---
# Gitea Actions runner on GKE.
#
# Architecture:
#   - init container registers the runner with Gitea (--no-interactive, idempotent)
#   - main container runs act_runner daemon
#   - docker:dind sidecar provides Docker for build jobs (privileged)
#   - emptyDir /data persists runner state within a pod lifetime
#
# The runner uses Docker-in-Docker (DinD) rather than a host socket because
# GKE Autopilot does not expose the node's Docker socket.
# DinD requires privileged mode — the ci namespace has
# pod-security.kubernetes.io/enforce: privileged (see namespace.yaml).
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea-runner
  namespace: ci
  labels:
    app: gitea-runner
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitea-runner
  template:
    metadata:
      labels:
        app: gitea-runner
    spec:
      serviceAccountName: gitea-runner
      securityContext:
        runAsNonRoot: false
      initContainers:
        - name: register
          image: us-central1-docker.pkg.dev/neuron-785695/neuron-ci/ci-base:latest
          command: ["/bin/sh", "-c"]
          args:
            - |
              # Idempotent registration — skip if already registered (.runner file exists).
              if [ -f /data/.runner ]; then
                echo "Runner already registered, skipping."
              else
                act_runner register \
                  --instance "${GITEA_INSTANCE_URL}" \
                  --token "${GITEA_RUNNER_REGISTRATION_TOKEN}" \
                  --name "gke-runner-$(hostname)" \
                  --labels "ubuntu-latest:docker://us-central1-docker.pkg.dev/neuron-785695/neuron-ci/ci-base:latest,ubuntu-24.04:docker://us-central1-docker.pkg.dev/neuron-785695/neuron-ci/ci-base:latest,linux,x64" \
                  --no-interactive
              fi
              cat > /data/config.yaml << 'CONFIGEOF'
              runner:
                capacity: 2
                timeout: 3h
              container:
                network: host
                docker_host: "tcp://localhost:2375"
                force_pull: true
                valid_volumes: []
                default_image: "us-central1-docker.pkg.dev/neuron-785695/neuron-ci/ci-base:latest"
                env:
                  GITEA_SSH_PRIVATE_KEY: ""
                  BASH_ENV: "/usr/local/bin/git-ssh-init.sh"
              CONFIGEOF
          env:
            - name: GITEA_INSTANCE_URL
              value: "https://git.neuralplatform.ai"
            - name: DOCKER_HOST
              value: "tcp://localhost:2375"
          envFrom:
            - secretRef:
                name: gitea-runner-token
          volumeMounts:
            - mountPath: /data
              name: data
          workingDir: /data
      containers:
        - name: runner
          image: us-central1-docker.pkg.dev/neuron-785695/neuron-ci/ci-base:latest
          command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
          env:
            - name: GITEA_INSTANCE_URL
              value: "https://git.neuralplatform.ai"
            - name: DOCKER_HOST
              value: "tcp://localhost:2375"
          envFrom:
            - secretRef:
                name: gitea-runner-token
          resources:
            requests:
              cpu: "500m"
              memory: "512Mi"
            limits:
              cpu: "4"
              memory: "4Gi"
          volumeMounts:
            - mountPath: /data
              name: data
          workingDir: /data
        - name: dind
          image: docker:dind
          securityContext:
            privileged: true
          env:
            - name: DOCKER_TLS_CERTDIR
              value: ""
          resources:
            requests:
              cpu: "500m"
              memory: "512Mi"
            limits:
              cpu: "4"
              memory: "4Gi"
          volumeMounts:
            - mountPath: /var/lib/docker
              name: docker-storage
      volumes:
        - name: data
          emptyDir: {}
        - name: docker-storage
          emptyDir: {}