Fix forgejo runner setup, prevent data wipe on re-run, add SSH key to Forgejo

- forgejo role: tasks no longer wipe data on subsequent runs (check for existing
  data before resetting)
- runner: use data.forgejo.org/forgejo/runner:12, register with --no-interactive,
  run as root for Docker socket access
- runner-config: proper generate-config format
- graham user: password hash in managed_users config
- SSH key added to Forgejo graham user
- direnv in base Debian packages

ansible/roles/forgejo/defaults/main.yml

@@ -1,5 +1,6 @@
 ---
 forgejo_version: "10"
+forgejo_runner_version: "12"
 forgejo_http_port: 3000
 forgejo_ssh_port: 2222
 forgejo_hostname: git.mcintire.me

ansible/roles/forgejo/tasks/main.yml

@@ -81,32 +81,18 @@
   changed_when: false
   failed_when: false
 
-- name: Stop and remove stale Forgejo container
+- name: Check if Forgejo data exists
+  ansible.builtin.stat:
+    path: "{{ forgejo_data_dir }}/data/gitea/conf/app.ini"
+  register: forgejo_data_exists
+
+- name: Start Forgejo if not running
   ansible.builtin.command:
-    cmd: docker compose down -v
+    cmd: docker compose up -d forgejo
     chdir: "{{ forgejo_data_dir }}"
-  when: "'forgejo' in forgejo_running.stdout_lines | default([])"
+  when: "'forgejo' not in forgejo_running.stdout_lines | default([])"
 
-- name: Clean Forgejo data for fresh install
-  ansible.builtin.file:
-    path: "{{ forgejo_data_dir }}/data"
-    state: absent
-
-- name: Recreate Forgejo data directory
-  ansible.builtin.file:
-    path: "{{ forgejo_data_dir }}"
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
-
-- name: Start Forgejo with INSTALL_LOCK
-  ansible.builtin.command:
-    cmd: docker compose up -d
-    chdir: "{{ forgejo_data_dir }}"
-  register: forgejo_started
-
-- name: Wait for Forgejo to be ready
+- name: Wait for Forgejo web UI
   ansible.builtin.uri:
     url: http://127.0.0.1:3000/
     method: GET
@@ -125,7 +111,7 @@
   register: admin_check
   changed_when: false
 
-- name: Create admin user via docker exec
+- name: Create admin user
   ansible.builtin.command:
     cmd: >
       docker exec -u git -w /data/gitea forgejo forgejo admin user create
@@ -134,12 +120,59 @@
       --password {{ forgejo_admin_password }}
       --email {{ forgejo_admin_email }}
       --admin
-  when: admin_check.status == 404
+  when:
+    - forgejo_data_exists.stat.exists
+    - admin_check.status == 404
   no_log: true
 
-- name: Verify admin user exists
-  ansible.builtin.uri:
-    url: http://127.0.0.1:3000/api/v1/users/{{ forgejo_admin_user }}
-    method: GET
-    status_code: 200
+- name: Create runner data directory
+  ansible.builtin.file:
+    path: "{{ forgejo_data_dir }}/runner"
+    state: directory
+    owner: "1000"
+    group: "1000"
+    mode: '0755'
+
+- name: Deploy runner config
+  ansible.builtin.template:
+    src: runner-config.yaml.j2
+    dest: "{{ forgejo_data_dir }}/runner/config.yaml"
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: Check if runner is registered
+  ansible.builtin.stat:
+    path: "{{ forgejo_data_dir }}/runner/.runner"
+  register: runner_registered
+
+- name: Generate runner token
+  ansible.builtin.command:
+    cmd: >
+      docker exec -u git -w /data/gitea forgejo forgejo actions generate-runner-token --config /data/gitea/conf/app.ini
+  register: runner_token
   changed_when: false
+  when: not runner_registered.stat.exists
+
+- name: Register runner
+  ansible.builtin.command:
+    cmd: >
+      docker run --rm
+      -v {{ forgejo_data_dir }}/runner:/data
+      -v /var/run/docker.sock:/var/run/docker.sock
+      --network forgejo_forgejo
+      data.forgejo.org/forgejo/runner:{{ forgejo_runner_version }}
+      forgejo-runner register
+      --no-interactive
+      --instance http://forgejo:3000
+      --token {{ runner_token.stdout }}
+      --name "forgejo-runner-{{ ansible_hostname }}"
+      --labels "ubuntu-latest:docker://node:20-bookworm,ubuntu-22.04:docker://node:20-bookworm,ubuntu-24.04:docker://node:20-bookworm"
+  when: not runner_registered.stat.exists
+
+- name: Start runner
+  ansible.builtin.command:
+    cmd: docker compose up -d runner
+    chdir: "{{ forgejo_data_dir }}"
+  register: runner_started
+  changed_when: "'Starting' in runner_started.stdout or 'Creating' in runner_started.stdout"

ansible/roles/forgejo/templates/docker-compose.yml.j2

@@ -30,5 +30,21 @@ services:
       timeout: 5s
       retries: 10
 
+  runner:
+    image: data.forgejo.org/forgejo/runner:{{ forgejo_runner_version }}
+    container_name: forgejo-runner
+    restart: unless-stopped
+    depends_on:
+      forgejo:
+        condition: service_healthy
+    networks:
+      - forgejo
+    user: "0:0"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - {{ forgejo_data_dir }}/runner:/data
+    command: ["forgejo-runner", "daemon", "--config", "/data/config.yaml"]
+    working_dir: /data
+
 networks:
   forgejo:

ansible/roles/forgejo/templates/runner-config.yaml.j2

@@ -0,0 +1,18 @@
+log:
+  level: info
+
+runner:
+  file: .runner
+  capacity: 2
+  labels:
+    - "ubuntu-latest:docker://node:20-bookworm"
+    - "ubuntu-22.04:docker://node:20-bookworm"
+    - "ubuntu-24.04:docker://node:20-bookworm"
+
+cache:
+  enabled: true
+
+container:
+  network: ""
+  privileged: false
+  docker_host: automount

ansible/roles/forgejo/templates/runner.yaml.j2

@@ -0,0 +1,10 @@
+log:
+  level: info
+
+runner:
+  file: /data/runner/.runner
+  capacity: 2
+  labels:
+    - "ubuntu-latest:docker://node:20-bookworm"
+    - "ubuntu-22.04:docker://node:20-bookworm"
+    - "ubuntu-24.04:docker://node:20-bookworm"