73 lines
2.9 KiB
Bash
Executable File
73 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install the containerized runner service for untrusted PR jobs.
|
|
set -euo pipefail
|
|
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
[ "$(id -u)" -eq 0 ] || { echo 'Run with sudo on the runner host' >&2; exit 1; }
|
|
for tool in cp cut date docker getent id install runuser systemctl useradd; do
|
|
command -v "$tool" >/dev/null || { echo "Install missing prerequisite: $tool" >&2; exit 1; }
|
|
done
|
|
docker info >/dev/null || {
|
|
echo 'Start Docker Engine before installing the PR runner' >&2
|
|
exit 1
|
|
}
|
|
command -v /usr/local/bin/gitea-runner >/dev/null || {
|
|
echo 'Install gitea-runner 3.0.2 at /usr/local/bin/gitea-runner first' >&2
|
|
exit 1
|
|
}
|
|
runner_version_output="$(/usr/local/bin/gitea-runner --version 2>&1)" || {
|
|
echo 'Cannot read the installed gitea-runner version' >&2
|
|
exit 1
|
|
}
|
|
if [[ ! "$runner_version_output" =~ (^|[[:space:]])v?3\.0\.2($|[[:space:]]) ]]; then
|
|
printf 'Expected gitea-runner 3.0.2; found: %s\n' "$runner_version_output" >&2
|
|
exit 1
|
|
fi
|
|
|
|
getent group docker >/dev/null || {
|
|
echo 'Install Docker Engine first; the docker group is missing' >&2
|
|
exit 1
|
|
}
|
|
id gitea-pr-runner >/dev/null 2>&1 || \
|
|
useradd --system --create-home --home-dir /var/lib/gitea-pr-runner --shell /usr/bin/bash gitea-pr-runner
|
|
runner_home="$(getent passwd gitea-pr-runner | cut -d: -f6)"
|
|
[ "$runner_home" = /var/lib/gitea-pr-runner ] || {
|
|
echo 'Unexpected PR runner home; inspect the existing service first' >&2
|
|
exit 1
|
|
}
|
|
case " $(id -nG gitea-pr-runner) " in
|
|
*' docker '*)
|
|
echo 'Remove gitea-pr-runner from the docker group; only the systemd service gets Docker access' >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
install -d -m 0755 /etc/gitea-pr-runner
|
|
stamp="$(date -u +%Y%m%dT%H%M%SZ)"
|
|
for existing in /etc/gitea-pr-runner/config.yaml /etc/systemd/system/gitea-pr-runner.service; do
|
|
[ ! -f "$existing" ] || cp -p "$existing" "$existing.before-$stamp"
|
|
done
|
|
install -m 0644 "$here/pr-config.yaml" /etc/gitea-pr-runner/config.yaml
|
|
install -m 0644 "$here/pr-runner.service" /etc/systemd/system/gitea-pr-runner.service
|
|
|
|
if [ ! -f /var/lib/gitea-pr-runner/.runner ]; then
|
|
read -r -s -p 'Enter the Gitea repository runner registration token: ' runner_token
|
|
printf '\n'
|
|
[ -n "$runner_token" ] || { echo 'Runner token is required' >&2; exit 1; }
|
|
export GITEA_RUNNER_REGISTRATION_TOKEN="$runner_token"
|
|
unset runner_token
|
|
runuser --preserve-environment -u gitea-pr-runner -- \
|
|
/usr/local/bin/gitea-runner register \
|
|
--config /etc/gitea-pr-runner/config.yaml \
|
|
--instance https://gitea.forust.xyz \
|
|
--name homelab-pr \
|
|
--labels 'homelab-pr:docker://docker.gitea.com/runner-images:ubuntu-24.04-v26.09.01' \
|
|
--no-interactive
|
|
unset GITEA_RUNNER_REGISTRATION_TOKEN
|
|
fi
|
|
chmod 0600 /var/lib/gitea-pr-runner/.runner
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now gitea-pr-runner.service
|
|
systemctl restart gitea-pr-runner.service
|
|
echo "PR runner ready. Configuration backups: *.before-$stamp"
|