apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: forgejo-runner
  namespace: forgejo
  labels:
    app: forgejo-runner
spec:
  selector:
    matchLabels:
      app: forgejo-runner
  template:
    metadata:
      labels:
        app: forgejo-runner
    spec:
      initContainers:
      - name: init-runner-permissions
        image: busybox:1.36
        command: ["/bin/sh", "-ec"]
        args:
        - |
          mkdir -p /data /cache
          chown -R 1000:0 /data /cache
          chmod -R g=u /data /cache
        securityContext:
          runAsUser: 0
        volumeMounts:
        - name: runner-config
          mountPath: /data
        - name: runner-cache
          mountPath: /cache
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: node-role.kubernetes.io/control-plane
                    operator: DoesNotExist
                  - key: node-role.kubernetes.io/master
                    operator: DoesNotExist
      containers:
      - name: dind
        image: docker:27-dind
        args:
        - --host=tcp://0.0.0.0:2375
        - --tls=false
        securityContext:
          privileged: true
        env:
        - name: DOCKER_TLS_CERTDIR
          value: ""
        volumeMounts:
        - name: dind-storage
          mountPath: /var/lib/docker
        resources:
          requests:
            cpu: 250m
            memory: 512Mi
          limits:
            cpu: 2
            memory: 4Gi
      - name: runner
        image: code.forgejo.org/forgejo/runner:6
        env:
        - name: DOCKER_HOST
          value: tcp://127.0.0.1:2375
        - name: FORGEJO_INSTANCE_URL
          value: http://forgejo-http.forgejo.svc.cluster.local:3000
        - name: FORGEJO_RUNNER_REGISTRATION_TOKEN
          valueFrom:
            secretKeyRef:
              name: forgejo-runner-secret
              key: FORGEJO_RUNNER_REGISTRATION_TOKEN
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: FORGEJO_RUNNER_LABELS
          value: "self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-latest,linux:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-24.04:docker://ghcr.io/catthehacker/ubuntu:act-latest,debian-12:docker://ghcr.io/catthehacker/ubuntu:act-latest"
        volumeMounts:
        - name: runner-config
          mountPath: /data
        - name: runner-cache
          mountPath: /cache
        command: ["/bin/sh"]
        args:
        - -ec
        - |
          cd /data
          RUNNER_NAME="${K8S_NODE_NAME}"

          echo "Waiting for Docker sidecar on ${K8S_NODE_NAME}..."
          sleep 8


          if [ ! -f .runner ]; then
            echo "Registering runner ${RUNNER_NAME} on node ${K8S_NODE_NAME}..."
            forgejo-runner register \
              --no-interactive \
              --instance "$FORGEJO_INSTANCE_URL" \
              --token "$FORGEJO_RUNNER_REGISTRATION_TOKEN" \
              --name "$RUNNER_NAME" \
              --labels "$FORGEJO_RUNNER_LABELS"
          else
            echo "Reusing existing runner state for ${RUNNER_NAME} on node ${K8S_NODE_NAME}."
          fi

          echo "Starting daemon for ${RUNNER_NAME}..."
          exec forgejo-runner daemon
        resources:
          requests:
            cpu: 200m
            memory: 512Mi
          limits:
            cpu: 4
            memory: 8Gi
      volumes:
      - name: runner-config
        hostPath:
          path: /var/lib/forgejo-runner
          type: DirectoryOrCreate
      - name: runner-cache
        hostPath:
          path: /var/cache/forgejo-runner
          type: DirectoryOrCreate
      - name: dind-storage
        emptyDir: {}
---
apiVersion: v1
kind: Secret
metadata:
  name: forgejo-runner-secret
  namespace: forgejo
type: Opaque
stringData:
  FORGEJO_RUNNER_REGISTRATION_TOKEN: "it63i9ZDM3NwSkSUMOYQSNTxpm3R8njC9SlIoRlq"