# Gitea Actions runner. Target: /opt/homelab/compose/gitea-runner/ on VM103 (compose.yaml, config.yaml, .env).
# WARNING: the Docker socket is root on the VM. Jobs run whatever the repository's workflows say, so register the
# runner only for repositories you control (it is registered instance-wide by default: prefer a repo/user-level token).
# One-time registration: put RUNNER_TOKEN=<registration token> in .env (chmod 600), `docker compose up -d`,
# then remove the line: the runner keeps its identity in /data/.runner. See docs/DEPLOY.md.
name: gitea-runner

services:
  runner:
    image: gitea/act_runner:0.6.1@sha256:b5c35d6bdbb9bb25e531230bfc7cc663cb751406cbec90a2a891b85fea54de86
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    environment:
      TZ: Europe/Warsaw
      CONFIG_FILE: /config.yaml
      # Straight to the port Gitea publishes on the VM (no traefik ipwhitelist in the way).
      GITEA_INSTANCE_URL: http://192.168.0.139:13080
      GITEA_RUNNER_NAME: vm103
      GITEA_RUNNER_REGISTRATION_TOKEN: ${RUNNER_TOKEN:-}
    volumes:
      - /srv/appdata/gitea-runner/data:/data
      - ./config.yaml:/config.yaml:ro
      - /var/run/docker.sock:/var/run/docker.sock