runner

1---
2# Runner Services - Forgejo Git Server
3
4- name: Create Forgejo configuration directories
5  file:
6    path: "{{ item }}"
7    state: directory
8    owner: "{{ runner_user }}"
9    group: "users"
10    mode: '2775'  # setgid bit for inheritance, group writable (umask 002)
11  loop:
12    - "{{ forgejo_config_dir }}"
13    - "{{ forgejo_config_dir }}/data"
14    - "{{ forgejo_config_dir }}/forgejo-runner-data"
15    - "{{ forgejo_config_dir }}/forgejo-ansible-runner-data"
16    - "{{ forgejo_config_dir }}/forgejo-docker-runner-data"
17
18- name: Create Forgejo NFS directories
19  file:
20    path: "{{ item }}"
21    state: directory
22    owner: "{{ runner_user }}"
23    group: "users"
24    mode: '2775'  # setgid bit for inheritance, group writable (umask 002)
25  loop:
26    - "{{ forgejo_data_dir }}"
27    - "{{ forgejo_data_dir }}/git"
28    - "{{ forgejo_data_dir }}/lfs"
29
30- name: Generate Forgejo environment file
31  template:
32    src: forgejo.env.j2
33    dest: "{{ forgejo_config_dir }}/.env"
34    owner: "{{ runner_user }}"
35    group: "users"
36    mode: '0664'
37  notify: restart forgejo
38
39- name: Create Forgejo runner config
40  template:
41    src: forgejo-runner-config.yaml.j2
42    dest: "{{ forgejo_config_dir }}/forgejo-runner-data/config.yaml"
43    owner: "{{ runner_user }}"
44    group: "{{ runner_group }}"
45    mode: '0664'
46
47- name: Create Forgejo Dockerfile
48  template:
49    src: forgejo-Dockerfile.j2
50    dest: "{{ forgejo_config_dir }}/Dockerfile"
51    owner: "{{ runner_user }}"
52    group: "{{ runner_group }}"
53    mode: '0664'
54
55- name: Create Forgejo Ansible Runner Dockerfile
56  template:
57    src: forgejo-Dockerfile.ansible.j2
58    dest: "{{ forgejo_config_dir }}/Dockerfile.ansible"
59    owner: "{{ runner_user }}"
60    group: "{{ runner_group }}"
61    mode: '0664'
62  when: forgejo_ansible_runner_enabled | default(false)
63
64- name: Require a registration token for the docker runner
65  ansible.builtin.assert:
66    that:
67      - forgejo_docker_runner_token | default('') | length > 0
68    fail_msg: |
69      forgejo_docker_runner_token is not set.
70      Generate one under Site Administration -> Actions -> Runners -> Create
71      new Runner, then add it to the vault as vault_runner.forgejo_docker_runner_token.
72      Registration tokens are single-use, so an existing runner's token cannot
73      be reused.
74    success_msg: "Docker runner registration token present"
75  when: forgejo_docker_runner_enabled | default(false)
76
77- name: Create Forgejo Docker Runner config
78  template:
79    src: forgejo-runner-config.yaml.j2
80    dest: "{{ forgejo_config_dir }}/forgejo-docker-runner-data/config.yaml"
81    owner: "{{ runner_user }}"
82    group: "{{ runner_group }}"
83    mode: '0664'
84  vars:
85    # This runner's jobs build and push images, so they need the daemon. Scoped
86    # to this runner alone: the host-label runners render the same template and
87    # must keep their current config.
88    forgejo_runner_config_docker_socket: true
89  when: forgejo_docker_runner_enabled | default(false)
90  notify: restart forgejo docker runner
91
92- name: Create Forgejo Ansible Runner config
93  template:
94    src: forgejo-runner-config.yaml.j2
95    dest: "{{ forgejo_config_dir }}/forgejo-ansible-runner-data/config.yaml"
96    owner: "{{ runner_user }}"
97    group: "{{ runner_group }}"
98    mode: '0664'
99  when: forgejo_ansible_runner_enabled | default(false)
100
101- name: Create Forgejo Docker Compose file
102  template:
103    src: forgejo-compose.yml.j2
104    dest: "{{ forgejo_config_dir }}/docker-compose.yml"
105    owner: "{{ runner_user }}"
106    group: "{{ runner_group }}"
107    mode: '0664'
108  notify: restart forgejo
109
110- name: Check if Forgejo is already running
111  community.docker.docker_compose_v2:
112    project_src: "{{ forgejo_config_dir }}"
113    state: present
114    restarted: false
115  register: forgejo_running
116  changed_when: false
117  failed_when: false
118
119- name: Start Forgejo service
120  community.docker.docker_compose_v2:
121    project_src: "{{ forgejo_config_dir }}"
122    state: present
123  register: forgejo_start_result
124  check_mode: no
125
126- name: Wait for Forgejo to be healthy
127  uri:
128    url: "http://localhost:{{ forgejo_http_port }}/api/v1/version"
129    method: GET
130    status_code: 200
131  register: forgejo_health
132  until: forgejo_health.status == 200
133  retries: 30
134  delay: 10
135  when: forgejo_start_result is changed
136  check_mode: no
137
138- name: Create SSH key directory for git operations
139  file:
140    path: "{{ forgejo_config_dir }}/ssh"
141    state: directory
142    owner: "{{ runner_user }}"
143    group: "{{ runner_group }}"
144    mode: '0700'
145
146- name: Generate SSH host keys for Forgejo
147  command: ssh-keygen -t {{ item.type }} -f {{ forgejo_config_dir }}/ssh/ssh_host_{{ item.type }}_key -N ""
148  args:
149    creates: "{{ forgejo_config_dir }}/ssh/ssh_host_{{ item.type }}_key"
150  loop:
151    - { type: "rsa" }
152    - { type: "ecdsa" }
153    - { type: "ed25519" }
154  check_mode: no
155
156- name: Set proper permissions on SSH keys
157  file:
158    path: "{{ forgejo_config_dir }}/ssh/ssh_host_{{ item.type }}_key"
159    owner: "{{ runner_user }}"
160    group: "{{ runner_group }}"
161    mode: '0664'
162  loop:
163    - { type: "rsa" }
164    - { type: "ecdsa" }
165    - { type: "ed25519" }
166
167
168- name: Create Forgejo Git hooks directory
169  file:
170    path: "{{ forgejo_config_dir }}/git/hooks"
171    state: directory
172    owner: "{{ runner_user }}"
173    group: "{{ runner_group }}"
174    mode: '0755'
175
176# The runners mount the host's docker socket rather than running their own
177# daemon, so builds execute against the host's Docker and the host's kernel.
178# binfmt registration therefore belongs here and NOT in the runner image -
179# putting it in the Dockerfile would register handlers in a namespace no build
180# ever uses.
181#
182# Without this, an arm64 build silently produces an amd64 image: docker
183# reports success, the push succeeds, and the Pi fails at runtime with
184# "exec format error" long after CI went green.
185- name: Check whether qemu-aarch64 binfmt is registered
186  ansible.builtin.stat:
187    path: /proc/sys/fs/binfmt_misc/qemu-aarch64
188  register: forgejo_binfmt_arm64
189  when: forgejo_runner_cross_build_enabled
190
191- name: Register QEMU binfmt handlers for cross-architecture builds
192  community.docker.docker_container:
193    name: binfmt-install
194    image: "{{ forgejo_runner_binfmt_image }}"
195    command: "--install {{ forgejo_runner_cross_platforms }}"
196    privileged: true
197    detach: false
198    cleanup: true
199    auto_remove: true
200  when:
201    - forgejo_runner_cross_build_enabled
202    - not forgejo_binfmt_arm64.stat.exists
203  register: forgejo_binfmt_result
204
205# binfmt registration is kernel state and does not survive a reboot. A systemd
206# unit re-runs it at boot so a restarted host does not quietly start producing
207# wrong-architecture images.
208- name: Install the binfmt registration service
209  ansible.builtin.template:
210    src: binfmt-register.service.j2
211    dest: /etc/systemd/system/binfmt-register.service
212    owner: root
213    group: root
214    mode: '0644'
215  become: true
216  when: forgejo_runner_cross_build_enabled
217  notify: reload systemd
218
219- name: Enable the binfmt registration service
220  ansible.builtin.systemd:
221    name: binfmt-register.service
222    enabled: true
223    daemon_reload: true
224  become: true
225  when: forgejo_runner_cross_build_enabled
226
227- name: Display Forgejo deployment summary
228  debug:
229    msg: |
230      Forgejo Git Server Deployment:
231      - Status: {{ 'Started' if forgejo_start_result is changed else 'Already running' }}
232      - Web UI: http://{{ ansible_default_ipv4.address }}:{{ forgejo_http_port }}
233      - SSH Clone: ssh://git@{{ ansible_default_ipv4.address }}:{{ forgejo_ssh_port }}/user/repo.git
234      - HTTP Clone: http://{{ ansible_default_ipv4.address }}:{{ forgejo_http_port }}/user/repo.git
235      - API Endpoint: http://{{ ansible_default_ipv4.address }}:{{ forgejo_http_port }}/api/v1
236      - Configuration: {{ forgejo_config_dir }}/config/app.ini
237      - Data Storage: {{ forgejo_data_dir }}
238      - Repository Storage: {{ forgejo_data_dir }}/git/repositories
239      - Database: {{ forgejo_db_type | upper }}
240      - SSH Domain: {{ forgejo_ssh_domain }}
241      {% if forgejo_runner_enabled %}
242      - CI/CD Runner: {{ 'Enabled' if forgejo_runner_enabled else 'Disabled' }}
243      - Runner Token: {{ forgejo_runner_token }}
244      - Runner Name: {{ forgejo_runner_name }}
245      - Runner Data: {{ forgejo_config_dir }}/forgejo-runner-data
246      {% endif %}
247      
248      Management Commands:
249      - forgejo-logs.sh - View service logs
250      - forgejo-restart.sh - Restart service
251      - forgejo-status.sh - Check service status
252      - forgejo-backup.sh - Backup repositories and database
253      - forgejo-cli.sh - Administration CLI
254      
255      Initial Setup:
256      1. Visit {{ forgejo_domain }}:{{ forgejo_http_port }}
257      2. Complete the installation wizard
258      3. Create admin account
259      4. Configure organization and repository settings
260      {% if forgejo_runner_enabled %}
261      5. Runner will auto-register with the Forgejo instance
262      {% endif %}
263