Adding gitea act_runner roles

ansible/group_vars/all/vars.yml

@@ -89,6 +89,13 @@ roundcube_smtp_port: "587"
 #     ssl: true           # default: true
 #     keep: true          # default: true — set false to delete from source after fetch
 
+# Gitea Actions runners (act_runner with Docker executor)
+act_runner_version: "latest"
+act_runner_data_dir: /opt/act_runner
+act_runner_count: 3
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
+# gitea_runner_registration_token: ""  # Gitea admin → Site Administration → Runners → Create runner token
+
 # Container registry (Docker Registry v2)
 registry_data_dir: /opt/registry
 # Registry users — plaintext passwords, Ansible generates bcrypt hashes at deploy time

ansible/roles/act_runner/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: Restart act_runner
+  community.docker.docker_compose_v2:
+    project_src: "{{ act_runner_data_dir }}"
+    state: present
+    pull: missing
+    recreate: always

ansible/roles/act_runner/tasks/main.yml

@@ -0,0 +1,46 @@
+---
+- name: Create act_runner base directory
+  ansible.builtin.file:
+    path: "{{ act_runner_data_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  tags: act_runner
+
+- name: Create per-runner data directories
+  ansible.builtin.file:
+    path: "{{ act_runner_data_dir }}/runner-{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop: "{{ range(1, act_runner_count + 1) | list }}"
+  tags: act_runner
+
+- name: Deploy act_runner config
+  ansible.builtin.template:
+    src: config.yml.j2
+    dest: "{{ act_runner_data_dir }}/config.yml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart act_runner
+  tags: act_runner
+
+- name: Deploy Docker Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ act_runner_data_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart act_runner
+  tags: act_runner
+
+- name: Start act_runner
+  community.docker.docker_compose_v2:
+    project_src: "{{ act_runner_data_dir }}"
+    state: present
+    pull: missing
+  tags: act_runner

ansible/roles/act_runner/templates/config.yml.j2

@@ -0,0 +1,21 @@
+# Managed by Ansible — do not edit manually
+log:
+  level: info
+
+runner:
+  file: .runner        # stored in each runner's /data volume
+  capacity: 1          # one concurrent job per runner container
+  timeout: 3h
+  fetch_timeout: 5s
+  fetch_interval: 2s
+
+cache:
+  enabled: false       # disable built-in cache server; use actions/cache if needed
+
+container:
+  network: bridge      # job containers get default bridge network with internet access
+  privileged: false
+  valid_volumes:
+    - /tmp
+  force_pull: false
+  force_rebuild: false

ansible/roles/act_runner/templates/docker-compose.yml.j2

@@ -0,0 +1,17 @@
+# Managed by Ansible — do not edit manually
+services:
+{% for i in range(1, act_runner_count + 1) %}
+  runner-{{ i }}:
+    image: gitea/act_runner:{{ act_runner_version }}
+    container_name: act-runner-{{ i }}
+    restart: unless-stopped
+    environment:
+      - GITEA_INSTANCE_URL=https://{{ domain_gitea }}
+      - GITEA_RUNNER_REGISTRATION_TOKEN={{ gitea_runner_registration_token }}
+      - GITEA_RUNNER_NAME=runner-{{ i }}
+      - CONFIG_FILE=/config.yml
+    volumes:
+      - {{ act_runner_data_dir }}/runner-{{ i }}:/data
+      - {{ act_runner_data_dir }}/config.yml:/config.yml:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+{% endfor %}

ansible/roles/registry/templates/docker-compose.yml.j2

@@ -20,7 +20,7 @@ services:
       - "traefik.http.routers.registry.entrypoints=websecure"
       - "traefik.http.routers.registry.tls.certresolver=letsencrypt"
       - "traefik.http.services.registry.loadbalancer.server.port=5000"
-      - "traefik.http.routers.registry.middlewares=registry-buffering,rate-limit@docker"
+      - "traefik.http.routers.registry.middlewares=registry-buffering"
       # Remove body size limit so large image layers can be pushed
       - "traefik.http.middlewares.registry-buffering.buffering.maxRequestBodyBytes=0"
 

ansible/site.yml

@@ -7,6 +7,7 @@
     - docker
     - traefik
     - gitea
+    - act_runner
     - nextcloud
     - sso
     - mail