infra/ansible/roles/forgejo/tasks/main.yml

---
- name: Install prerequisites
  ansible.builtin.apt:
    name:
      - ca-certificates
      - curl
      - gnupg
      - apt-transport-https
    state: present
    update_cache: true

- name: Check if Docker is installed
  ansible.builtin.command: which docker
  register: docker_installed
  changed_when: false
  failed_when: false

- name: Add Docker GPG key
  ansible.builtin.get_url:
    url: https://download.docker.com/linux/debian/gpg
    dest: /usr/share/keyrings/docker-archive-keyring.asc
    mode: '0644'
  when: docker_installed.rc != 0

- name: Add Docker repository
  ansible.builtin.deb822_repository:
    name: docker
    types: deb
    uris: https://download.docker.com/linux/debian
    suites: "{{ ansible_facts['distribution_release'] }}"
    components: stable
    architectures: "{{ ansible_facts['architecture'] | replace('x86_64', 'amd64') }}"
    signed_by: /usr/share/keyrings/docker-archive-keyring.asc
    state: present
  when: docker_installed.rc != 0

- name: Install Docker packages
  ansible.builtin.apt:
    name:
      - docker-ce
      - docker-ce-cli
      - containerd.io
      - docker-compose-plugin
    state: present
    update_cache: true
  when: docker_installed.rc != 0

- name: Ensure Docker service is started and enabled
  ansible.builtin.systemd:
    name: docker
    state: started
    enabled: true

- name: Add ansible user to docker group
  ansible.builtin.user:
    name: ansible
    groups: docker
    append: true

- name: Create Forgejo data directory
  ansible.builtin.file:
    path: "{{ forgejo_data_dir }}"
    state: directory
    owner: root
    group: root
    mode: '0755'

- name: Deploy docker-compose.yml
  ansible.builtin.template:
    src: docker-compose.yml.j2
    dest: "{{ forgejo_data_dir }}/docker-compose.yml"
    owner: root
    group: root
    mode: '0644'

- name: Check if Forgejo is running
  ansible.builtin.command:
    cmd: docker compose ps --services --filter "status=running"
    chdir: "{{ forgejo_data_dir }}"
  register: forgejo_running
  changed_when: false
  failed_when: false

- name: Check if Forgejo data exists
  ansible.builtin.stat:
    path: "{{ forgejo_data_dir }}/data/gitea/conf/app.ini"
  register: forgejo_data_exists

- name: Start Forgejo if not running
  ansible.builtin.command:
    cmd: docker compose up -d forgejo
    chdir: "{{ forgejo_data_dir }}"
  when: "'forgejo' not in forgejo_running.stdout_lines | default([])"

- name: Wait for Forgejo web UI
  ansible.builtin.uri:
    url: http://127.0.0.1:3000/
    method: GET
    status_code: 200
  register: web_ready
  retries: 30
  delay: 2
  until: web_ready.status == 200
  changed_when: false

- name: Create admin user (first deploy only)
  ansible.builtin.command:
    cmd: >
      docker exec -u git -w /data/gitea forgejo forgejo admin user create
      --config /data/gitea/conf/app.ini
      --username {{ forgejo_admin_user }}
      --password {{ forgejo_admin_password }}
      --email {{ forgejo_admin_email }}
      --admin
  when: not forgejo_data_exists.stat.exists
  no_log: true

- name: Create runner data directory
  ansible.builtin.file:
    path: "{{ forgejo_data_dir }}/runner"
    state: directory
    owner: "1000"
    group: "1000"
    mode: '0755'

- name: Deploy runner config
  ansible.builtin.template:
    src: runner-config.yaml.j2
    dest: "{{ forgejo_data_dir }}/runner/config.yaml"
    owner: root
    group: root
    mode: '0644'

- name: Check if runner is registered
  ansible.builtin.stat:
    path: "{{ forgejo_data_dir }}/runner/.runner"
  register: runner_registered

- name: Generate runner token
  ansible.builtin.command:
    cmd: >
      docker exec -u git -w /data/gitea forgejo forgejo actions generate-runner-token --config /data/gitea/conf/app.ini
  register: runner_token
  changed_when: false
  when: not runner_registered.stat.exists

- name: Register runner
  ansible.builtin.command:
    cmd: >
      docker run --rm
      -v {{ forgejo_data_dir }}/runner:/data
      -v /var/run/docker.sock:/var/run/docker.sock
      --network forgejo_forgejo
      data.forgejo.org/forgejo/runner:{{ forgejo_runner_version }}
      forgejo-runner register
      --no-interactive
      --instance http://forgejo:3000
      --token {{ runner_token.stdout }}
      --name "forgejo-runner-{{ ansible_hostname }}"
      --labels "ubuntu-latest:docker://node:20-bookworm,ubuntu-22.04:docker://node:20-bookworm,ubuntu-24.04:docker://node:20-bookworm"
  when: not runner_registered.stat.exists

- name: Start runner
  ansible.builtin.command:
    cmd: docker compose up -d runner
    chdir: "{{ forgejo_data_dir }}"
  register: runner_started
  changed_when: "'Starting' in runner_started.stdout or 'Creating' in runner_started.stdout"

- name: Deploy registry cleanup script
  ansible.builtin.template:
    src: cleanup-registry.sh.j2
    dest: "{{ forgejo_data_dir }}/cleanup-registry.sh"
    owner: root
    group: root
    mode: '0755'

- name: Schedule registry cleanup cron job
  ansible.builtin.cron:
    name: forgejo-registry-cleanup
    job: "{{ forgejo_data_dir }}/cleanup-registry.sh >/dev/null 2>&1"
    hour: "*/6"
    minute: "0"