Julien Gautier
644d3603d2
Set up the infrastructure-as-code recipe to bring up the three
self-hosted Gitea Actions runners required by ADR-0015. The compose
file launches three act_runner instances pinned to 0.2.13, registered
with the project's Gitea organisation, labelled self-hosted + on-prem
to match the runs-on selector in every job under .gitea/workflows/*.
Layout:
- infra/ new top-level folder for IaC
- infra/README.md explains the folder, registration
flow, security implications, future
placeholders (local/, prod/, runbooks/)
- infra/ci-runners.compose.yml three act_runner services, networked
together, persisting credentials to
./data/runner-N
- infra/.env.example GITEA_INSTANCE_URL +
GITEA_RUNNER_REGISTRATION_TOKEN; .env
itself stays git-ignored (root rule)
- infra/data/.gitignore tracks the dir, ignores runtime state
Security posture (documented in infra/README.md): mounting
/var/run/docker.sock gives the runner root-equivalent access to the
host Docker daemon. Mitigations rely on (a) repo-scope of the runner
in Gitea, (b) running the runner host outside the production trust
boundary, (c) no extra host filesystem mounts. Future hardening
(rootless Docker, DinD sidecar) is flagged as deferred.
The compose pins the runner image (0.2.13). Bumps go through a
dedicated chore(deps) PR per the convention; image upgrades roll one
runner at a time so CI is never starved (procedure documented in the
README).
Doc indexing (docs/README.md) deliberately not touched here to avoid
a conflict with the pending docs/architecture-diagrams branch which
also modifies that file. A small follow-up PR will add an index entry
once that branch is merged.
63 lines
2.1 KiB
YAML
63 lines
2.1 KiB
YAML
# Self-hosted Gitea Actions runners — per ADR-0015 §"Runners".
|
|
#
|
|
# Three act_runner instances registered with the project's Gitea
|
|
# organisation, labelled self-hosted + on-prem (the labels referenced
|
|
# by every job in .gitea/workflows/*).
|
|
#
|
|
# First-time registration, scaling, image pinning, and security notes
|
|
# are documented in infra/README.md.
|
|
|
|
name: apf-portal-ci-runners
|
|
|
|
services:
|
|
runner-1:
|
|
image: gitea/act_runner:0.2.13
|
|
container_name: apf-portal-runner-1
|
|
restart: unless-stopped
|
|
environment:
|
|
GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:?GITEA_INSTANCE_URL must be set in infra/.env}
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
|
|
GITEA_RUNNER_NAME: apf-portal-runner-1
|
|
GITEA_RUNNER_LABELS: self-hosted,on-prem
|
|
volumes:
|
|
# Docker socket — see security note in infra/README.md.
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
# Persistent state: runner credentials live here after first registration.
|
|
- ./data/runner-1:/data
|
|
networks:
|
|
- act-runners
|
|
|
|
runner-2:
|
|
image: gitea/act_runner:0.2.13
|
|
container_name: apf-portal-runner-2
|
|
restart: unless-stopped
|
|
environment:
|
|
GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:?GITEA_INSTANCE_URL must be set in infra/.env}
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
|
|
GITEA_RUNNER_NAME: apf-portal-runner-2
|
|
GITEA_RUNNER_LABELS: self-hosted,on-prem
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ./data/runner-2:/data
|
|
networks:
|
|
- act-runners
|
|
|
|
runner-3:
|
|
image: gitea/act_runner:0.2.13
|
|
container_name: apf-portal-runner-3
|
|
restart: unless-stopped
|
|
environment:
|
|
GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:?GITEA_INSTANCE_URL must be set in infra/.env}
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
|
|
GITEA_RUNNER_NAME: apf-portal-runner-3
|
|
GITEA_RUNNER_LABELS: self-hosted,on-prem
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ./data/runner-3:/data
|
|
networks:
|
|
- act-runners
|
|
|
|
networks:
|
|
act-runners:
|
|
name: apf-portal-act-runners
|