# act_runner config. Mounted into the runner container at
# /data/config.yaml (CONFIG_FILE env var points here).
#
# Reference: https://docs.gitea.com/usage/actions/act-runner

log:
  level: info

runner:
  # Persisted registration credentials. Created on first successful
  # `register`; reused on subsequent starts.
  file: /data/.runner

  # Max parallel jobs this runner will accept.
  capacity: 2

  # Hard timeout per job — covers a wedged docker build, a hung ssh,
  # etc. 30m is generous for our deploy workflows (mostly seconds).
  timeout: 30m

  # Time given to a job to clean up after a SIGTERM before SIGKILL.
  shutdown_timeout: 1m

  # TLS verification when talking to gitea. KEEP true in prod.
  insecure: false

  # Polling cadence + per-poll HTTP timeout.
  fetch_timeout: 5s
  fetch_interval: 2s

cache:
  # Provides actions-cache-compatible storage for `actions/cache`.
  enabled: true
  dir: /data/cache

container:
  # Job containers join this docker network. Lets workflow steps
  # talk to other compose services (gitea itself, registries, etc.)
  # by container name.
  network: traefik-net

  privileged: false

  # Job containers' working dir is mounted under here on the host
  # (via the runner's docker.sock spawning). Kept on the runner's
  # /data volume so workspaces persist briefly between steps.
  workdir_parent: /data/workspace

  # Volumes a WORKFLOW may bind-mount into its job container. Keep tight.
  #
  # ⚠ This does NOT keep the docker daemon out of jobs, and reading it that
  # way is the mistake. act_runner mounts /var/run/docker.sock into every job
  # container on its own, independently of this list. Measured 2026-09-02: a
  # job running `docker:27-cli` is uid 0, sees all 49 containers on this host
  # via `docker ps`, and has `docker compose v2.33.0` on PATH.
  #
  # So every job on this runner has root-equivalent control of ana-docker —
  # which hosts gitea itself, synapse, phasefinal-web and adguardhome. It is
  # also LOAD-BEARING: vh/Worldtree, vh/soong-lab, vh/skaldsong and
  # vh/wt-matrix-bridge all drive buildx through that socket, so it cannot
  # simply be closed. Isolate sensitive work onto its own runner instead.
  valid_volumes: []

  force_pull: false

host:
  workdir_parent: /data/host-workspace