forgejo-runner: match the live runner and pin the nix image

The role had drifted from what runs on asxpio-services: capacity 4,
a bridge network per workflow so service containers start, the Docker
socket automounted into jobs, and a nix-latest label backed by a
persistent nix-store volume.

That volume caused a CI outage on 2026-10-18. nixos/nix:latest moved on,
and since the image's /bin/sh and /etc/nix/nix.conf link into /nix/store,
the old volume left them dangling. Pin the image through
forgejo_runner_nix_version and name the volume after it, so a bump is
deliberate and always gets a store seeded from its own image.

Assisted-by: Claude:opus-5-5

ansible/inventory/group_vars/services_servers/forgejo_runner.yaml

@@ -3,8 +3,14 @@
 
 # Runner version and settings
 forgejo_runner_version: "11"
-forgejo_runner_capacity: 1
+forgejo_runner_capacity: 4
 forgejo_runner_timeout: 3h
+
+# Image behind the nix-latest label. Jobs mount a nix-store volume over
+# /nix, seeded from this image on first use; the image's /bin/sh and
+# /etc/nix/nix.conf link into that store, so a volume from another
+# version breaks them. Bumping this also switches to a fresh volume.
+forgejo_runner_nix_version: "2.35.3"
 forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
 
 # Runner installation path

ansible/roles/forgejo_runner/templates/config.yaml.j2

@@ -28,6 +28,7 @@ runner:
     - "python-3.11:docker://python:3.11"
     - "python-3.12:docker://python:3.12"
     - "alpine-latest:docker://alpine:latest"
+    - "nix-latest:docker://nixos/nix:{{ forgejo_runner_nix_version }}"
 
 cache:
   enabled: true
@@ -35,9 +36,13 @@ cache:
   dir: ""
 
 container:
-  network: "host"
+  # "" so each workflow gets a bridge network; services (Postgres) need it.
+  network: ""
   enable_ipv6: false
   privileged: false
-  docker_host: "-"
+  options: "-v nix-store-{{ forgejo_runner_nix_version }}:/nix"
+  valid_volumes:
+    - '**'
+  docker_host: "automount"
   force_pull: false
   force_rebuild: false

ansible/roles/forgejo_runner/templates/docker-compose.yml.j2

@@ -1,13 +1,16 @@
+name: forgejo-runner
+
 services:
   forgejo-runner:
-    image: code.forgejo.org/forgejo/runner:{{ forgejo_runner_version }}
     container_name: forgejo-runner
+    image: code.forgejo.org/forgejo/runner:{{ forgejo_runner_version }}
     restart: unless-stopped
-    user: "0:0"  # Run as root to access docker socket
-    command: forgejo-runner daemon
+    user: "0:0"  # Run as root to access Docker socket
+    command: forgejo-runner daemon --config /config.yaml
+    environment:
+      - CONFIG_FILE=/config.yaml
     volumes:
       - ./data:/data
       - ./config/config.yaml:/config.yaml
       - /var/run/docker.sock:/var/run/docker.sock
-    environment:
-      - CONFIG_FILE=/config.yaml
+    network_mode: host