Docker and the host's kernel.
149# binfmt registration therefore belongs here and NOT in the runner image -
150# putting it in the Dockerfile would register handlers in a namespace no build
151# ever uses.
152#
153# Without this, an arm64 build silently produces an amd64 image: docker
154# reports success, the push succeeds, and the Pi fails at runtime with
155# "exec format error" long after CI went green.
156- name: Check whether qemu-aarch64 binfmt is registered
157  ansible.builtin.stat:
158    path: /proc/sys/fs/binfmt_misc/qemu-aarch64
159  register: forgejo_binfmt_arm64
160  when: forgejo_runner_cross_build_enabled
161
162- name: Register QEMU binfmt handlers for cross-architecture builds
163  community.docker.docker_container:
164    name: binfmt-install
165    image: "{{ forgejo_runner_binfmt_image }}"
166    command: "--install {{ forgejo_runner_cross_platforms }}"
167    privileged: true
168    detach: false
169    cleanup: true
170    auto_remove: true
171  when:
172    - forgejo_runner_cross_build_enabled
173    - not forgejo_binfmt_arm64.stat.exists
174  register: forgejo_binfmt_result
175
176# binfmt registration is kernel state and does not survive a reboot. A systemd
177# unit re-runs it at boot so a restarted host does not quietly start producing
178# wrong-architecture images.
179- name: Install the binfmt registration service
180  ansible.builtin.template:
181    src: binfmt-register.service.j2
182    dest: /etc/systemd/system/binfmt-register.service
183    owner: root
184    group: root
185    mode: '0644'
186  become: true
187  when: forgejo_runner_cross_build_enabled
188  notify: reload systemd
189
190- name: Enable the binfmt registration service
191  ansible.builtin.systemd:
192    name: binfmt-register.service
193    enabled: true
194    daemon_reload: true
195  become: true
196  when: forgejo_runner_cross_build_enabled
197
198- name: Display Forgejo deployment summary
199  debug:
200    msg: |
201      Forgejo Git Server Deployment:
202      - Status: {{ 'Started' if forgejo_start_result is changed else 'Already running' }}
203      - Web UI: http://{{ ansible_default_ipv4.address }}:{{ forgejo_http_port }}
204      - SSH Clone: ssh://git@{{ ansible_default_ipv4.address }}:{{ forgejo_ssh_port }}/user/repo.git
205      - HTTP Clone: http://{{ ansible_default_ipv4.address }}:{{ forgejo_http_port }}/user/repo.git
206      - API Endpoint: http://{{ ansible_default_ipv4.address }}:{{ forgejo_http_port }}/api/v1
207      - Configuration: {{ forgejo_config_dir }}/config/app.ini
208      - Data Storage: {{ forgejo_data_dir }}
209      - Repository Storage: {{ forgejo_data_dir }}/git/repositories
210      - Database: {{ forgejo_db_type | upper }}
211      - SSH Domain: {{ forgejo_ssh_domain }}
212      {% if forgejo_runner_enabled %}
213      - CI/CD Runner: {{ 'Enabled' if forgejo_runner_enabled else 'Disabled' }}
214      - Runner Token: {{ forgejo_runner_token }}
215      - Runner Name: {{ forgejo_runner_name }}
216      - Runner Data: {{ forgejo_config_dir }}/forgejo-runner-data
217      {% endif %}
218      
219      Management Commands:
220      - forgejo-logs.sh - View service logs
221      - forgejo-restart.sh - Restart service
222      - forgejo-status.sh - Check service status
223      - forgejo-backup.sh - Backup repositories and database
224      - forgejo-cli.sh - Administration CLI
225      
226      Initial Setup:
227      1. Visit {{ forgejo_domain }}:{{ forgejo_http_port }}
228      2. Complete the installation wizard
229      3. Create admin account
230      4. Configure organization and repository settings
231      {% if forgejo_runner_enabled %}
232      5. Runner will auto-register with the Forgejo instance
233      {% endif %}
234