fix: load tun module and pre-configure systemd override for Arch rootless Docker

- Load the tun kernel module before running dockerd-rootless-setuptool.sh,
  as both slirp4netns and pasta drivers require /dev/net/tun inside a user
  namespace. On Arch Linux CONFIG_TUN=m so the module must be loaded
  explicitly. If modprobe fails (kernel mismatch after pacman -Syu without
  reboot), warn but don't fail — a reboot will fix it.
- Create the systemd override directory and override.conf BEFORE running
  the setuptool, so when the setuptool starts docker.service it picks up
  the pasta network driver instead of defaulting to slirp4netns.
- Pass DOCKERD_ROOTLESS_ROOTLESSKIT_NET env var to the setuptool command
  as well, for belt-and-suspenders coverage.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ansible/roles/gitea_runner/tasks/rootless_docker.yml

@@ -68,6 +68,29 @@
     state: present
   when: ansible_facts['os_family'] == 'Archlinux'
 
+# The tun kernel module is required by rootlesskit (both slirp4netns and pasta
+# drivers create a tap device inside a user namespace). On Arch Linux, CONFIG_TUN=m
+# so the module must be loaded. If the running kernel doesn't match the installed
+# kernel (e.g. after a pacman -Syu that upgraded linux but didn't reboot), modprobe
+# will fail — in that case we warn but don't fail, as a reboot will fix it.
+- name: Load tun kernel module for rootless networking
+  community.general.modprobe:
+    name: tun
+    state: present
+  ignore_errors: true
+  register: gitea_runner_tun_module
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Warn if tun module could not be loaded (kernel mismatch — reboot needed)
+  ansible.builtin.debug:
+    msg: >-
+      WARNING: Could not load the tun kernel module. This is likely because the
+      running kernel ({{ ansible_facts['kernel'] }}) does not match the installed
+      kernel modules. A reboot is required before rootless Docker can start.
+  when:
+    - ansible_facts['os_family'] == 'Archlinux'
+    - gitea_runner_tun_module is failed
+
 # Arch Linux's "docker" package does not ship the rootless setup scripts (dockerd-rootless-setuptool.sh
 # and dockerd-rootless.sh), unlike Debian/Ubuntu's docker-ce-rootless-extras. No official Arch package
 # provides them, so fetch them from the upstream moby/moby contrib/ directory. They are installed
@@ -90,6 +113,35 @@
     path: "{{ gitea_runner_home }}/.config/systemd/user/docker.service"
   register: gitea_runner_rootless_docker_check
 
+# Create the systemd override BEFORE running the setuptool so that when
+# the setuptool starts docker.service, it picks up the pasta network driver
+# instead of the default slirp4netns (which may fail on some kernels).
+- name: Ensure systemd user override directory exists
+  ansible.builtin.file:
+    path: "{{ gitea_runner_home }}/.config/systemd/user/docker.service.d"
+    state: directory
+    mode: "0755"
+    owner: "{{ gitea_runner_service_user }}"
+    group: "{{ gitea_runner_service_user }}"
+  when:
+    - gitea_runner_docker_rootless_setup
+    - not gitea_runner_rootless_docker_check.stat.exists
+
+- name: Pre-configure rootless Docker network driver override
+  ansible.builtin.copy:
+    dest: "{{ gitea_runner_home }}/.config/systemd/user/docker.service.d/override.conf"
+    content: |
+      [Service]
+      Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_NET={{ gitea_runner_docker_rootless_net_driver }}"
+      Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=implicit"
+      Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS=--ipv6"
+    mode: "0644"
+    owner: "{{ gitea_runner_service_user }}"
+    group: "{{ gitea_runner_service_user }}"
+  when:
+    - gitea_runner_docker_rootless_setup
+    - not gitea_runner_rootless_docker_check.stat.exists
+
 - name: Set up rootless Docker for runner user
   ansible.builtin.command: dockerd-rootless-setuptool.sh install
   args:
@@ -98,6 +150,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DOCKERD_ROOTLESS_ROOTLESSKIT_NET: "{{ gitea_runner_docker_rootless_net_driver }}"
   when:
     - gitea_runner_docker_rootless_setup
     - not gitea_runner_rootless_docker_check.stat.exists
@@ -129,15 +182,6 @@
     group: "{{ gitea_runner_service_user }}"
   when: gitea_runner_docker_rootless_setup
 
-- name: Ensure systemd user override directory exists
-  ansible.builtin.file:
-    path: "{{ gitea_runner_home }}/.config/systemd/user/docker.service.d"
-    state: directory
-    mode: "0755"
-    owner: "{{ gitea_runner_service_user }}"
-    group: "{{ gitea_runner_service_user }}"
-  when: gitea_runner_docker_rootless_setup
-
 - name: Configure rootless Docker to use pasta with IPv6
   ansible.builtin.copy:
     dest: "{{ gitea_runner_home }}/.config/systemd/user/docker.service.d/override.conf"