Adding gitea act_runner roles

docs/runbook-configuration.md

@@ -209,6 +209,55 @@ With the alias in place you can use the shorter SCP-like URL:
 git clone git@gitea.ladkau.de:<username>/myrepo.git
 ```
 
+### 3.4 Deploy Gitea Actions runners
+
+Three `act_runner` containers (Docker executor) are provisioned by the
+`act_runner` Ansible role. Each runner handles one concurrent job; together
+they allow up to three parallel workflow jobs.
+
+**This step requires Gitea to be running and the admin account to exist
+(step 3.1). Runners cannot register until a token is obtained from Gitea.**
+
+**Step 1 — Get a runner registration token**
+
+1. Go to `https://gitea.ladkau.de` → sign in as admin.
+2. Navigate to **Site Administration** (top-right menu) →
+   **Actions** → **Runners**.
+3. Click **Create runner token** and copy the token.
+
+**Step 2 — Add the token to the vault**
+
+```bash
+ansible-vault edit ansible/group_vars/all/vault.yml
+```
+
+Add the key:
+
+```yaml
+gitea_runner_registration_token: "<token-from-step-1>"
+```
+
+**Step 3 — Deploy the runners**
+
+```bash
+ansible-playbook -i ansible/inventory.ini ansible/site.yml \
+  --tags act_runner --ask-vault-pass
+```
+
+Ansible creates `/opt/act_runner/` with a shared `config.yml` and three
+per-runner data directories (`runner-1/`, `runner-2/`, `runner-3/`). On first
+start each container auto-registers with Gitea and writes a `.runner` file to
+its data directory. Subsequent restarts reuse the saved registration.
+
+**Verify**
+
+Back in Gitea **Site Administration → Actions → Runners**, all three runners
+should appear as **Online** within a few seconds.
+
+> **Security note:** Each runner container mounts `/var/run/docker.sock`.
+> This gives workflow jobs root-equivalent access to the host Docker daemon.
+> Only run workflows from trusted repositories.
+
 ## 4. Nextcloud
 
 The admin credentials are set via `nextcloud_admin_user` and