feat: add system-wide forgejo runner

jobs/jobspecs/forgejo-runner.hcl

@@ -0,0 +1,102 @@
+job "forgejo-runner" {
+  datacenters = ["dc1"]
+  namespace   = "default"
+  type        = "service"
+
+  group "runner" {
+    count = 1
+
+    volume "juicefs" {
+      type      = "host"
+      source    = "juicefs"
+      read_only = false
+    }
+
+    task "runner" {
+      driver = "podman"
+      user   = "root"
+
+      config {
+        image        = "data.forgejo.org/forgejo/runner:12"
+        command      = "/bin/sh"
+        args         = ["-c", "${NOMAD_TASK_DIR}/start.sh"]
+        network_mode = "host"
+        volumes = [
+          "/var/run/docker.sock:/var/run/docker.sock",
+        ]
+      }
+
+      volume_mount {
+        volume      = "juicefs"
+        destination = "/mnt/juicefs"
+        read_only   = false
+      }
+
+      template {
+        destination = "${NOMAD_SECRETS_DIR}/env.vars"
+        env         = true
+        data        = <<EOF
+{{ with nomadVar "nomad/jobs/forgejo-runner" -}}
+RUNNER_TOKEN={{ .registration_token }}
+{{- end }}
+{{ range nomadService "forgejo" -}}
+FORGEJO_URL=http://{{ .Address }}:{{ .Port }}
+{{- end }}
+EOF
+      }
+
+      template {
+        destination = "${NOMAD_TASK_DIR}/config.yaml"
+        data        = <<EOF
+log:
+  level: info
+
+runner:
+  file: /mnt/juicefs/forgejo-runner/.runner
+  capacity: 3
+  timeout: 3h
+  insecure: true
+  fetch_timeout: 5s
+  fetch_interval: 2s
+
+cache:
+  enabled: false
+
+container:
+  network: host
+  docker_host: unix:///var/run/docker.sock
+  valid_volumes:
+    - "**"
+EOF
+      }
+
+      template {
+        destination = "${NOMAD_TASK_DIR}/start.sh"
+        perms       = "755"
+        data        = <<EOF
+#!/bin/sh
+set -e
+
+mkdir -p /mnt/juicefs/forgejo-runner
+
+if [ ! -f /mnt/juicefs/forgejo-runner/.runner ]; then
+  forgejo-runner register \
+    --no-interactive \
+    --instance "$FORGEJO_URL" \
+    --token "$RUNNER_TOKEN" \
+    --name "ncm-runner" \
+    --labels "ubuntu-latest:docker://ubuntu:24.04,ubuntu-22.04:docker://ubuntu:22.04,ubuntu-20.04:docker://ubuntu:20.04" \
+    --config {{ env "NOMAD_TASK_DIR" }}/config.yaml
+fi
+
+exec forgejo-runner daemon --config {{ env "NOMAD_TASK_DIR" }}/config.yaml
+EOF
+      }
+
+      resources {
+        cpu    = 256
+        memory = 256
+      }
+    }
+  }
+}

jobs/main.tf

@@ -400,6 +400,19 @@ resource "nomad_job" "forgejo" {
   depends_on = [nomad_variable.forgejo]
 }
 
+resource "nomad_variable" "forgejo_runner" {
+  path      = "nomad/jobs/forgejo-runner"
+  namespace = nomad_namespace.default.name
+  items = {
+    registration_token = var.forgejo_runner_token
+  }
+}
+
+resource "nomad_job" "forgejo_runner" {
+  jobspec    = file("jobspecs/forgejo-runner.hcl")
+  depends_on = [nomad_variable.forgejo_runner]
+}
+
 #####################################################################################################################
 # ACL Policies
 #####################################################################################################################

jobs/variables.tf

@@ -264,6 +264,12 @@ variable "weride_map_tiler_key" {
 
 # Forgejo
 # B2 keys are not declared here — they come from deploy module outputs via terraform_remote_state.
+
+variable "forgejo_runner_token" {
+  type        = string
+  description = "Forgejo system runner registration token — obtain from https://code.adriano.fyi/-/admin/runners"
+  sensitive   = true
+}
 # /Forgejo