From 5bd770287425e9ea3cfa601312eab474e1fde7ae Mon Sep 17 00:00:00 2001
From: Will Anderson <andersonwilliam85@gmail.com>
Date: Tue, 24 Mar 2026 12:51:22 -0500
Subject: [PATCH] Add Gitea act-runner and fix ddclient deployment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- gitea-runner.tf: Secret for Gitea runner registration token
- apps/gitea-runner.yaml: Gitea act-runner deployment (init container
  registers with Gitea, main container runs daemon) — serves all Gitea
  Actions CI jobs on self-hosted,linux,x64,legion labels
- variables.tf: Add gitea_runner_token variable
- ddclient.tf: Switch to official ghcr.io/ddclient/ddclient image,
  remove linuxserver wrapper that was exhausting inotify instances
---
 servers/legion/apps/gitea-runner.yaml | 61 +++++++++++++++++++++++++++
 servers/legion/ddclient.tf            | 16 ++-----
 servers/legion/gitea-runner.tf        | 14 ++++++
 servers/legion/variables.tf           |  6 +++
 4 files changed, 85 insertions(+), 12 deletions(-)
 create mode 100644 servers/legion/apps/gitea-runner.yaml
 create mode 100644 servers/legion/gitea-runner.tf

diff --git a/servers/legion/apps/gitea-runner.yaml b/servers/legion/apps/gitea-runner.yaml
new file mode 100644
index 0000000..c90466b
--- /dev/null
+++ b/servers/legion/apps/gitea-runner.yaml
@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea-runner
+  namespace: ci
+  labels:
+    app: gitea-runner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea-runner
+  template:
+    metadata:
+      labels:
+        app: gitea-runner
+    spec:
+      initContainers:
+        - name: register
+          image: gitea/act_runner:latest
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              act_runner register \
+                --instance "$GITEA_INSTANCE_URL" \
+                --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
+                --name legion \
+                --labels self-hosted,linux,x64,legion \
+                --no-interactive
+          envFrom:
+            - secretRef:
+                name: gitea-runner-secret
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      containers:
+        - name: runner
+          image: gitea/act_runner:latest
+          command: ["act_runner", "daemon"]
+          envFrom:
+            - secretRef:
+                name: gitea-runner-secret
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
+          resources:
+            requests:
+              memory: 512Mi
+              cpu: 250m
+            limits:
+              memory: 4Gi
+              cpu: "4"
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: docker-sock
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
diff --git a/servers/legion/ddclient.tf b/servers/legion/ddclient.tf
index 25fe480..7814b06 100644
--- a/servers/legion/ddclient.tf
+++ b/servers/legion/ddclient.tf
@@ -42,21 +42,13 @@ resource "kubernetes_deployment" "ddclient" {
       }
       spec {
         container {
-          name  = "ddclient"
-          image = "ghcr.io/linuxserver/ddclient:latest"
-
-          env {
-            name  = "PUID"
-            value = "1000"
-          }
-          env {
-            name  = "PGID"
-            value = "1000"
-          }
+          name    = "ddclient"
+          image   = "ghcr.io/ddclient/ddclient:latest"
+          command = ["ddclient", "-file", "/etc/ddclient/ddclient.conf", "-daemon", "300", "-noquiet", "-foreground"]
 
           volume_mount {
             name       = "config"
-            mount_path = "/config/ddclient.conf"
+            mount_path = "/etc/ddclient/ddclient.conf"
             sub_path   = "ddclient.conf"
             read_only  = true
           }
diff --git a/servers/legion/gitea-runner.tf b/servers/legion/gitea-runner.tf
new file mode 100644
index 0000000..b292466
--- /dev/null
+++ b/servers/legion/gitea-runner.tf
@@ -0,0 +1,14 @@
+# Gitea act-runner — executes Gitea Actions CI jobs on Legion
+# Registered at the instance level so it can serve all repos/orgs
+
+resource "kubernetes_secret" "gitea_runner_secret" {
+  metadata {
+    name      = "gitea-runner-secret"
+    namespace = kubernetes_namespace.ci.metadata[0].name
+  }
+
+  data = {
+    GITEA_INSTANCE_URL    = "http://gitea.git.svc.cluster.local:3000"
+    GITEA_RUNNER_REGISTRATION_TOKEN = var.gitea_runner_token
+  }
+}
diff --git a/servers/legion/variables.tf b/servers/legion/variables.tf
index 500a523..0b6c1ca 100644
--- a/servers/legion/variables.tf
+++ b/servers/legion/variables.tf
@@ -135,3 +135,9 @@ variable "gitea_api_token" {
   type        = string
   sensitive   = true
 }
+
+variable "gitea_runner_token" {
+  description = "Gitea act-runner registration token"
+  type        = string
+  sensitive   = true
+}