feat(homelab): isolate PR runner and add Paperless

.gitea/runner/setup-pr-runner.sh

@@ -1,16 +1,32 @@
 #!/usr/bin/env bash
-# Install a native runner for untrusted PR jobs without Docker access.
+# Install the containerized runner service for untrusted PR jobs.
 set -euo pipefail
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 [ "$(id -u)" -eq 0 ] || { echo 'Run with sudo on the runner host' >&2; exit 1; }
-for tool in cp cut date getent id install runuser systemctl useradd; do
+for tool in cp cut date docker getent id install runuser systemctl useradd; do
   command -v "$tool" >/dev/null || { echo "Install missing prerequisite: $tool" >&2; exit 1; }
 done
+docker info >/dev/null || {
+  echo 'Start Docker Engine before installing the PR runner' >&2
+  exit 1
+}
 command -v /usr/local/bin/gitea-runner >/dev/null || {
   echo 'Install gitea-runner 3.0.2 at /usr/local/bin/gitea-runner first' >&2
   exit 1
 }
+runner_version_output="$(/usr/local/bin/gitea-runner --version 2>&1)" || {
+  echo 'Cannot read the installed gitea-runner version' >&2
+  exit 1
+}
+if [[ ! "$runner_version_output" =~ (^|[[:space:]])v?3\.0\.2($|[[:space:]]) ]]; then
+  printf 'Expected gitea-runner 3.0.2; found: %s\n' "$runner_version_output" >&2
+  exit 1
+fi
 
+getent group docker >/dev/null || {
+  echo 'Install Docker Engine first; the docker group is missing' >&2
+  exit 1
+}
 id gitea-pr-runner >/dev/null 2>&1 || \
   useradd --system --create-home --home-dir /var/lib/gitea-pr-runner --shell /usr/bin/bash gitea-pr-runner
 runner_home="$(getent passwd gitea-pr-runner | cut -d: -f6)"
@@ -20,7 +36,7 @@ runner_home="$(getent passwd gitea-pr-runner | cut -d: -f6)"
 }
 case " $(id -nG gitea-pr-runner) " in
   *' docker '*)
-    echo 'The PR runner account must not belong to the docker group' >&2
+    echo 'Remove gitea-pr-runner from the docker group; only the systemd service gets Docker access' >&2
     exit 1
     ;;
 esac
@@ -44,7 +60,7 @@ if [ ! -f /var/lib/gitea-pr-runner/.runner ]; then
     --config /etc/gitea-pr-runner/config.yaml \
     --instance https://gitea.forust.xyz \
     --name homelab-pr \
-    --labels homelab-pr:host \
+    --labels 'homelab-pr:docker://docker.gitea.com/runner-images:ubuntu-24.04-v26.09.01' \
     --no-interactive
   unset GITEA_RUNNER_REGISTRATION_TOKEN
 fi