apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: gitea-runner
  namespace: gitea-runners
  labels:
    app.kubernetes.io/name: gitea-runner
    app.kubernetes.io/part-of: gitea-actions
spec:
  serviceName: gitea-runner
  replicas: 5
  podManagementPolicy: Parallel
  selector:
    matchLabels:
      app.kubernetes.io/name: gitea-runner
  template:
    metadata:
      labels:
        app.kubernetes.io/name: gitea-runner
        app.kubernetes.io/part-of: gitea-actions
      annotations:
        hectic-lab.com/security-note: "Privileged rootful DinD is limited to trusted internal Gitea workflows only. Do not enable untrusted fork or PR jobs for this pool."
    spec:
      serviceAccountName: gitea-runner
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 60
      securityContext:
        fsGroup: 1000
      containers:
        - name: runner
          image: gitea/act_runner:0.2.11
          imagePullPolicy: IfNotPresent
          env:
            - name: GITEA_INSTANCE_URL
              value: https://gitea.hectic-lab.com
            - name: GITEA_RUNNER_REGISTRATION_TOKEN_FILE
              value: /runner-secrets/token
            - name: CONFIG_FILE
              value: /runner-config/config.yaml
            - name: DOCKER_HOST
              value: unix:///runner-docker/docker.sock
          ports:
            - name: cache
              containerPort: 8088
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
          livenessProbe:
            exec:
              command:
                - /bin/sh
                - -ec
                - test -s /data/.runner && test -S /runner-docker/docker.sock
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 6
          readinessProbe:
            exec:
              command:
                - /bin/sh
                - -ec
                - test -S /runner-docker/docker.sock
            initialDelaySeconds: 15
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 6
          volumeMounts:
            - name: data
              mountPath: /data
            - name: config
              mountPath: /runner-config
              readOnly: true
            - name: runner-token
              mountPath: /runner-secrets
              readOnly: true
            - name: docker-socket
              mountPath: /runner-docker
        - name: docker
          image: docker:27-dind
          imagePullPolicy: IfNotPresent
          args:
            - --host=unix:///runner-docker/docker.sock
            - --storage-driver=overlay2
            - --tls=false
          env:
            - name: DOCKER_TLS_CERTDIR
              value: ""
            - name: DOCKER_HOST
              value: unix:///runner-docker/docker.sock
          securityContext:
            # Privileged rootful DinD is intentionally scoped to this trusted
            # internal runner pool; never expose it to untrusted fork/PR jobs.
            privileged: true
          resources:
            requests:
              cpu: 500m
              memory: 1Gi
            limits:
              cpu: "2"
              memory: 4Gi
          livenessProbe:
            exec:
              command:
                - docker
                - info
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 6
          readinessProbe:
            exec:
              command:
                - docker
                - info
            initialDelaySeconds: 20
            periodSeconds: 10
            timeoutSeconds: 10
            failureThreshold: 6
          volumeMounts:
            - name: docker-socket
              mountPath: /runner-docker
            - name: docker-graph
              mountPath: /var/lib/docker
      volumes:
        - name: config
          configMap:
            name: gitea-runner-config
        - name: runner-token
          secret:
            secretName: gitea-runner-token
            items:
              - key: token
                path: token
            defaultMode: 0400
        - name: docker-socket
          emptyDir: {}
        - name: docker-graph
          emptyDir: {}
  volumeClaimTemplates:
    - metadata:
        name: data
        labels:
          app.kubernetes.io/name: gitea-runner
          app.kubernetes.io/part-of: gitea-actions
      spec:
        accessModes:
          - ReadWriteOnce
        storageClassName: hcloud-volumes
        resources:
          requests:
            storage: 20Gi