runner (codeberg-ci-runner)

Purpose: the host-backend forgejo-runner daemon that long-polls Codeberg and runs jobs labelled con-ci. This is the live platform runner.

Deploys (manifests/components/runner/): a forgejo-runner Deployment + ServiceAccount in con-ci.

Key facts: - v12 connection model — forgejo-runner daemon --config /config/config.yml, where the config (server.connections, uuid+token, labels, capacity, job proxy env) comes from the SOPS secret forgejo-runner-conn. NO register, NO .runner (deprecated/broken on Codeberg). - Org-scope, one connection. Serves every org repo with Actions enabled + runs-on: con-ci. No per-repo tokens. Token is long-lived. - Host backend: jobs run in the runner pod's own filesystem — tools must be in the image or installed in-job. Cannot run container: images (that's runner-oci). - Non-root (uid 1000), caps dropped, seccomp RuntimeDefault. Daemon egress to Codeberg goes through the egress-proxy (HTTPS_PROXY pod env). - runner.capacity = simultaneous jobs (currently 5); host backend → those share the pod, so size pod limits (4 CPU / 4Gi) + the namespace quota accordingly.

Operate / gotchas: - Logs: kubectl -n con-ci logs deploy/forgejo-runner -f (jobs run in this pod). "declared successfully" + "[poller] launched" = healthy. - unauthenticated: unregistered runner → the uuid/token pair is stale/mismatched; re-enroll (matching uuid+token from one "Create new runner") and update the secret. - Replicas stay at 1 (a second replica with the same uuid conflicts). Scale via capacity.

Enroll / rotate: see onboarding.md.