generated from coulomb/repo-seed
tegwick
7aae00e933
Documents interim coulombcore org runner for forgejo.coulomb.social and adds make forgejo-runner-status for operator health checks.
76 lines
2.6 KiB
Markdown
76 lines
2.6 KiB
Markdown
# Forgejo Actions Runner Substrate
|
|
|
|
Last reviewed: 2026-07-03
|
|
|
|
Status: first supported runner on coulombcore (interim). Forgejo instance runs on
|
|
railiance01; runner host is intentionally separate per Forgejo security guidance.
|
|
|
|
## Purpose
|
|
|
|
Provide a forge-owned Actions runner for `https://forgejo.coulomb.social` so
|
|
repos in the `coulomb` organization can build and publish without workstation
|
|
involvement. Mirrors the Gitea runner contract in
|
|
`docs/gitea-actions-runner-substrate.md`.
|
|
|
|
## First Supported Runner
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| Runner name | `railiance-coulombcore-build-01` |
|
|
| Runner scope | `coulomb` organization |
|
|
| Host | coulombcore (`92.205.130.254`) |
|
|
| Instance | `https://forgejo.coulomb.social/` |
|
|
| Binary | `forgejo-runner` v6.3.1 |
|
|
| Runtime | Host mode (Docker not installed on host yet) |
|
|
| Cluster deploy authority | Not included |
|
|
|
|
### Labels
|
|
|
|
```text
|
|
self-hosted:host,linux:host,linux_amd64:host,container-build:host,registry-publish:host,railiance01:host
|
|
```
|
|
|
|
`self-hosted` preserves compatibility with existing Gitea workflow `runs-on`
|
|
values during migration. Container image builds require Docker on the runner
|
|
host — install before cutover of image-publishing workflows.
|
|
|
|
## Service Layout
|
|
|
|
| Path | Purpose |
|
|
| --- | --- |
|
|
| `/usr/local/bin/forgejo-runner` | Runner binary |
|
|
| `/var/lib/forgejo-runner/config.yaml` | Generated config |
|
|
| `/var/lib/forgejo-runner/.runner` | Registration state (secret) |
|
|
| `/etc/systemd/system/forgejo-runner.service` | systemd unit |
|
|
|
|
## Probe Evidence (2026-07-03)
|
|
|
|
- Org `coulomb` created on Forgejo.
|
|
- Runner registered and `systemctl is-active forgejo-runner` → `active`.
|
|
- Repo `coulomb/forgejo-actions-probe` workflow `probe.yaml` (`runs-on: self-hosted`)
|
|
completed with `status: success` (API: `/api/v1/repos/coulomb/forgejo-actions-probe/actions/tasks`).
|
|
|
|
## Operator Commands
|
|
|
|
```bash
|
|
# Runner health (from railiance-forge)
|
|
RUNNER_HOST=coulombcore make forgejo-runner-status
|
|
|
|
# Forgejo app smoke (from railiance-apps)
|
|
make -C ~/railiance-apps forgejo-smoke
|
|
|
|
# Generate a new org registration token (in cluster, no token in logs)
|
|
KUBECONFIG=~/.kube/config-hosteurope kubectl exec -n forgejo deploy/forgejo-gitea -- \
|
|
forgejo actions generate-runner-token --scope coulomb
|
|
```
|
|
|
|
## Secret Boundaries
|
|
|
|
Same as Gitea runner substrate: registration tokens and `.runner` files stay
|
|
off Git. Use approved secret paths on the runner host only.
|
|
|
|
## Follow-On
|
|
|
|
1. Install Docker on the approved runner host for `container-build` jobs.
|
|
2. Move runner to a non-legacy host before coulombcore decommission (T03 drain).
|
|
3. Add repo-scoped registry credentials in Forgejo org secrets for image push. |