forgejo-runner-external(host): configure forgejo-runner setup

Configure connection for the DI-Day/website repo.

inventories/chaosknoten/host_vars/forgejo-runner-external.sops.yaml

@@ -1,4 +1,5 @@
 ansible_pull__age_private_key: ENC[AES256_GCM,data:moFPOIyQyFs7Js0sNjlV2Qdr24DdEYJsngDNqsiVJEIiu8mJS9qE9xdXozUympR99NF/dOgcsiBXmSSb4Bhv99OKZp8Kfto/s4eUSx4=,iv:biRudbCF5mdXnXim1p2N+5w9F0z3M9titSVBNJmDXwM=,tag:ESOBA5urjeLdUvTkUyDDOw==,type:str]
+secret__forgejo_runner_codeberg_diday_website_token: ENC[AES256_GCM,data:RDXT2MfYdtVOBIlSrwEnfMQsxKOaloinKFNoXT1lBHrGac9E7ayQOA==,iv:ljt5bELla9rb5H4yhCarNav5qcj0KR2yD66KTKYBVqs=,tag:OZ9G8vS9Wt5/vk34nh6sPQ==,type:str]
 sops:
   age:
     - enc: |
@@ -41,8 +42,8 @@ sops:
         1U7Q2Eo+C+Xq7OM=
         -----END AGE ENCRYPTED FILE-----
       recipient: age1pq1jqrcp3te50xugmv5wst3s9ahj0d38rfktxt43wlcqz7vnwyn3y2h7kyfr6rckrvmuk9m7yvp4efjnfsuxx6d8r9gn222r2eal5593arywrjwrgeypf745wyuvf3z2xk9tm5fgnwckftuvdggk66fph59rw69nt5dpjeewuww4vzt9gs4xelre952s7zjz56qv8tvesg2c89sp8rmy9dvhwfd6tucjhs6sjr6yp2njjra2u6w7c7f0sch3rwkw3wf2dc9su9aaa9q2f22sh5yf0fqejxa2qqpq4pg752589st5xsa5g8tpkjglj4tn35gd4hjj0xet9cjwhydmkmmkffy3nr8zdtctqu6pqsyf7aphvktryez39ru3qe7m6nvr465ffxr0ltvr85nddzxvcwpwpac64nu5tdfrxgjfqzc99vr3zxv8carpsw5evmruqlvrq6v6a4m2cwsz5gqw7nyk3jlj75kp5cnafzjn5dyrf8ppfhp5g5s34zsl7pejmmx2uuudjt7ru2y7as9mtagykrgqgt80fvp3eeh4gsmmd3ujgtp0ranq28aq9x0xdekqh49pfhhprjj6zqdfac5gxtjj736kh5jktc4ls4mjs3p33rzt6ze54uqsfept3qhua2pmugypup6hm6j2ek5sgxjnwvqyfj2l8vz4yfgkaxf699v7jqlwf7g68ang5kzqrjsu78lyardm4zen8zhrr24j334qdgs4zr8dhsfsnmvx9cdvu0swx27tcz8txs46zds9kekgmua7w7fnw3l2lf6zla956ssycac4zjy87rawr4thusxtcqgfzfzh2za9np0s34e5dwkp2l2k06cq09myxqfe7ze6a53d8sl5j43qcekh6kfvl9k0t7903q99pc35630zwm3hwxgnw354du5gngnz56skq9zx3pcnkr5eyh8r8t0dqudmvrrwmxreu6tgrklxw7yvu3zkjgt3gyjhc8kqcrevlukay45sz4k9zqxx9yrs88hzt4h52r2g74alf3cedes3atufy06q4lfq3nxdlnve0kqcwstzr6z6u7fqpqvacezdrr62ycteju6dqawkpthu0drtlxj547htfjcsnrmhgvhskwtuhk6yp7wp30p7qc5vkk8fegg6qx5kc9xs4trx7hj9xgydu7vd30hkceuxsczywjs9v2fl3svkwfypg62882yq6ltv7gfj4ajuy8ezd76g0z7juwspe7q6zs5ceshd6038tvvh2nlpjty6rg6a9qfzhgmjx9s6hynyk7xnq9zra6hxstg8p58x75hapd2mk6rapfunlnnkz5dsxjf4ud4dsvgjfjpzxcdy7sp8dzxtengrsdyu4824mqlw8p63d7m2z4mcyme4tm2qkugtdgrkyphe7akk2geukf6xkfkzd2pkdq5s3qm9fkvfkgrv6yw5kdgjak8xcgesg6tumans4fs8yrxtqlvv2z3emdvwchrjfq4xpzsj27yt4gdg8pknwz9tqpjkjxq6lysutrvwkvt2fwyj8wvv8wtmdl6fk6rsd9kq9a6wkhuq7vvrgwgj3xg2s229sprj4g2vzhy2dfesrp403gs64jqkrjuezwm4zd6uw2x4e2qkj8xqcf7c0zprdzu959x23u878vqqetgpjwt0z3kedt8l6dgpm0rf5dmrya5h3wgzfa0jjvgjphyxgxrwlrzpv4czgal933zs64tn90ks66ejjdaw4t67sch8r3q0kljeqnpdgmw0cpj6arc6k46wcqaccygczy76zt9362vslakvzqqv33tv3sjldp6qxprharmpm9uykgpx66343wuur5xj2aw0rgutpm4ztjzycn3a8d2jq2zpdzwmevezm7mkp9dmndkc3qz0kklgkxq9yehrk5ayfly97umhws0jll8qqg0r7gzxgw5vv76
-  lastmodified: "2026-07-07T22:15:31Z"
+  lastmodified: "2026-07-07T22:27:10Z"
-  mac: ENC[AES256_GCM,data:CrH4s1yeMfK52Ltl2mnECvC+bzcedGX4FKV49shX4agp4xB3cNaIvp8++qjmJaJMMcC1Ab4ZGEMBniyRoS/e4tJwSZ0zos+MIwgEHLxP/tCrsxdSsrSobQuuFj1bOvTYO9USZ706tGOG64tpJSM5WpR0FZ98kPRxiQyY0TNiXWk=,iv:JyZB2ko+tJLw9TM0ozXh7r4j4i2eUz18QGjvxVCxOPo=,tag:7fsnFkGV608dscAAoc/nFg==,type:str]
+  mac: ENC[AES256_GCM,data:bxgvYhfbWMQKhLhPbhw4GO5lbEBkdKHtf6kzUrZZ9UEmcM4JHfbX+RvtDSptcI6R3HOEwEzqVc6UUfvbLMaHgFzWcJP+Xl/5hghd7sauO3YQ7c6hRTpEHDRdBMeUvEO9Xcui27Gi30sSL8QMizkEenvVbdVtyM9bsfbwWHRwE/4=,iv:PbJ1sKqsuQOZqyl4Q3ccSyfx269gGlTAuwiEsxoYVpI=,tag:D94E/JPqnOJ3T6salPzUrA==,type:str]
   pgp:
     - created_at: "2026-07-07T22:15:14Z"
       enc: |-

inventories/chaosknoten/host_vars/forgejo-runner-external.yaml

@@ -0,0 +1 @@
+forgejo_runner__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/forgejo-runner-external/forgejo-runner/configuration.yaml.j2') }}"

inventories/chaosknoten/hosts.yaml

@@ -292,3 +292,4 @@ secrets_hosts:
 forgejo_runner_hosts:
   hosts:
     forgejo-runner:
+    forgejo-runner-external:

resources/chaosknoten/forgejo-runner-external/forgejo-runner/configuration.yaml.j2

@@ -0,0 +1,52 @@
+log:
+  level: info
+  job_level: info
+
+runner:
+  file: .runner
+  capacity: 4
+  timeout: 1h
+  shutdown_timeout: 30m
+  insecure: false
+  fetch_timeout: 30s
+  fetch_interval: 2s
+  report_interval: 1s
+  labels:
+    # https://forgejo.org/docs/latest/admin/actions/configuration/#choosing-labels
+    - docker:docker://docker.io/library/node:lts
+    # Provide ubuntu labels similar to the images running at Codeberg.
+    # https://github.com/catthehacker/docker_images
+    # https://codeberg.org/actions/meta
+    - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest
+    - ubuntu-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04
+    # Alpine
+    - alpine:docker://docker.io/library/alpine:latest
+    # Debian
+    - debian:docker://docker.io/library/debian:latest
+
+cache:
+  enabled: false
+
+container:
+  # Leave emtpy to create a network automatically.
+  network: ""
+  enable_ipv6: true
+  privileged: false
+  ## Something like this once gVisor can be used.
+  ## options: "--runtime=runsc --mount type=bind,src=/etc/gvisor-helper-resolv.conf,dst=/etc/resolv.conf,ro=true"
+  # Leave empty for default /workspace to be used.
+  workdir_parent:
+  ## Something like this once gVisor can be used.
+  ## Add /etc/gvisor-helper-resolv.conf to valid_volumes to make the bind-mount in options work.
+  ## valid_volumes: ["/etc/gvisor-helper-resolv.conf:ro"]
+  # Leave "-", so no docker host will be mounted in the job container.
+  docker_host: "-"
+  force_pull: true
+  force_rebuild: false
+
+server:
+  connections:
+    codeberg-diday-website:
+      url: https://codeberg.org/
+      uuid: 9e145f54-2263-4fb1-8151-9efb205f88d1
+      token: {{ secret__forgejo_runner_codeberg_diday_website_token }}