GRM-156: fix: switch default network driver to slirp4netns (pasta TCP RST bug)

Co-authored-by: oblachno Admin <admin@oblachno.oblachno.fyi>

ansible/roles/gitea_runner/tasks/healthcheck.yml

@@ -7,6 +7,22 @@
     group: "{{ gitea_runner_service_user }}"
     mode: "0755"
 
+- name: Write auto-recovery API token file
+  ansible.builtin.copy:
+    content: "{{ gitea_runner_auto_recover_api_token }}"
+    dest: "{{ gitea_runner_config_dir }}/auto-recover.token"
+    owner: "{{ gitea_runner_service_user }}"
+    group: "{{ gitea_runner_service_user }}"
+    mode: "0400"
+  no_log: true
+  when: gitea_runner_auto_recover_api_token | length > 0
+
+- name: Remove stale auto-recovery token file (if auto-recovery disabled)
+  ansible.builtin.file:
+    path: "{{ gitea_runner_config_dir }}/auto-recover.token"
+    state: absent
+  when: gitea_runner_auto_recover_api_token | length == 0
+
 - name: Create healthcheck user service file
   ansible.builtin.template:
     src: runner-healthcheck.service.j2

ansible/roles/gitea_runner/tasks/register.yml

@@ -7,11 +7,20 @@
     group: "{{ gitea_runner_service_user }}"
     mode: "0755"
 
-- name: Check if runner is already registered
+- name: Check if runner registration file exists
   ansible.builtin.stat:
     path: "{{ gitea_runner_data_dir }}/.runner"
   register: gitea_runner_registered
 
+- name: Remove stale runner registration file
+  ansible.builtin.file:
+    path: "{{ gitea_runner_data_dir }}/.runner"
+    state: absent
+  when:
+    - gitea_runner_registered.stat.exists
+    - gitea_runner_force_reregister | bool
+  register: gitea_runner_registration_removed
+
 - name: Register runner with Gitea
   ansible.builtin.command: >
     {{ gitea_runner_binary_path }} register
@@ -28,7 +37,23 @@
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid | default(0) }}"
     DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
     DOCKER_HOST: "unix:///run/user/{{ gitea_runner_uid | default(0) }}/docker.sock"
-  when: not gitea_runner_registered.stat.exists
+  when: not gitea_runner_registered.stat.exists or gitea_runner_force_reregister | bool
   register: gitea_runner_register_output
-  changed_when: "'already exists' not in gitea_runner_register_output.stdout | default('')"
+  changed_when: >-
+    gitea_runner_register_output.rc == 0 and
+    ('already exists' not in gitea_runner_register_output.stdout | default(''))
   timeout: 60
+
+- name: Ensure runner service is running after registration
+  ansible.builtin.command: systemctl --user start gitea-runner
+  become: true
+  become_user: "{{ gitea_runner_service_user }}"
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  changed_when: true
+  when:
+    - gitea_runner_systemd_available.stat.exists
+    - gitea_runner_docker_rootless_setup
+    - gitea_runner_register_output is defined
+    - gitea_runner_register_output.rc | default(1) == 0

ansible/roles/gitea_runner/tasks/rootless_docker.yml

@@ -53,72 +53,6 @@
   register: gitea_runner_docker_install
   when: ansible_facts['os_family'] == 'Debian'
 
-# Docker 28.x vendors containerd v2.1.x. containerd.io >= 2.3 ships a shim that
-# returns a protobuf BootstrapResult the vendored 2.1.x code cannot parse, causing
-# "failed to create TTRPC connection: unsupported protocol" on every container start.
-# Detect the mismatch and downgrade containerd.io to the latest compatible 2.2.x.
-- name: Check installed Docker CE version (Debian/Ubuntu)
-  ansible.builtin.command: dpkg-query -W -f='${Version}' docker-ce
-  register: gitea_runner_docker_version_check
-  changed_when: false
-  when: ansible_facts['os_family'] == 'Debian'
-
-- name: Check installed containerd.io version (Debian/Ubuntu)
-  ansible.builtin.shell: "set -o pipefail; dpkg-query -W -f='${Version}' containerd.io 2>/dev/null | cut -d: -f2 | cut -d- -f1"
-  args:
-    executable: /bin/bash
-  register: gitea_runner_containerd_version_check
-  changed_when: false
-  when: ansible_facts['os_family'] == 'Debian'
-
-- name: Determine if containerd.io is incompatible with installed Docker
-  ansible.builtin.set_fact:
-    gitea_runner_containerd_needs_downgrade: >-
-      {{
-        gitea_runner_containerd_version_check.stdout.split('.')[0] | int > gitea_runner_containerd_max_compatible_major
-        or (
-          gitea_runner_containerd_version_check.stdout.split('.')[0] | int == gitea_runner_containerd_max_compatible_major
-          and gitea_runner_containerd_version_check.stdout.split('.')[1] | int > gitea_runner_containerd_max_compatible_minor
-        )
-      }}
-    gitea_runner_docker_major: "{{ gitea_runner_docker_version_check.stdout.split('.')[0] | default('0') | int }}"
-  when: ansible_facts['os_family'] == 'Debian'
-
-- name: Find latest compatible containerd.io version (Debian/Ubuntu)
-  ansible.builtin.shell: |
-    set -o pipefail
-    apt-cache madison containerd.io \
-      | awk -F'|' '{print $2}' \
-      | tr -d ' ' \
-      | grep -E '^{{ gitea_runner_containerd_max_compatible_major }}\.{{ gitea_runner_containerd_max_compatible_minor }}\.' \
-      | head -1
-  args:
-    executable: /bin/bash
-  register: gitea_runner_containerd_compatible_version
-  changed_when: false
-  when:
-    - ansible_facts['os_family'] == 'Debian'
-    - gitea_runner_containerd_needs_downgrade | default(false)
-    - gitea_runner_docker_major | int < 29
-
-- name: Downgrade containerd.io to compatible version (Debian/Ubuntu)
-  ansible.builtin.apt:
-    name: "containerd.io={{ gitea_runner_containerd_compatible_version.stdout }}"
-    state: present
-    allow_downgrades: true
-  register: gitea_runner_containerd_downgrade
-  when:
-    - ansible_facts['os_family'] == 'Debian'
-    - gitea_runner_containerd_needs_downgrade | default(false)
-    - gitea_runner_docker_major | int < 29
-    - gitea_runner_containerd_compatible_version.stdout | length > 0
-
-- name: Hold containerd.io package to prevent auto-upgrade (Debian/Ubuntu)
-  ansible.builtin.dpkg_selections:
-    name: containerd.io
-    selection: hold
-  when: ansible_facts['os_family'] == 'Debian'
-
 - name: Update pacman cache (Arch Linux)
   community.general.pacman:
     update_cache: true