Episode 2: Forgejo Actions — runner, Docker sandbox, own registry, locked-down deploy

compose.yml

@@ -22,6 +22,7 @@ name: selfhostedops-stack
 
 networks:
   proxy:
+  ci:
   internal:
 
 volumes:
@@ -34,6 +35,9 @@ volumes:
   kuma_data:
   n8n_data:
   wg_data:
+  docker_certs:
+  dind_data:
+  runner_data:
 
 services:
   caddy:
@@ -53,7 +57,7 @@ services:
     networks: [proxy]
 
   forgejo:
-    image: codeberg.org/forgejo/forgejo:11
+    image: codeberg.org/forgejo/forgejo:16
     restart: unless-stopped
     environment:
       USER_UID: "1000"
@@ -63,6 +67,8 @@ services:
       FORGEJO__server__SSH_PORT: "2222"
       FORGEJO__service__DISABLE_REGISTRATION: "true"
       FORGEJO__openid__ENABLE_OPENID_SIGNIN: "false"
+      FORGEJO__actions__ENABLED: "true"
+      FORGEJO__repository__DEFAULT_REPO_UNITS: "repo.code,repo.issues,repo.pulls,repo.releases,repo.packages,repo.actions"
     ports:
       - "2222:22"       # git over SSH
     volumes:
@@ -163,3 +169,38 @@ services:
     volumes:
       - wg_data:/etc/wireguard
     networks: [proxy]
+
+  # --- CI (episode 2) -- start with: docker compose --profile ci up -d ---
+
+  docker-in-docker:
+    image: data.forgejo.org/oci/docker:dind
+    # The hostname MUST be "docker": the TLS certificates dind generates are
+    # only valid for that name. Rename it and you get a handshake error that
+    # reads like a network problem and is not one.
+    hostname: docker
+    profiles: [ci]
+    privileged: true
+    restart: unless-stopped
+    environment:
+      DOCKER_TLS_CERTDIR: /certs
+    volumes:
+      - docker_certs:/certs
+      - dind_data:/var/lib/docker
+    networks: [ci]
+
+  forgejo-runner:
+    image: data.forgejo.org/forgejo/runner:13.0.0
+    profiles: [ci]
+    restart: unless-stopped
+    depends_on: [docker-in-docker]
+    environment:
+      DOCKER_HOST: tcp://docker:2376
+      DOCKER_CERT_PATH: /certs/client
+      DOCKER_TLS_VERIFY: "1"
+    volumes:
+      - runner_data:/data
+      - docker_certs:/certs
+      - ./runner-config.yml:/data/config.yml:ro
+    networks: [ci, proxy]
+    command: forgejo-runner --config /data/config.yml daemon
+