147 lines
7.7 KiB
YAML
147 lines
7.7 KiB
YAML
---
|
|
gitea_runner_version: "2.0.1"
|
|
gitea_runner_labels: "docker,ubuntu-latest:docker://runner-images:ubuntu-26.04"
|
|
gitea_runner_skip_registration: false
|
|
|
|
# Force re-registration even if .runner file exists.
|
|
# Use this when Gitea no longer recognizes the runner (e.g., after a Gitea
|
|
# server restore/reinstall or when the runner record was deleted from the
|
|
# admin UI). The existing .runner file is removed and a new registration is
|
|
# performed. Requires registration_token.
|
|
gitea_runner_force_reregister: false
|
|
|
|
# Per-runner user (rootless isolation)
|
|
gitea_runner_user_prefix: "grm-"
|
|
gitea_runner_base_home: "/home"
|
|
gitea_runner_service_user: "{{ gitea_runner_user_prefix }}{{ gitea_runner_name }}"
|
|
gitea_runner_home: "{{ gitea_runner_base_home }}/{{ gitea_runner_service_user }}"
|
|
|
|
# Base paths (instance-scoped via gitea_runner_name)
|
|
gitea_runner_base_data_dir: "/var/lib/gitea-runner"
|
|
gitea_runner_base_config_dir: "/etc/gitea-runner"
|
|
gitea_runner_data_dir: "{{ gitea_runner_base_data_dir }}/{{ gitea_runner_name }}"
|
|
gitea_runner_config_dir: "{{ gitea_runner_base_config_dir }}/{{ gitea_runner_name }}"
|
|
gitea_runner_binary_path: "/usr/local/bin/gitea_runner"
|
|
|
|
# Prune configuration
|
|
gitea_runner_prune_until: "24h"
|
|
# Every 6 hours — daily is insufficient for CI runners that build dozens
|
|
# of images per day. Accumulation between daily runs can trigger Docker
|
|
# daemon instability (containerd snapshotter GC holds locks, blocking
|
|
# container operations).
|
|
gitea_runner_prune_schedule: "*-*-* 00/6:00:00"
|
|
gitea_runner_prune_label: "gitea-runner=true"
|
|
|
|
# Service configuration
|
|
gitea_runner_service_restart_sec: "5"
|
|
|
|
# Health check configuration
|
|
# 2min interval — catches hung daemons before multiple CI jobs fail between
|
|
# checks. The 1min interval caused excessive pruning which removed cached
|
|
# images, forcing all 6 parallel slots to re-pull simultaneously and
|
|
# actually increasing disk pressure.
|
|
gitea_runner_healthcheck_interval: "2min"
|
|
gitea_runner_healthcheck_boot_delay: "2min"
|
|
gitea_runner_healthcheck_disk_threshold: 70
|
|
# When disk reaches this level, prune EVERYTHING (no until-filter) — the
|
|
# runner is dangerously full and the gentle until=1h prune isn't enough.
|
|
# This removes all stopped containers and unused images regardless of age.
|
|
# At 75%+, molecule containers fail with "container is not running" because
|
|
# overlay2 runs out of space under parallel DinD load.
|
|
# IMPORTANT: keep at 75 (not lower) — the host disk normally sits at ~74%.
|
|
# Lowering to 70 triggers full prune every cycle, wiping cached images and
|
|
# forcing all parallel slots to re-pull simultaneously, which increases
|
|
# disk pressure rather than reducing it.
|
|
gitea_runner_healthcheck_disk_critical: 75
|
|
gitea_runner_healthcheck_script_path: "{{ gitea_runner_config_dir }}/healthcheck.sh"
|
|
|
|
# Auto-recovery: when the healthcheck detects an unregistered runner, it
|
|
# can automatically re-register if a Gitea API token is provided.
|
|
# The token needs admin or org-level access to fetch registration tokens.
|
|
# Stored in a file readable by the runner user (mode 0400).
|
|
# Set to empty string to disable auto-recovery (manual re-registration required).
|
|
gitea_runner_auto_recover_api_token: ""
|
|
|
|
# Cooldown file to prevent auto-recovery loops (e.g., if Gitea is down).
|
|
# The healthcheck writes a timestamp to this file after a re-registration
|
|
# attempt and skips further attempts for the cooldown period.
|
|
gitea_runner_auto_recover_cooldown_sec: 300
|
|
|
|
# Docker daemon resilience settings (applied to daemon.json).
|
|
# live-restore: containers survive daemon restarts — prevents stuck container
|
|
# states when the healthcheck restarts a hung daemon.
|
|
# shutdown-timeout: grace period (seconds) for containers to stop on daemon
|
|
# shutdown/restart. Default 15s is too short for DinD containers with nested
|
|
# processes (molecule tests). 30s gives SIGTERM time to propagate.
|
|
# max-concurrent-downloads/uploads: limits parallel transfers to reduce daemon
|
|
# memory pressure when multiple CI jobs pull images simultaneously.
|
|
# default-ulimits: prevents FD exhaustion in container processes.
|
|
gitea_runner_docker_live_restore: true
|
|
gitea_runner_docker_shutdown_timeout: 30
|
|
gitea_runner_docker_max_concurrent_downloads: 3
|
|
gitea_runner_docker_max_concurrent_uploads: 3
|
|
gitea_runner_docker_default_nofile: 65536
|
|
# Log file size limits — under parallel DinD load, container logs can fill
|
|
# disk and cause the daemon to become unresponsive. Limit log size per container.
|
|
gitea_runner_docker_max_log_size: "10m"
|
|
gitea_runner_docker_max_log_files: 3
|
|
|
|
# Admin token for runner deregistration via Gitea API.
|
|
# If not set, falls back to registration_token (which likely lacks admin scope).
|
|
# Set this to a token with admin scope to enable automatic runner cleanup on removal.
|
|
gitea_runner_admin_token: ""
|
|
|
|
# Removal defaults
|
|
gitea_runner_remove_systemd_template: true
|
|
gitea_runner_remove_user: true
|
|
|
|
# Runner configuration
|
|
gitea_runner_log_level: "info"
|
|
gitea_runner_container_label: "gitea-runner=true"
|
|
gitea_runner_file: ".runner"
|
|
|
|
# Containerd version pinning — Docker 28.x vendors containerd v2.1.x internally.
|
|
# containerd.io >= 2.3 ships a shim that returns a protobuf BootstrapResult which
|
|
# Docker 28.x's vendored containerd code cannot parse, causing:
|
|
# "failed to create TTRPC connection: unsupported protocol: \b\x03\x12Yunix"
|
|
# When Docker 29+ is installed (it vendors containerd 2.3+), this pin is not needed.
|
|
# Set to "" to skip the compatibility check and allow any containerd.io version.
|
|
gitea_runner_containerd_max_compatible_major: 2
|
|
gitea_runner_containerd_max_compatible_minor: 2
|
|
|
|
# Docker installation (for rootless dependencies)
|
|
gitea_runner_docker_gpg_key_path: "/etc/apt/keyrings/docker.gpg"
|
|
gitea_runner_docker_apt_arch: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else ansible_facts['architecture'] }}"
|
|
gitea_runner_docker_apt_source_line: >-
|
|
deb [arch={{ gitea_runner_docker_apt_arch }} signed-by={{ gitea_runner_docker_gpg_key_path }}]
|
|
https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}
|
|
{{ ansible_facts['distribution_release'] }} stable
|
|
# Set to false in CI/molecule to skip rootless daemon startup (needs kernel userns)
|
|
gitea_runner_docker_rootless_setup: true
|
|
|
|
# Rootless Docker helper scripts (dockerd-rootless-setuptool.sh / dockerd-rootless.sh).
|
|
# Arch Linux's "docker" package does not ship these (unlike Debian's docker-ce-rootless-extras),
|
|
# and no official Arch package provides them. They are fetched from the upstream moby/moby
|
|
# "contrib/" directory at the git ref below. The scripts are stable bash wrappers that are
|
|
# version-agnostic with respect to the dockerd binary, so a pinned ref is safe.
|
|
gitea_runner_rootless_scripts_ref: "v28.5.1"
|
|
# Install dir MUST match the location of the "docker" / "dockerd" / "rootlesskit" binaries so
|
|
# that dockerd-rootless-setuptool.sh (which derives BIN from its own dirname) finds them co-located.
|
|
gitea_runner_rootless_scripts_install_dir: "/usr/bin"
|
|
|
|
# Rootless Docker network driver: "slirp4netns" (default) or "pasta" (IPv6 support)
|
|
# slirp4netns is the default because pasta has a TCP proxy bug that sends RST
|
|
# packets with wrong sequence numbers, breaking TCP connections from Docker
|
|
# containers to external hosts. slirp4netns doesn't have IPv6 support.
|
|
# See: https://bugs.passt.top/show_bug.cgi?id=52
|
|
gitea_runner_docker_rootless_net_driver: "slirp4netns"
|
|
|
|
# IPv6 subnet for rootless Docker containers (ULA range, not routable on internet)
|
|
gitea_runner_docker_ipv6_cidr: "fd00:dead:beef::/48"
|
|
|
|
# Pre-pull Docker images that CI runners need (avoids pulling on every CI run).
|
|
# The runner container image (ci-full) is large (~3.3GB) and the healthcheck's
|
|
# disk-space prune only removes dangling images, so pre-pulled tagged images persist.
|
|
# Set to [] to skip pre-pulling. Images are pulled as the runner user via rootless Docker.
|
|
gitea_runner_pre_pull_images: []
|