homelab/k8s/infra/forgejo-runner/values.yaml

runner:
  image:
    repository: code.forgejo.org/forgejo/runner
    tag: "6"          # pin exact release before apply
  name: talos-runner
  labels: "docker:docker://node:22-bookworm"
  # In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
  # (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
  forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
  # tokenSecret: name of the K8s Secret that holds the runner registration token
  # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)
  tokenSecret: runner-token
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "2"
      memory: 4Gi

dind:
  image:
    repository: docker
    tag: "27-dind"    # pin exact release before apply
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "2"
      memory: 4Gi

persistence:
  reg:
    storageClass: longhorn  # Unified StorageClass (3 replicas)
    size: 1Gi               # .runner registration file + config — survives pod restarts
  dind:
    storageClass: longhorn  # Unified StorageClass (3 replicas)
    size: 30Gi              # docker layer cache — keeps rebuilds fast across restarts

tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule

# Pin to az-a (talos-cp-1) — sole Longhorn node; RWO PVCs (reg/dind cache) only
# attach there.
nodeSelector:
  topology.kubernetes.io/zone: az-a

# Egress exceptions. The NetworkPolicy denies the whole LAN /24 by default;
# this is the one address punched back through, because forgejo.riotpiao.com
# (the image registry) resolves to the ingress-nginx LoadBalancer.
# Must match the Cilium LB pool allocation — pool is 192.168.1.160/28.
egress:
  ingressLoadBalancerIP: 192.168.1.160