route runner build container clones via public URL with CF Access (#7)

servers/legion/k8s/gitea-runner/external-secrets.yaml

@@ -1,12 +1,20 @@
 ---
 # gitea-runner-secret — neural-platform org runner token
+#
+# GITEA_INSTANCE_URL stays as the in-cluster URL — the act_runner daemon
+# polls it constantly and we don't want every poll to hit Cloudflare Access.
+# Build containers, however, need the public URL because they run with
+# network: host and can't resolve gitea.git.svc.cluster.local. The
+# git-cf-access-init.sh entrypoint in the ci-base image rewrites the
+# in-cluster URL to https://git.neuralplatform.ai with the CF Access
+# headers from CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET below.
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: gitea-runner-secret
   namespace: ci
   annotations:
-    force-sync: "2026-04-23"
+    force-sync: "2026-05-04-cf-access"
 spec:
   refreshInterval: 1h
   secretStoreRef:
@@ -19,11 +27,21 @@ spec:
       data:
         GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
         GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
+        CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
+        CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
   data:
     - secretKey: runner_token
       remoteRef:
         key: secret/data/gitea
         property: runner_token
+    - secretKey: cf_access_client_id
+      remoteRef:
+        key: secret/data/gitea-runner-cf-access
+        property: client_id
+    - secretKey: cf_access_client_secret
+      remoteRef:
+        key: secret/data/gitea-runner-cf-access
+        property: client_secret
 ---
 # neuron-technologies-runner-secret — neuron-technologies org runner token
 apiVersion: external-secrets.io/v1beta1
@@ -31,6 +49,8 @@ kind: ExternalSecret
 metadata:
   name: neuron-technologies-runner-secret
   namespace: ci
+  annotations:
+    force-sync: "2026-05-04-cf-access"
 spec:
   refreshInterval: 1h
   secretStoreRef:
@@ -43,8 +63,18 @@ spec:
       data:
         GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
         GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
+        CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
+        CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
   data:
     - secretKey: runner_token
       remoteRef:
         key: secret/data/gitea
         property: neuron_technologies_runner_token
+    - secretKey: cf_access_client_id
+      remoteRef:
+        key: secret/data/gitea-runner-cf-access
+        property: client_id
+    - secretKey: cf_access_client_secret
+      remoteRef:
+        key: secret/data/gitea-runner-cf-access
+        property: client_secret