act-runner.yml

##### USER #####

- name: create act-runner user
  user:
    name: act-runner
    system: yes
    shell: '/bin/bash'
    comment: 'Gitea Actions runner'
    password: '*'
    home: /var/lib/act-runner
  register: gitea_act_runner_user

- name: update act-runner home directory ownership
  file:
    path: /var/lib/act-runner
    state: directory
    owner: act-runner
    group: act-runner
    recurse: yes
  when: ansible_local.gitea_act_runner.work_directory_ownership_migrated is not defined
  ignore_errors: "{{ ansible_check_mode }}"

##### PODMAN #####

- name: check if systemd/logind session lingering is enabled
  stat:
    path: "/var/lib/systemd/linger/act-runner"
  register: linger_file
  when: gitea_act_runner_container_engine == "podman"

- name: enable systemd/logind session lingering
  become: yes
  command:
    cmd: loginctl enable-linger act-runner
  when: (not linger_file.stat.exists) and (gitea_act_runner_container_engine == "podman")
  ignore_errors: "{{ ansible_check_mode }}"
  changed_when: yes

- name: set subuid/subgid mappings for act-runner user
  lineinfile:
    path: "{{ item }}"
    regexp: '^act-runner'
    line: 'act-runner:1000000:65536'
    owner: root
    group: root
    mode: "0644"
  when: gitea_act_runner_container_engine == "podman"
  with_items:
    - /etc/subuid
    - /etc/subgid

# this must be run once after subuid/subgid mappings are created
- name: run podman system migrate
  become: yes
  become_user: act-runner
  command:
    cmd: podman system migrate
  ignore_errors: "{{ ansible_check_mode }}"
  changed_when: yes
  when:
    - gitea_act_runner_container_engine == "podman"
    - ansible_local.gitea_act_runner.podman_system_migrated is not defined

# use sudo systemctl --user --machine act-runner@ list-units to list another user's services
- name: enable podman socket for the act-runner user
  become: yes
  become_user: act-runner
  systemd:
    name: podman.socket
    scope: user
    state: started
    enabled: yes
  ignore_errors: "{{ ansible_check_mode }}"
  when: gitea_act_runner_container_engine == "podman"
  register: gitea_act_runner_enable_podman_socket
  retries: 3
  delay: 3
  until: gitea_act_runner_enable_podman_socket is not failed

- name: configure nightly cleanup of unused podman data
  cron:
    user: act-runner
    cron_file: act-runner-podman-system-prune
    name: "cleanup unused podman data"
    minute: "30"
    hour: "03"
    day: "*"
    job: podman system prune --all --force | logger -t act-runner-podman-system-prune
    disabled: "{{ True if not gitea_act_runner_container_engine == 'podman' or not gitea_act_runner_daily_podman_prune else False }}"

##### ACT-RUNNER #####

- name: download act-runner binary
  get_url:
    url: "https://dl.gitea.com/act_runner/0.2.3/act_runner-0.2.3-linux-amd64"
    dest: "/root/act_runner-0.2.3-linux-amd64"
    owner: root
    group: root
    mode: "0640"

- name: install act-runner binary
  copy:
    src: "/root/act_runner-0.2.3-linux-amd64"
    dest: "/usr/local/bin/act-runner"
    mode: "0755"
    remote_src: yes
    owner: root
    group: root
  notify: restart act-runner
  when: not ansible_check_mode

- name: create act-runner configuration directory
  file:
    state: directory
    path: /etc/act-runner
    owner: root
    group: act-runner
    mode: "0770"
  ignore_errors: "{{ ansible_check_mode }}"

- name: copy act-runner configuration
  template:
    src: etc_act-runner_config.yaml.j2
    dest: /etc/act-runner/config.yaml
    owner: root
    group: act-runner
    mode: "0640"
  notify: restart act-runner
  ignore_errors: "{{ ansible_check_mode }}"

- name: copy CA certificates store file to act-runner configuration directory
  copy:
    remote_src: yes
    src: /etc/ssl/certs/ca-certificates.crt
    dest: /etc/act-runner/ca-certificates.crt
    owner: root
    group: act-runner
    mode: "0640"
  ignore_errors: "{{ ansible_check_mode }}"

##### SERVICES #####

- name: install act-runner systemd service/unit file
  template:
    src: "etc_systemd_system_act-runner.service.j2"
    dest: "/etc/systemd/system/act-runner.service"
    mode: "0644"
  notify:
    - reload systemd unit files
    - restart act-runner

# re-read systemd service configuration
- name: apply configuration (flush handlers)
  meta: flush_handlers

- name: enable/disable start/stop act-runner service
  systemd:
    name: act-runner
    enabled: "{{ gitea_act_runner_enable_service }}"
    state: "{{ 'started' if gitea_act_runner_enable_service else 'stopped' }}"
    daemon_reload: yes
  ignore_errors: "{{ ansible_check_mode }}"

##### RUNNER REGISTRATION #####

- name: check if runner registration file exists
  stat:
    path: /var/lib/act-runner/.runner
  register: runner_registration_file

- name: generate gitea actions runner token
  become: yes
  become_user: gitea
  delegate_to: "{{ gitea_act_runner_gitea_instance_hostname | default(inventory_hostname) }}"
  command:
    cmd: gitea --config /etc/gitea/app.ini actions generate-runner-token
  register: gitea_actions_generate_runner_token
  when: not runner_registration_file.stat.exists
  changed_when: yes
  ignore_errors: "{{ ansible_check_mode }}"

- name: register the runner on the gitea instance (if this fails, check host logs and ensure that the actions API is enabled on the gitea instance)
  become: yes
  become_user: act-runner
  shell:
    cmd: /usr/local/bin/act-runner --config /etc/act-runner/config.yaml register --no-interactive --instance https://{{ gitea_act_runner_gitea_instance_fqdn }} --token {{ gitea_actions_generate_runner_token.stdout }} 2>&1 | logger -t act-runner
    chdir: "/var/lib/act-runner"
  ignore_errors: "{{ ansible_check_mode }}"
  when: not runner_registration_file.stat.exists
  changed_when: yes
  timeout: 10
  notify: restart act-runner