Bastian de Byl
2640d09cb5
Switch the act_runners from :host execution to docker:// images backed by a rootless podman socket under the gitea-runner user, so each job runs in its own ephemeral container with per-job Go caches. This eliminates the cross-repo GOMODCACHE/go-build poisoning that forced the debyl runner to capacity:1. - deps.yml: enable the rootless --user podman.socket, ensure subuid/subgid, register gitea_runner_uid; drop the rootful system socket override, podman-docker and host golang - images.yml + Containerfile.ci/.espidf: build localhost/gitea-ci and localhost/gitea-ci-espidf into the runner's rootless image store - config.yaml.j2: docker:// labels (per-runner overridable), docker_host -> rootless socket, force_pull false - act_runner.service.j2: XDG_RUNTIME_DIR + DOCKER_HOST -> user socket - defaults: uniform capacity:4 (drop the debyl capacity:1 workaround); esp_idf_version now tags the espressif/idf-based image - main.yml: import images.yml, drop the host esp-idf install (firmware jobs use the espressif/idf job container instead) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
72 lines
2.0 KiB
YAML
72 lines
2.0 KiB
YAML
---
|
|
- name: create gitea-runner user
|
|
become: true
|
|
ansible.builtin.user:
|
|
name: "{{ gitea_runner_user }}"
|
|
comment: Gitea Actions runner
|
|
shell: /bin/bash
|
|
createhome: true
|
|
home: "{{ gitea_runner_home }}"
|
|
tags: gitea-actions
|
|
|
|
- name: check if gitea-runner lingering enabled
|
|
become: true
|
|
ansible.builtin.stat:
|
|
path: "/var/lib/systemd/linger/{{ gitea_runner_user }}"
|
|
register: gitea_runner_lingering
|
|
tags: gitea-actions
|
|
|
|
- name: enable gitea-runner lingering
|
|
become: true
|
|
ansible.builtin.command: loginctl enable-linger {{ gitea_runner_user }}
|
|
when: not gitea_runner_lingering.stat.exists
|
|
tags: gitea-actions
|
|
|
|
- name: create .config/systemd/user directory
|
|
become: true
|
|
become_user: "{{ gitea_runner_user }}"
|
|
ansible.builtin.file:
|
|
path: "{{ gitea_runner_home }}/.config/systemd/user"
|
|
state: directory
|
|
mode: "0755"
|
|
tags: gitea-actions
|
|
|
|
- name: create .ssh directory
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "{{ gitea_runner_home }}/.ssh"
|
|
state: directory
|
|
owner: "{{ gitea_runner_user }}"
|
|
group: "{{ gitea_runner_user }}"
|
|
mode: "0700"
|
|
tags: gitea-actions
|
|
|
|
- name: generate SSH key for gitea-runner
|
|
become: true
|
|
become_user: "{{ gitea_runner_user }}"
|
|
ansible.builtin.command:
|
|
cmd: ssh-keygen -t ed25519 -f {{ gitea_runner_home }}/.ssh/id_ed25519 -N "" -C "gitea-runner@galactica"
|
|
creates: "{{ gitea_runner_home }}/.ssh/id_ed25519"
|
|
tags: gitea-actions
|
|
|
|
- name: add Gitea SSH host keys to known_hosts
|
|
become: true
|
|
become_user: "{{ gitea_runner_user }}"
|
|
ansible.builtin.shell:
|
|
cmd: ssh-keyscan -p 2222 {{ item }} >> {{ gitea_runner_home }}/.ssh/known_hosts 2>/dev/null
|
|
args:
|
|
creates: "{{ gitea_runner_home }}/.ssh/known_hosts"
|
|
loop:
|
|
- git.skudak.com
|
|
- git.debyl.io
|
|
tags: gitea-actions
|
|
|
|
- name: set known_hosts permissions
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "{{ gitea_runner_home }}/.ssh/known_hosts"
|
|
owner: "{{ gitea_runner_user }}"
|
|
group: "{{ gitea_runner_user }}"
|
|
mode: "0644"
|
|
tags: gitea-actions
|