PhilandClaude Opus 5.5
a6592d3ad0
Jobs run inside the runner container (label docker:host), and with the host's Docker socket mounted every workflow had root on the server. The socket was only there for StarPunk's image build, which has never worked (it logged in to gitea:3000, which the host daemon can't resolve). Image builds now go to a rootless BuildKit container that shares only a unix socket with the runner. Site builds keep their /sites mount. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
84 lines
2.7 KiB
Django/Jinja
84 lines
2.7 KiB
Django/Jinja
version: "3"
|
|
services:
|
|
server:
|
|
image: gitea/gitea:1
|
|
container_name: gitea
|
|
environment:
|
|
- USER_UID=1000
|
|
- USER_GID=1000
|
|
- GITEA__mailer__ENABLED=true
|
|
- GITEA__mailer__FROM=git@{{ email_domains.updates }}
|
|
- GITEA__mailer__PROTOCOL=smtps
|
|
- GITEA__mailer__SMTP_ADDR={{ smtp.host }}
|
|
- GITEA__mailer__SMTP_PORT=465
|
|
- GITEA__mailer__USER={{ smtp.username }}
|
|
- GITEA__mailer__PASSWD={{ vault_smtp.password }}
|
|
# Legacy OpenID 2.0 login let anyone register despite DISABLE_REGISTRATION. Logins go through Pocket ID.
|
|
- GITEA__openid__ENABLE_OPENID_SIGNIN=false
|
|
- GITEA__openid__ENABLE_OPENID_SIGNUP=false
|
|
restart: unless-stopped
|
|
labels:
|
|
mag37.dockcheck.update: true
|
|
volumes:
|
|
- gitea:/data
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
ports:
|
|
- 222:22
|
|
extra_hosts:
|
|
- '{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}'
|
|
- '{{ subdomains.git }}:{{ docker.hairpin_ip }}'
|
|
{% if lava_reserved | default(false) | bool %}
|
|
networks:
|
|
default:
|
|
ipv4_address: {{ docker.gitea_ip }}
|
|
{% endif %}
|
|
runner:
|
|
image: gitea/act_runner:nightly
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- server
|
|
environment:
|
|
- CONFIG_FILE=/config.yaml
|
|
- GITEA_INSTANCE_URL=http://gitea:3000
|
|
- GITEA_RUNNER_REGISTRATION_TOKEN={{ vault_infrastructure.gitea_runner_key }}
|
|
- GITEA_RUNNER_NAME=runner_1
|
|
- GITEA_RUNNER_LABELS=docker
|
|
extra_hosts:
|
|
- '{{ subdomains.git }}:{{ docker.hairpin_ip }}'
|
|
labels:
|
|
mag37.dockcheck.update: true
|
|
volumes:
|
|
- ./runner-config.yaml:/config.yaml
|
|
- ./data:/data
|
|
# No Docker socket: jobs run inside this container (label docker:host),
|
|
# and the socket would give every workflow root on the server.
|
|
# Image builds go to the rootless BuildKit below through its socket at
|
|
# /run/buildkit/buildkit/buildkitd.sock.
|
|
- buildkit-run:/run/buildkit
|
|
- {{ paths.stacks }}/caddy/site:/sites
|
|
buildkitd:
|
|
image: moby/buildkit:rootless
|
|
restart: unless-stopped
|
|
# Rootless BuildKit in an unprivileged container (see BuildKit's
|
|
# docs/rootless.md). It listens only on a unix socket shared with the runner.
|
|
command: ["--oci-worker-no-process-sandbox"]
|
|
security_opt:
|
|
- seccomp=unconfined
|
|
- apparmor=unconfined
|
|
extra_hosts:
|
|
- '{{ subdomains.git }}:{{ docker.hairpin_ip }}'
|
|
labels:
|
|
mag37.dockcheck.update: true
|
|
volumes:
|
|
- buildkit-run:/run/user/1000
|
|
- buildkit-cache:/home/user/.local/share/buildkit
|
|
volumes:
|
|
gitea:
|
|
driver: local
|
|
buildkit-run:
|
|
buildkit-cache:
|
|
networks:
|
|
default:
|
|
external: true
|
|
name: {{ docker.network_name }} |