Emil Simeonov
7cf6ce9afb
pasta's TCP proxy sends RST packets with wrong sequence numbers after the first data packet, breaking TCP connections from Docker containers to external hosts. slirp4netns doesn't have this bug. Changes: - Default gitea_runner_docker_rootless_net_driver changed to slirp4netns - Port driver: 'implicit' for pasta, 'builtin' for slirp4netns - daemon.json: DNS configured per driver (10.0.2.3 for pasta, 8.8.8.8 for slirp4netns) - IPv6 only enabled for pasta (slirp4netns doesn't support IPv6) - integration_test: retry service active check (handles slow startup)
76 lines
3.6 KiB
YAML
76 lines
3.6 KiB
YAML
---
|
|
gitea_runner_version: "2.0.1"
|
|
gitea_runner_labels: "docker,ubuntu-latest:docker://runner-images:ubuntu-26.04"
|
|
gitea_runner_skip_registration: false
|
|
|
|
# Per-runner user (rootless isolation)
|
|
gitea_runner_user_prefix: "grm-"
|
|
gitea_runner_base_home: "/home"
|
|
gitea_runner_service_user: "{{ gitea_runner_user_prefix }}{{ gitea_runner_name }}"
|
|
gitea_runner_home: "{{ gitea_runner_base_home }}/{{ gitea_runner_service_user }}"
|
|
|
|
# Base paths (instance-scoped via gitea_runner_name)
|
|
gitea_runner_base_data_dir: "/var/lib/gitea-runner"
|
|
gitea_runner_base_config_dir: "/etc/gitea-runner"
|
|
gitea_runner_data_dir: "{{ gitea_runner_base_data_dir }}/{{ gitea_runner_name }}"
|
|
gitea_runner_config_dir: "{{ gitea_runner_base_config_dir }}/{{ gitea_runner_name }}"
|
|
gitea_runner_binary_path: "/usr/local/bin/gitea_runner"
|
|
|
|
# Prune configuration
|
|
gitea_runner_prune_until: "24h"
|
|
gitea_runner_prune_schedule: "daily"
|
|
gitea_runner_prune_label: "gitea-runner=true"
|
|
|
|
# Service configuration
|
|
gitea_runner_service_restart_sec: "5"
|
|
|
|
# Health check configuration
|
|
gitea_runner_healthcheck_interval: "5min"
|
|
gitea_runner_healthcheck_boot_delay: "2min"
|
|
gitea_runner_healthcheck_disk_threshold: 85
|
|
gitea_runner_healthcheck_script_path: "{{ gitea_runner_config_dir }}/healthcheck.sh"
|
|
|
|
# Admin token for runner deregistration via Gitea API.
|
|
# If not set, falls back to registration_token (which likely lacks admin scope).
|
|
# Set this to a token with admin scope to enable automatic runner cleanup on removal.
|
|
gitea_runner_admin_token: ""
|
|
|
|
# Removal defaults
|
|
gitea_runner_remove_systemd_template: true
|
|
gitea_runner_remove_user: true
|
|
|
|
# Runner configuration
|
|
gitea_runner_log_level: "info"
|
|
gitea_runner_container_label: "gitea-runner=true"
|
|
gitea_runner_file: ".runner"
|
|
|
|
# Docker installation (for rootless dependencies)
|
|
gitea_runner_docker_gpg_key_path: "/etc/apt/keyrings/docker.gpg"
|
|
gitea_runner_docker_apt_arch: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else ansible_facts['architecture'] }}"
|
|
gitea_runner_docker_apt_source_line: >-
|
|
deb [arch={{ gitea_runner_docker_apt_arch }} signed-by={{ gitea_runner_docker_gpg_key_path }}]
|
|
https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}
|
|
{{ ansible_facts['distribution_release'] }} stable
|
|
# Set to false in CI/molecule to skip rootless daemon startup (needs kernel userns)
|
|
gitea_runner_docker_rootless_setup: true
|
|
|
|
# Rootless Docker helper scripts (dockerd-rootless-setuptool.sh / dockerd-rootless.sh).
|
|
# Arch Linux's "docker" package does not ship these (unlike Debian's docker-ce-rootless-extras),
|
|
# and no official Arch package provides them. They are fetched from the upstream moby/moby
|
|
# "contrib/" directory at the git ref below. The scripts are stable bash wrappers that are
|
|
# version-agnostic with respect to the dockerd binary, so a pinned ref is safe.
|
|
gitea_runner_rootless_scripts_ref: "v28.5.1"
|
|
# Install dir MUST match the location of the "docker" / "dockerd" / "rootlesskit" binaries so
|
|
# that dockerd-rootless-setuptool.sh (which derives BIN from its own dirname) finds them co-located.
|
|
gitea_runner_rootless_scripts_install_dir: "/usr/bin"
|
|
|
|
# Rootless Docker network driver: "slirp4netns" (default) or "pasta" (IPv6 support)
|
|
# slirp4netns is the default because pasta has a TCP proxy bug that sends RST
|
|
# packets with wrong sequence numbers, breaking TCP connections from Docker
|
|
# containers to external hosts. slirp4netns doesn't have IPv6 support.
|
|
# See: https://bugs.passt.top/show_bug.cgi?id=52
|
|
gitea_runner_docker_rootless_net_driver: "slirp4netns"
|
|
|
|
# IPv6 subnet for rootless Docker containers (ULA range, not routable on internet)
|
|
gitea_runner_docker_ipv6_cidr: "fd00:dead:beef::/48"
|