commit 981bc8f3ce0c6d7ab9cd6e7e728c4b7145905704
parent c68e8c4224b8e0e54975295bc7cd51205b4ae856
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sat, 21 Feb 2026 16:09:47 +0100
make codeberg runner work without the helm chart
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
5 files changed, 266 insertions(+), 2 deletions(-)
diff --git a/apps/talos_cluster/codeberg/cm.yaml b/apps/talos_cluster/codeberg/cm.yaml
@@ -0,0 +1,93 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: runner-config
+data:
+ config.yaml: |
+ log:
+ # The level of logging, can be trace, debug, info, warn, error, fatal
+ level: info
+
+ runner:
+ # Where to store the registration result.
+ file: .runner
+ # Execute how many tasks concurrently at the same time.
+ capacity: 1
+ # Extra environment variables to run jobs.
+ # envs:
+ # A_TEST_ENV_NAME_1: a_test_env_value_1
+ # A_TEST_ENV_NAME_2: a_test_env_value_2
+ # Extra environment variables to run jobs from a file.
+ # It will be ignored if it's empty or the file doesn't exist.
+ env_file: .env
+ # The timeout for a job to be finished.
+ # Please note that the Forgejo instance also has a timeout (3h by default) for the job.
+ # So the job could be stopped by the Forgejo instance if it's timeout is shorter than this.
+ timeout: 3h
+ # Whether skip verifying the TLS certificate of the Forgejo instance.
+ insecure: false
+ # The timeout for fetching the job from the Forgejo instance.
+ fetch_timeout: 5s
+ # The interval for fetching the job from the Forgejo instance.
+ fetch_interval: 2s
+ # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+ # Like: ["macos-arm64:host", "ubuntu-latest:docker://node:16-bullseye", "ubuntu-22.04:docker://node:16-bullseye"]
+ # If it's empty when registering, it will ask for inputting labels.
+ # If it's empty when execute `deamon`, will use labels in `.runner` file.
+ labels: []
+
+ cache:
+ # Enable cache server to use actions/cache.
+ enabled: true
+ # The directory to store the cache data.
+ # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+ dir: /data
+ # The host of the cache server.
+ # It's not for the address to listen, but the address to connect from job containers.
+ # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+ host: ""
+ # The port of the cache server.
+ # 0 means to use a random available port.
+ port: 0
+ # The external cache server URL. Valid only when enable is true.
+ # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+ # The URL should generally end with "/".
+ external_server: ""
+
+ container:
+ # Specifies the network to which the container will connect.
+ # Could be host, bridge or the name of a custom network.
+ # If it's empty, create a network automatically.
+ network: ""
+ # Whether to create networks with IPv6 enabled. Requires the Docker daemon to be set up accordingly.
+ # Only takes effect if "network" is set to "".
+ enable_ipv6: false
+ # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+ privileged: false
+ # And other options to be used when the container is started (eg, --add-host=my.forgejo.url:host-gateway).
+ options:
+ # The parent directory of a job's working directory.
+ # If it's empty, /workspace will be used.
+ workdir_parent:
+ # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+ # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+ # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+ # valid_volumes:
+ # - data
+ # - /src/*.json
+ # If you want to allow any volume, please use the following configuration:
+ # valid_volumes:
+ # - '**'
+ valid_volumes: []
+ # overrides the docker client host with the specified one.
+ # If it's empty, act_runner will find an available docker host automatically.
+ # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+ # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+ docker_host: ""
+ # Pull docker image(s) even if already present
+ force_pull: false
+
+ host:
+ # The parent directory of a job's working directory.
+ # If it's empty, $HOME/.cache/act/ will be used.
+ workdir_parent: /data
diff --git a/apps/talos_cluster/codeberg/deploy.yaml b/apps/talos_cluster/codeberg/deploy.yaml
@@ -0,0 +1,120 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ labels:
+ app: forgejo-runner
+ name: forgejo-runner
+ namespace: codeberg
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: forgejo-runner
+ strategy: {}
+ template:
+ metadata:
+ labels:
+ app: forgejo-runner
+ spec:
+ securityContext:
+ fsGroup: 1000
+ restartPolicy: Always
+ initContainers:
+ - name: init
+ image: { { .Values.image } }
+ command:
+ [
+ "sh",
+ "-c",
+ "if ! [ -f /data/.runner ]; then forgejo-runner register --no-interactive --token ${RUNNER_REGISTRATION_TOKEN} --labels ${LABELS} --name ${RUNNER_NAME} --instance ${INSTANCE_URL}; fi",
+ ]
+ env:
+ - name: INSTANCE_URL
+ value: { { .Values.forgejoInstanceUrl } }
+ - name: RUNNER_NAME
+ value: forgejo-runner
+ - name: LABELS
+ value: ubuntu-latest,ubuntu-22.04,docker
+ - name: RUNNER_REGISTRATION_TOKEN
+ valueFrom:
+ secretKeyRef:
+ name: codeberg-runner
+ key: forgejoInstanceToken
+ volumeMounts:
+ - name: docker-certs
+ mountPath: /certs
+ - name: runner-data
+ mountPath: /data
+ - name: runner-config
+ mountPath: /config
+ resources:
+ limits:
+ cpu: "1"
+ memory: "1024Mi"
+ requests:
+ cpu: "50m"
+ memory: "32Mi"
+ containers:
+ - name: runner
+ image: { { .Values.image } }
+ command:
+ [
+ "sh",
+ "-c",
+ "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; forgejo-runner daemon --config /config/config.yaml",
+ ]
+ env:
+ - name: DOCKER_HOST
+ value: tcp://localhost:2376
+ - name: DOCKER_CERT_PATH
+ value: /certs/client
+ - name: DOCKER_TLS_VERIFY
+ value: "1"
+ volumeMounts:
+ - name: docker-certs
+ mountPath: /certs
+ - name: runner-data
+ mountPath: /data
+ - name: runner-config
+ mountPath: /config
+ resources:
+ limits:
+ cpu: "1"
+ memory: "1024Mi"
+ requests:
+ cpu: "50m"
+ memory: "32Mi"
+ - name: daemon
+ image: docker:27.5.1-dind
+ env:
+ - name: DOCKER_TLS_CERTDIR
+ value: /certs
+ securityContext:
+ privileged: true
+ volumeMounts:
+ - name: docker-certs
+ mountPath: /certs
+ - name: docker-data
+ mountPath: /var/lib/docker
+ resources:
+ limits:
+ cpu: "2"
+ memory: "4096Mi"
+ requests:
+ cpu: "50m"
+ memory: "32Mi"
+ volumes:
+ - name: docker-certs
+ emptyDir: {}
+ - name: runner-data
+ persistentVolumeClaim:
+ claimName: forgejo-runner-vol
+ - name: docker-data
+ persistentVolumeClaim:
+ claimName: docker
+ - name: runner-config
+ configMap:
+ name: runner-config
+ items:
+ - key: config.yaml
+ path: config.yaml
diff --git a/apps/talos_cluster/codeberg/kustomization.yaml b/apps/talos_cluster/codeberg/kustomization.yaml
@@ -2,5 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: codeberg
resources:
- - repository.yaml
- - release.yaml
+ #- repository.yaml
+ #- release.yaml
+ - cm.yaml
+ - rbac.yaml
+ - pvc.yaml
+ - deploy.yaml
diff --git a/apps/talos_cluster/codeberg/pvc.yaml b/apps/talos_cluster/codeberg/pvc.yaml
@@ -0,0 +1,23 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+ name: forgejo-runner-vol
+spec:
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 1Gi
+ storageClassName: longhorn
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+ name: docker
+spec:
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 5Gi
+ storageClassName: longhorn
diff --git a/apps/talos_cluster/codeberg/rbac.yaml b/apps/talos_cluster/codeberg/rbac.yaml
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: buildx
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ annotations:
+ kubernetes.io/service-account.name: buildx
+ name: buildx-sa-token
+type: kubernetes.io/service-account-token
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: admin
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: admin
+subjects:
+ - kind: ServiceAccount
+ name: buildx
