# CI/CD Runner

## Host

TODO: Should we have a dedicated runner server?

sls-vserv-bd-01-dev

## Setup

Resources:

 - https://docs.gitea.com/usage/actions/act-runner
 - https://linux.psi.ch/documentation/services/gitea/gitea-runner/

Register the runner: (by default the name is the machine name `sls-vserv-bd-hla01-dev.psi.ch`)
```
sudo su svcusr-sls2hla
mkdir ~/gitea-runner
cd ~/gitea-runner
/usr/local/bin/act_runner register --instance https://gitea.psi.ch/ --labels hla-dev --token <token> --no-interactive
```

This generates a `.runner` file.


Set up deployment dirs (not directly related to the gitea cicd runner setup)
```shell
mkdir /sls/bd/hla
chmod 755 /sls/bd/hla
...
```

Install Node -- required for actions like repo checkout
```
mkdir ~/.local/bin

cd /tmp
curl -LO https://nodejs.org/dist/v20.11.1/node-v20.11.1-linux-x64.tar.xz
tar -xf node-v20.11.1-linux-x64.tar.xz --strip-components=2 -C ~/.local/bin/ node-v20.11.1-linux-x64/bin/
rm node-v20.11.1-linux-x64.tar.xz
```

## Manually run the runner

```shell
sudo su svcusr-sls2hla
/usr/local/bin/act_runner daemon
```

## Run the runner as a systemd service

Edit the service file `/etc/systemd/system/act_runner.service`:

```toml
[Unit]
ConditionPathExists=/etc/act_runner/config.yaml
Description=Gitea Actions runner
Documentation=https://gitea.com/gitea/act_runner
After=podman.socket
Requires=podman.socket

[Service]
User=svcusr-sls2hla
WorkingDirectory=/home/svcusr-sls2hla/gitea-runner
ExecStart=/usr/local/bin/act_runner daemon --config /etc/act_runner/config.yaml
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=10
Restart=always

[Install]
WantedBy=multi-user.target
```

As your own user (not `svcusr-sls2hla`; need access to sudo):
```
# 1. Install Podman
sudo dnf install -y podman

# 2. Enable and start the system-wide Podman socket
sudo systemctl enable --now podman.socket

# 3. Create the symlink so the Gitea runner finds Podman at the expected Docker path
sudo ln -s /run/podman/podman.sock /var/run/docker.sock

# 4. Create podman group
sudo groupadd podman

# 5. Add service user to this new group
sudo usermod -aG podman svcusr-sls2hla
```

Configure podman socket:
```
sudo systemctl edit podman.socket
```
add this to the file:

```
[Socket]
SocketMode=0660
SocketGroup=podman
```

Enable and restart:

```
# Enable act_runner
sudo systemctl enable --now act_runner

# Reload configurations
sudo systemctl daemon-reload

# Restart the socket so it applies the new group owner
sudo systemctl restart podman.socket

# Fire up the runner
sudo systemctl restart act_runner.service
```

### Check logs of systemd service

```
sudo su svcusr-sls2hla
journalctl -u act_runner.service -n 20
```

Should show 

```
Jul 24 10:05:30 sls-vserv-bd-hla01-dev.psi.ch act_runner[3662214]: time="2026-07-24T10:05:30+02:00" level=info msg="Starting runner daemon"
Jul 24 10:05:30 sls-vserv-bd-hla01-dev.psi.ch act_runner[3662214]: time="2026-07-24T10:05:30+02:00" level=info msg="labels updated to: [hla-dev:host]"
Jul 24 10:05:30 sls-vserv-bd-hla01-dev.psi.ch act_runner[3662214]: time="2026-07-24T10:05:30+02:00" level=info msg="runner: sls-vserv-bd-hla01-dev.psi.ch, with version: v2.0.0, with labels: [hla-dev], declare successfully"
...
```

## User

The gitea actions run as user `svcusr-sls2hla`

## Auth

### #TODO: this is a temporary workaround
I created an ssh key on `sls-vserv-bd-hla01-dev` (where the runner runs), and added the public key to my
gitea profile ssh keys. That way the `svcusr` can clone the repos I can clone.