homelab/k8s/infra/forgejo-runner/values.yaml

runner:
  image:
    repository: code.forgejo.org/forgejo/runner
    tag: "6"          # pin exact release before apply
  name: golang-runner
  # Default image is only used when a job's `container:` doesn't override it
  # (both ci.yaml and build.yaml in homelab-frontend do). Retired the old
  # "docker" label entirely; every repo this runner serves is Go, so this
  # instance carries the golang toolchain and its own dind sidecar builds and
  # pushes that repo's images too -- there is no separate generic runner
  # anymore.
  labels: "golang:docker://golang:1.26-bookworm"
  # In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
  # (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
  forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
  # tokenSecret: name of the K8s Secret that holds the runner registration token
  # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)
  tokenSecret: runner-token
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "2"
      memory: 4Gi

dind:
  image:
    repository: docker
    tag: "27-dind"    # pin exact release before apply
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "2"
      memory: 4Gi

persistence:
  reg:
    storageClass: longhorn  # Unified StorageClass (3 replicas)
    size: 20Gi              # .runner registration file + action tool cache + actcache artifacts
  dind:
    storageClass: longhorn  # Unified StorageClass (3 replicas)
    size: 30Gi              # docker layer cache — keeps rebuilds fast across restarts

tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule

# Pin to az-b (talos-cp-2) — more Longhorn storage than az-a (worker-1 over-provisioned).
# RWO PVCs will recreate on talos-cp-2 when nodeSelector changes.
nodeSelector:
  topology.kubernetes.io/zone: az-b

# GC CronJob — prunes Docker images/volumes/build-cache and actcache across
# ALL forgejo-runner pods. Only enable in default values (golang instance);
# disable in per-runner overrides so it renders once.
gc:
  enabled: true
  schedule: "0 3 * * *"        # daily 03:00 UTC
  image: alpine/k8s:1.31.0
  pruneAge: "72h"              # Docker artifacts unused longer than this get pruned
  pruneAgeHours: 72             # Same as pruneAge but numeric for date arithmetic in shell
  actcacheMaxAgeDays: 1        # actcache files older than N days (aggressive for heavy Rust cargo builds)