From 5004d16270b8c9aa062939e401886a01fdeb83f3 Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Sat, 4 Jul 2026 12:50:26 +0200
Subject: [PATCH] forgejo-runner: try to configure dind

---
 .../chaosknoten/host_vars/forgejo-runner.yaml |  1 +
 .../forgejo-runner/configuration.yaml.j2      |  5 +++-
 roles/forgejo_runner/README.md                |  5 ++++
 roles/forgejo_runner/defaults/main.yaml       |  2 ++
 .../files/forgejo-docker-in-docker.service    | 24 +++++++++++++++++++
 roles/forgejo_runner/tasks/main/02_setup.yaml | 21 ++++++++++++++++
 6 files changed, 57 insertions(+), 1 deletion(-)
 create mode 100644 roles/forgejo_runner/defaults/main.yaml
 create mode 100644 roles/forgejo_runner/files/forgejo-docker-in-docker.service

diff --git a/inventories/chaosknoten/host_vars/forgejo-runner.yaml b/inventories/chaosknoten/host_vars/forgejo-runner.yaml
index 28bc4ab..c74f5ca 100644
--- a/inventories/chaosknoten/host_vars/forgejo-runner.yaml
+++ b/inventories/chaosknoten/host_vars/forgejo-runner.yaml
@@ -1 +1,2 @@
 forgejo_runner__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2') }}"
+forgejo_runner__enable_dind: true
diff --git a/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2 b/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2
index 7463ea3..18a41dc 100644
--- a/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2
+++ b/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2
@@ -23,6 +23,8 @@ runner:
     - alpine:docker://docker.io/library/alpine:latest
     # Debian
     - debian:docker://docker.io/library/debian:latest
+  envs:
+    DOCKER_HOST: tcp://dind_container.docker.internal:2375
 
 cache:
   enabled: false
@@ -40,7 +42,8 @@ container:
   ## Add /etc/gvisor-helper-resolv.conf to valid_volumes to make the bind-mount in options work.
   ## valid_volumes: ["/etc/gvisor-helper-resolv.conf:ro"]
   # Leave "-", so no docker host will be mounted in the job container.
-  docker_host: "-"
+  docker_host: "tcp://127.0.0.1:2376"
+  options: "--add-host=dind_container.docker.internal:host-gateway"
   force_pull: true
   force_rebuild: false
 
diff --git a/roles/forgejo_runner/README.md b/roles/forgejo_runner/README.md
index ed53e8b..6aadfb3 100644
--- a/roles/forgejo_runner/README.md
+++ b/roles/forgejo_runner/README.md
@@ -7,3 +7,8 @@ See: https://forgejo.org/docs/latest/admin/actions/
 
 - `forgejo_runner__config`: The configuration to run the Forgejo Runner with.  
   A configuration can be generated using `forgejo-runner generate-config`. Also see the [relevant docs](https://forgejo.org/docs/latest/admin/actions/configuration/).
+
+## Optional Arguments
+
+- `forgejo_runner__enable_dind`: set up a Docker-in-Docker (dind) service alongside the runner.
+  You will need to adjust the runner configuration as explained in [Utilizing Docker within Actions: Docker-in-Docker](https://forgejo.org/docs/latest/admin/actions/docker-access/#docker-in-docker).
diff --git a/roles/forgejo_runner/defaults/main.yaml b/roles/forgejo_runner/defaults/main.yaml
new file mode 100644
index 0000000..94ac14c
--- /dev/null
+++ b/roles/forgejo_runner/defaults/main.yaml
@@ -0,0 +1,2 @@
+# Set up Docker in Docker on the runner host, and mount it into the runner
+forgejo_runner__enable_dind: false
diff --git a/roles/forgejo_runner/files/forgejo-docker-in-docker.service b/roles/forgejo_runner/files/forgejo-docker-in-docker.service
new file mode 100644
index 0000000..e015d87
--- /dev/null
+++ b/roles/forgejo_runner/files/forgejo-docker-in-docker.service
@@ -0,0 +1,24 @@
+[Unit]
+Description=Forgejo Docker in Docker
+Documentation=https://forgejo.org/docs/latest/admin/actions/docker-access/#docker-in-docker
+After=docker.service
+Requires=docker.service
+
+[Service]
+ExecStart=/usr/bin/docker run \
+  -p 127.0.0.1:2376:2375 \
+  --rm \
+  --privileged \
+  --name dind_container \
+  docker:dind \
+  dockerd -H tcp://0.0.0.0:2375 --tls=false
+ExecStop=/usr/bin/docker stop dind_container
+
+User=runner
+WorkingDirectory=/home/runner
+Restart=on-failure
+TimeoutSec=0
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/forgejo_runner/tasks/main/02_setup.yaml b/roles/forgejo_runner/tasks/main/02_setup.yaml
index c83c057..1b14c16 100644
--- a/roles/forgejo_runner/tasks/main/02_setup.yaml
+++ b/roles/forgejo_runner/tasks/main/02_setup.yaml
@@ -38,9 +38,30 @@
     - systemd daemon reload
     - restart the forgejo-runner service
 
+- name: ensure systemd service for dind exists
+  ansible.builtin.copy:
+    src: forgejo-docker-in-docker.service
+    dest: /etc/systemd/system/forgejo-docker-in-docker.service
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  when: forgejo_runner__enable_dind
+  notify:
+    - systemd daemon reload
+    - restart the forgejo-runner service
+
 - name: ensure systemd service is started and enabled
   ansible.builtin.systemd_service:
     name: forgejo-runner.service
     state: started
     enabled: true
   become: true
+
+- name: ensure systemd service for dind is started and enabled
+  ansible.builtin.systemd_service:
+    name: forgejo-docker-in-docker.service
+    state: started
+    enabled: true
+  become: true
+  when: forgejo_runner__enable_dind