basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/forgejo-runner
History
CTO Agent 8c389f7082 fix: revert to Deployment with host Docker socket (dind approach abandoned) 
dind sidecar had networking issue: host-networked job containers can't reach
the dind daemon inside the pod. Back to host socket with docker binary
bind-mounted into job containers via container.options.
2026-07-18 16:47:05 +00:00
..
forgejo-runner-config.yaml fix: bind-mount host docker binary into job containers 2026-07-18 16:40:32 +00:00
forgejo-runner-deployment.yaml fix: revert to Deployment with host Docker socket (dind approach abandoned) 2026-07-18 16:47:05 +00:00
forgejo-runner-serviceaccount.yaml Add Forgejo Actions runner deployment configuration 2026-07-18 14:21:57 +00:00
forgejo-runner-token-sealed.yaml feat: add Forgejo runner registration token secret 2026-07-18 15:45:33 +00:00
README.md feat: migrate Forgejo runner to StatefulSet with Docker-in-Docker 2026-07-18 16:41:20 +00:00

README.md

Forgejo Actions Runner

This directory contains the deployment configuration for the Forgejo Actions runner.

Prerequisites

Before deploying the runner, you need to obtain a registration token from Forgejo.

Getting the Registration Token

Option 1: Via Forgejo Admin UI

  1. Log in to https://forgejo.basicstack.de as admin
  2. Navigate to Site Administration → Actions → Runners
  3. Click "Create new Runner"
  4. Copy the registration token

Option 2: Via API

export FORGEJO_TOKEN="your-api-token"
curl -X POST \
  -H "Authorization: token $FORGEJO_TOKEN" \
  https://forgejo.basicstack.de/api/v1/admin/runners/registration-token

Creating the Secret

Once you have the registration token, create a sealed secret:

# Create a temporary secret file
kubectl create secret generic forgejo-runner-token \
  --from-literal=token='YOUR_REGISTRATION_TOKEN' \
  --namespace=forgejo \
  --dry-run=client -o yaml > /tmp/runner-token-secret.yaml

# Seal it with kubeseal
kubeseal --format=yaml < /tmp/runner-token-secret.yaml > apps/forgejo-runner/forgejo-runner-token-sealed.yaml

# Clean up
rm /tmp/runner-token-secret.yaml

Deployment

The runner is deployed via Argo CD. After creating the sealed secret, apply the Argo CD application:

kubectl apply -f apps/app-forgejo-runner.yaml

Runner Configuration

The runner is deployed as a StatefulSet with Docker-in-Docker (dind) sidecar for proper isolation and state management.

Configuration:

  • Deployment type: StatefulSet (stable pod identity, persistent storage)
  • Docker execution: Docker-in-Docker sidecar (privileged init container)
  • Concurrent jobs: 2 (configurable via config.yaml)
  • Labels: ubuntu-latest:docker://node:24-bookworm, ubuntu-22.04:docker://node:24-bookworm
  • Forgejo URL: https://forgejo.basicstack.de (external URL for proper webhook/API access)
  • Persistent volumes:
    • runner-data (1Gi): Runner registration and config
    • docker-data (20Gi): Docker image cache

Troubleshooting

Check runner logs:

kubectl logs -n forgejo -l app=forgejo-runner -f

Check if runner is registered:

kubectl exec -n forgejo deployment/forgejo-runner -- forgejo-runner list

Kubernetes native runners

Kubernetes native runner still in discussion / under construction:\ https://codeberg.org/forgejo/discussions/issues/66