thermograph/infra/deploy/forgejo/runner-vps2/config.yaml

# Forgejo Actions runner config for the vps2 runner. Mounted at /data/config.yaml
# by runner-vps2/docker-compose.yml.
#
# Values that differ from `forgejo-runner generate-config` defaults are the only
# ones written out below; everything else is left at its default deliberately, so
# a future runner upgrade inherits new defaults instead of a frozen copy of the
# old ones.

log:
  level: info
  job_level: info

runner:
  file: .runner

  # ONE job at a time. The desktop runner uses capacity 8, which is right for a
  # box whose whole job is CI. This runner shares a host with prod, so the
  # binding constraint is not throughput, it is that a CI burst must never be
  # able to contend with thermograph_web for CPU. One job at a time also makes
  # the resource ceiling below exact rather than a per-job estimate multiplied
  # by an unknown.
  capacity: 1

  timeout: 3h
  shutdown_timeout: 3h

container:
  # 1) --add-host: both Forgejo names resolve publicly to vps1, but vps1's
  #    Caddy rejects the /v2/* registry API from off-mesh. Job containers that
  #    docker-pull or docker-push therefore need the MESH address, and DNS will
  #    not give it to them. Same line the desktop runner carries; the value is
  #    the same from vps2 because both boxes are on 10.10.0.0/24.
  #
  #    BOTH names are pinned, and that is not belt-and-braces. dev.jinemi.com is
  #    the registry host in image names AND Forgejo's ROOT_URL, from which the
  #    registry's bearer-token realm is derived -- so a pull needs it twice over.
  #    git.thermograph.org stays pinned because already-pushed tags carry it as
  #    their prefix; unpinned, a rollback to such a tag takes the public route
  #    and gets a 403 that reads like a credential failure. See
  #    ../README.md, "Migrating the domain".
  #
  # 2) --cpus/--memory: vps2 runs prod. Without a ceiling a runaway job (a
  #    `docker build` that fans out, a test that leaks) competes with the
  #    production app for the same 6 cores. These bound the JOB container, which
  #    is a sibling of the runner rather than its child, so the runner's own
  #    compose limits do not cover it -- this is the only lever that does.
  options: --add-host=dev.jinemi.com:10.10.0.2 --add-host=git.thermograph.org:10.10.0.2 --cpus=2 --memory=4g

  # Jobs may mount NOTHING from the host. The workflows here do not need to:
  # they check out into the job container's own workspace and reach the estate
  # over SSH. An empty list is the difference between "a job can read
  # /etc/thermograph.env" and "a job cannot", on the box where that file is
  # prod's.
  valid_volumes: []

  privileged: false

  # Mounts the host docker socket into the job container. build-push.yml runs
  # `docker build`, so it needs a daemon; this points it at vps2's. See the
  # README for what that does and does not mean for trust.
  docker_host: "automount"