1 - Forgejo runner infrastructure specification
Purpose
Describe the Forgejo Actions runner VM and deployment scaffold owned by
infra/forgejo_runner. Its tf_setup and ansible packages are stages of
this owner. The runner role is commented out in the baseline playbook;
the checked-in configuration therefore does not establish a deployed or
registered Actions worker. No live runner state was observed.
Baseline revision: 550d7e79b1f5fdbc2b6017b75178471d6914082f.
Observed: 2026-09-08. Sources:
owner README,
BUILD, and the implementation
links below.
Requirements
Requirement: Dedicated runner VM allocation
Setup SHALL declare runner1 as Proxmox VM 1200 in the
src_infra_forgejo_runner pool, with eight cores, 16 GiB memory, a 20 GiB
boot disk, and a 300 GiB runner disk on ceph-ec storage. Its hostname and
address SHALL derive from the owner’s DNS declaration.
Source: VM definition.
Scenario: Inspect the runner capacity definition
- WHEN a maintainer evaluates the runner VM configuration
- THEN the source declares the dedicated runner pool, compute allocation, and separate boot and runner disks
- AND DNS source supplies the hostname and address
Requirement: Explicit host-only deployment baseline
The baseline deployment playbook SHALL apply the shared host role to the
forgejo_runner inventory group. The specification MUST identify the
commented-out Forgejo runner role as inactive and MUST NOT interpret the
available runner variables as evidence that the worker is installed or
registered.
Sources: deployment playbook and runner variables.
Scenario: Determine the effect of the current playbook
- WHEN the current playbook’s active roles are inspected
- THEN only the shared host role is enabled
- AND runner installation and registration remain outside the behavior established by this source baseline
Requirement: Packaged setup and deployment configuration
The owner SHALL expose Terraform setup and packaged Ansible entry points
through its al configuration and Vault injection dependencies. The runner
configuration SHALL reference https://git.alwaldend.com, /dev/sdb, and
an environment-supplied FORGEJO_RUNNER_TOKEN rather than a checked-in
registration token.
Sources: setup BUILD, Ansible BUILD, and runner variables.
Scenario: Resolve the registration credential source
- WHEN a maintainer inspects the runner configuration scaffold
- THEN its token value is an environment lookup and its instance URL is the canonical Forgejo service
- AND the token reference alone does not enable the inactive runner role