Add Gitea act-runner and fix ddclient deployment

- gitea-runner.tf: Secret for Gitea runner registration token
- apps/gitea-runner.yaml: Gitea act-runner deployment (init container
  registers with Gitea, main container runs daemon) — serves all Gitea
  Actions CI jobs on self-hosted,linux,x64,legion labels
- variables.tf: Add gitea_runner_token variable
- ddclient.tf: Switch to official ghcr.io/ddclient/ddclient image,
  remove linuxserver wrapper that was exhausting inotify instances

servers/legion/apps/gitea-runner.yaml

@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea-runner
+  namespace: ci
+  labels:
+    app: gitea-runner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea-runner
+  template:
+    metadata:
+      labels:
+        app: gitea-runner
+    spec:
+      initContainers:
+        - name: register
+          image: gitea/act_runner:latest
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              act_runner register \
+                --instance "$GITEA_INSTANCE_URL" \
+                --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
+                --name legion \
+                --labels self-hosted,linux,x64,legion \
+                --no-interactive
+          envFrom:
+            - secretRef:
+                name: gitea-runner-secret
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      containers:
+        - name: runner
+          image: gitea/act_runner:latest
+          command: ["act_runner", "daemon"]
+          envFrom:
+            - secretRef:
+                name: gitea-runner-secret
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
+          resources:
+            requests:
+              memory: 512Mi
+              cpu: 250m
+            limits:
+              memory: 4Gi
+              cpu: "4"
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: docker-sock
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket

servers/legion/ddclient.tf

@@ -42,21 +42,13 @@ resource "kubernetes_deployment" "ddclient" {
       }
       spec {
         container {
-          name  = "ddclient"
+          name    = "ddclient"
-          image = "ghcr.io/linuxserver/ddclient:latest"
+          image   = "ghcr.io/ddclient/ddclient:latest"
-
+          command = ["ddclient", "-file", "/etc/ddclient/ddclient.conf", "-daemon", "300", "-noquiet", "-foreground"]
-          env {
-            name  = "PUID"
-            value = "1000"
-          }
-          env {
-            name  = "PGID"
-            value = "1000"
-          }
 
           volume_mount {
             name       = "config"
-            mount_path = "/config/ddclient.conf"
+            mount_path = "/etc/ddclient/ddclient.conf"
             sub_path   = "ddclient.conf"
             read_only  = true
           }

servers/legion/gitea-runner.tf

@@ -0,0 +1,14 @@
+# Gitea act-runner — executes Gitea Actions CI jobs on Legion
+# Registered at the instance level so it can serve all repos/orgs
+
+resource "kubernetes_secret" "gitea_runner_secret" {
+  metadata {
+    name      = "gitea-runner-secret"
+    namespace = kubernetes_namespace.ci.metadata[0].name
+  }
+
+  data = {
+    GITEA_INSTANCE_URL    = "http://gitea.git.svc.cluster.local:3000"
+    GITEA_RUNNER_REGISTRATION_TOKEN = var.gitea_runner_token
+  }
+}

servers/legion/variables.tf

@@ -135,3 +135,9 @@ variable "gitea_api_token" {
   type        = string
   sensitive   = true
 }
+
+variable "gitea_runner_token" {
+  description = "Gitea act-runner registration token"
+  type        = string
+  sensitive   = true
+}