GRM-163: Fix systemctl --user tasks in gitea_runner role using runuser #255

Merged

emo merged 5 commits from GRM-163-runner-self-healing-v2 into master 2026-08-24 03:15:19 +00:00

Conversation 14 Commits 5 Files Changed 8

+121 -78

5 Commits

Author	SHA1	Message	Date
Emil Simeonov	8b751e4eff	fix: wait for molecule tests before auto-merge attempt	2026-08-24 05:03:51 +02:00
Emil Simeonov	4083835ca3	chore: re-trigger auto-merge	2026-08-24 04:50:15 +02:00
Emil Simeonov	150d3267d1	fix: pin devx to v0.50.1 (v0.50.5 tag does not exist)	2026-08-24 04:36:31 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	fe9f66afb5	fix: runner self-healing — fix service startup order, add Docker restart override ... Three fixes for runner reliability: 1. Fix service startup order (install_runner.yml) - Move service.yml include BEFORE register.yml - Previously, register.yml tried to start gitea-runner.service before service.yml created the systemd unit file, causing "Unit gitea-runner.service not found" on first install - This only failed when registration actually happened (new runner); on idempotent re-runs registration was skipped so the bug was masked 2. Restart runner after (re-)registration (register.yml) - Add "Restart runner service after (re-)registration" task - When a runner is re-registered (force-reregister or auto-recovery), the service must be restarted to pick up the new .runner file - The old premature start task was already removed; this adds it back in the correct position (after service.yml has created the unit) 3. Docker daemon restart override (rootless_docker.yml) - Add Restart=always, RestartSec=5, StartLimitIntervalSec=300, StartLimitBurst=10 to both Docker service override blocks - Upstream dockerd-rootless-setuptool.sh defaults to StartLimitBurst=3 in 60s — too aggressive for OOM-prone hosts - If Docker crashes 3 times in a minute, it stops restarting permanently, taking the runner down with it - New settings allow 10 restarts in 5 minutes, matching the runner service's own restart policy Note: Auto-recovery (--auto-recover-token) already exists in the CLI and healthcheck script but defaults to disabled. Operators should pass --auto-recover-token <token> during grm install to enable automatic re-registration when runners become unregistered. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-08-24 04:36:21 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	d16f53dfd7	fix: use runuser for systemctl --user tasks in gitea_runner role ... The become_user pattern with sudo doesn't reliably connect to the user's D-Bus session, causing systemd user timers (docker-prune, runner-healthcheck) to silently fail to enable. This led to stale Docker images accumulating and filling the disk on CI runners. Switch all systemctl --user invocations to use runuser with explicit XDG_RUNTIME_DIR and DBUS_SESSION_BUS_ADDRESS environment variables, which correctly connects to the user's systemd session. Affected tasks: prune timer, healthcheck timer, gitea-runner service, rootless Docker daemon start/enable/restart, runner service restart. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-08-24 04:36:21 +02:00