Sync forgejo runner-deployment.yaml with live cluster state, drop exposed password

This file had drifted badly from the actual running DaemonSet - the
live cluster already moved off the standalone registry.nxtgauge.com
mirror (now decommissioned, confirmed dead: internal DNS routes it to
Traefik with no matching ingress) onto ci.nxtgauge.com's built-in
registry. That migration was done directly against the cluster and
never reflected back to git, leaving a stale REGISTRY_PASSWORD literal
("Ashwin@2026") in this file that doesn't exist in the live DaemonSet
at all. Replaces the file with the actual live spec and adds the two
ConfigMaps (docker-daemon-config, registry-cert) it depends on, which
were also missing from the repo. Not applying this to the cluster -
the differences are purely cosmetic (mount ordering, stale
annotations) and would trigger a pointless restart of healthy runners.

apps/forgejo/runner-deployment.yaml

@@ -14,9 +14,18 @@ spec:
       labels:
         app: forgejo-runner
     spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: DoesNotExist
+                  - key: node-role.kubernetes.io/master
+                    operator: DoesNotExist
       initContainers:
       - name: init-runner-permissions
-        image: registry.nxtgauge.com/busybox:1.36
+        image: ci.nxtgauge.com/admin/busybox:1.36
         command: ["/bin/sh", "-ec"]
         args:
         - |
@@ -30,18 +39,9 @@ spec:
           mountPath: /data
         - name: runner-cache
           mountPath: /cache
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
-                    operator: DoesNotExist
-                  - key: node-role.kubernetes.io/master
-                    operator: DoesNotExist
       containers:
       - name: dind
-        image: registry.nxtgauge.com/docker:27-dind
+        image: ci.nxtgauge.com/admin/docker:27-dind
         args:
         - --host=tcp://0.0.0.0:2375
         - --tls=false
@@ -53,9 +53,12 @@ spec:
         volumeMounts:
         - name: dind-storage
           mountPath: /var/lib/docker
-        - name: registry-docker-config
-          mountPath: /root/.docker/config.json
-          subPath: config.json
+        - name: docker-config
+          mountPath: /etc/docker/daemon.json
+          subPath: daemon.json
+        - name: registry-cert
+          mountPath: /etc/docker/certs.d/registry.nxtgauge.com/ca.crt
+          subPath: registry.crt
           readOnly: true
         resources:
           requests:
@@ -65,7 +68,7 @@ spec:
             cpu: 2
             memory: 4Gi
       - name: runner
-        image: registry.nxtgauge.com/forgejo-runner:6
+        image: ci.nxtgauge.com/admin/forgejo-runner:6
         env:
         - name: DOCKER_HOST
           value: tcp://127.0.0.1:2375
@@ -82,12 +85,13 @@ spec:
               fieldPath: spec.nodeName
         - name: FORGEJO_RUNNER_LABELS
           value: "self-hosted:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,linux:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,ubuntu-latest:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,ubuntu-22.04:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,ubuntu-24.04:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,debian-12:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,docker-ready:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest"
-        - name: REGISTRY_HOSTPORT
-          value: "registry.nxtgauge.com"
-        - name: REGISTRY_USERNAME
-          value: "admin"
-        - name: REGISTRY_PASSWORD
-          value: "Ashwin@2026"
+        resources:
+          requests:
+            cpu: 200m
+            memory: 512Mi
+          limits:
+            cpu: 4
+            memory: 8Gi
         volumeMounts:
         - name: runner-config
           mountPath: /data
@@ -99,32 +103,28 @@ spec:
         - |
           cd /data
           RUNNER_NAME="${K8S_NODE_NAME}"
-
           echo "Waiting for Docker sidecar on ${K8S_NODE_NAME}..."
           sleep 8
-
-
-          echo "Resetting runner registration state for ${RUNNER_NAME}..."
           rm -f .runner
-
-          echo "Registering runner ${RUNNER_NAME} on node ${K8S_NODE_NAME}..."
+          echo "Registering runner ${RUNNER_NAME}..."
           forgejo-runner register \
             --no-interactive \
             --instance "$FORGEJO_INSTANCE_URL" \
             --token "$FORGEJO_RUNNER_REGISTRATION_TOKEN" \
             --name "$RUNNER_NAME" \
             --labels "$FORGEJO_RUNNER_LABELS"
-
-          echo "Starting daemon for ${RUNNER_NAME}..."
+          echo "Starting daemon..."
           exec forgejo-runner daemon
-        resources:
-          requests:
-            cpu: 200m
-            memory: 512Mi
-          limits:
-            cpu: 4
-            memory: 8Gi
       volumes:
+      - name: docker-config
+        configMap:
+          name: docker-daemon-config
+      - name: registry-cert
+        configMap:
+          name: registry-cert
+          items:
+            - key: registry.crt
+              path: registry.crt
       - name: runner-config
         hostPath:
           path: /var/lib/forgejo-runner
@@ -135,15 +135,8 @@ spec:
           type: DirectoryOrCreate
       - name: dind-storage
         emptyDir: {}
-      - name: registry-docker-config
-        secret:
-          secretName: registry-docker-config
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: forgejo-runner-secret
-  namespace: forgejo
-type: Opaque
-stringData:
-  FORGEJO_RUNNER_REGISTRATION_TOKEN: "it63i9ZDM3NwSkSUMOYQSNTxpm3R8njC9SlIoRlq"
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 0

apps/forgejo/runner-docker-daemon-config.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: docker-daemon-config
+  namespace: forgejo
+data:
+  daemon.json: |
+    {
+      "insecure-registries": ["registry.nxtgauge.com"]
+    }

apps/forgejo/runner-registry-cert.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: registry-cert
+  namespace: forgejo
+data:
+  registry.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDXjCCAkagAwIBAgIRAKmaH9FY6+MJkPAoIP/iQkkwDQYJKoZIhvcNAQELBQAw
+    HzEdMBsGA1UEAxMUVFJBRUZJSyBERUZBVUxUIENFUlQwHhcNMjYwNjE3MTYxMTI2
+    WhcNMjcwNjE3MTYxMTI2WjAfMR0wGwYDVQQDExRUUkFFRklLIERFRkFVTFQgQ0VS
+    VDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALOQ4CM5+Vxm/0S3ijLl
+    nCdrhLO5/YHW4cby7llpn2Sac2fJP4jVnLLrFWITAfvqa5o2oDeHJH9nhpGZI/fg
+    NQvQu9RZIeq4d8xKoJ4d8qSJ2IVt2JJ+J0cjfg6Wm69DnFGpZGy4Vz4DgEWQ1u20
+    gnRfFBPBZmo45/pz9UafNtjoOx++C8VeHJRt8RCd0Zx26wePXQbN07+T1tj3MOc+
+    t92IBn0tQ9g20hiGMgrhi50dPv7HEupbKKy7ZCkBVN/XNHFrvorsCudirFlJZTGw
+    k2chsTOm2jiIf7xob+Ma1kHncH/NWm9QVieeBUTgrH/Fa2xAHhJ+DuFR0iXW8APj
+    FnMCAwEAAaOBlDCBkTAOBgNVHQ8BAf8EBAMCA7gwEwYDVR0lBAwwCgYIKwYBBQUH
+    AwEwDAYDVR0TAQH/BAIwADBcBgNVHREEVTBTglFmZmE0MmE0ZGJhZGJiMTY3ZjUz
+    YTBiNjA3ZWIyOTQ5OS5iN2QyYWM4ZDlhODRmZDU1MjU5OTc1Y2I0NDM3MWZhZS50
+    cmFlZmlrLmRlZmF1bHQwDQYJKoZIhvcNAQELBQADggEBAF1RgfSra5RE1zyRLAai
+    d8tBbzBMAYQVrLKjlYATsnv+d6RQ9ZocdwgLG2OI+roFx1BuLLl/C5aL09UFqCvr
+    Ab2exdlLMi4IGoVvgUkEtWYwwnbbsL0hR0keR7UE5snc2tT3SlAYLHenzY3kPFhf
+    Tx0IiS1hdLAQk0TpfRKDYJ7+IV5Mj+aeiG9uK+0je5VcvRSFnrGnackYT7f5yX96
+    fQ9vwhi7HvWwUlj/8wU/Se//92N7KkddlasyBF77Gdhnoa9qzYyUD1DJHCyfmkaI
+    RV9jAOWn4RFwpXB7TqNAKnkGWzYBaF5OQc7K/pHgYb+RtC1uNKd1rK3Lyoh56vAy
+    Y1g=
+    -----END CERTIFICATE-----