iac/ansible/playbooks/deploy-forgejo-runner-standalone.yaml

---
# Standalone Forgejo Runner Deployment
#
# PREREQUISITES:
# 1. Forgejo must be deployed and running
# 2. You must have created an admin account in Forgejo
# 3. You must generate a runner registration token from Forgejo UI
#
# To get the registration token:
#   1. Login to Forgejo as admin
#   2. Go to: Site Administration → Actions → Runners
#   3. Click "Create new Runner" or "Generate Token"
#   4. Copy the token and update forgejo_runner_token variable
#
# Usage:
#   ansible-playbook playbooks/deploy-forgejo-runner-standalone.yaml
#

- name: Verify Forgejo is accessible
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Check Forgejo is running
      ansible.builtin.uri:
        url: "http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}/"
        status_code: 200
        timeout: 10
      register: forgejo_check
      failed_when: false
      delegate_to: localhost

    - name: Display Forgejo status
      ansible.builtin.debug:
        msg: |
          {% if forgejo_check.status == 200 %}
          ✅ Forgejo is accessible at http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
          {% else %}
          ❌ ERROR: Cannot reach Forgejo!

          Please ensure:
          1. Forgejo is deployed and running
          2. You can access: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
          3. You are connected to the VPC network or WireGuard VPN

          Deploy Forgejo first:
            ansible-playbook playbooks/02-full-deployment.yaml

          Or deploy just Forgejo:
            ansible-playbook playbooks/legacy/deploy-forgejo.yaml
          {% endif %}

    - name: Fail if Forgejo is not accessible
      ansible.builtin.fail:
        msg: "Forgejo is not accessible. Please deploy Forgejo first."
      when: forgejo_check.status != 200

- name: Get runner registration token
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Prompt for runner token configuration
      ansible.builtin.pause:
        prompt: |

          ========================================
          Forgejo Runner Registration Token Required
          ========================================

          Before deploying the runner, you MUST generate a registration token from Forgejo.

          Steps to generate the token:

          1. Open Forgejo: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}

          2. Login as administrator

          3. Navigate to: Site Administration → Actions → Runners
             (Click your profile icon → Site Administration → Actions → Runners)

          4. Click "Create new Runner" or "Generate registration token"

          5. Copy the generated token (it looks like: "eyJhbGc...")

          6. Update the token in one of these locations:

             Option A - Plaintext (NOT RECOMMENDED):
               Edit: inventory/group_vars/all.yaml
               Set: forgejo_runner_token: "YOUR-TOKEN-HERE"

             Option B - Ansible Vault (RECOMMENDED):
               ansible-vault edit inventory/group_vars/vault.yaml
               Set: vault_forgejo_runner_token: "YOUR-TOKEN-HERE"
               Then in all.yaml: forgejo_runner_token: "{{ vault_forgejo_runner_token }}"

          7. Save the file

          8. Press ENTER to continue with runner deployment

          Or press Ctrl+C to abort and configure the token first
          ========================================

- name: Deploy Forgejo CI/CD Runner
  hosts: asxpio-services
  become: true
  gather_facts: true

  pre_tasks:
    - name: Verify runner token is configured
      ansible.builtin.assert:
        that:
          - forgejo_runner_token is defined
          - forgejo_runner_token | length > 0
          - forgejo_runner_token != "REPLACE_WITH_ACTUAL_TOKEN"
          - forgejo_runner_token != "***REDACTED***"  # Old token from git
        fail_msg: |
          ❌ ERROR: forgejo_runner_token is not properly configured!

          Current value: {{ forgejo_runner_token | default('NOT SET') }}

          You must set a valid runner registration token from Forgejo:

          1. Get token from Forgejo UI:
             Site Administration → Actions → Runners → Generate Token

          2. Update in inventory/group_vars/all.yaml:
             forgejo_runner_token: "YOUR-TOKEN-HERE"

             OR better, use Ansible Vault (recommended):
             ansible-vault edit inventory/group_vars/vault.yaml
             vault_forgejo_runner_token: "YOUR-TOKEN-HERE"

          3. Re-run this playbook

          Aborting deployment...
        success_msg: "✅ Runner token validated (length: {{ forgejo_runner_token | length }} chars)"

    - name: Display deployment information
      ansible.builtin.debug:
        msg: |
          ========================================
          Deploying Forgejo Runner
          ========================================

          Target: {{ inventory_hostname }}
          Forgejo instance: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
          Runner name: runner-{{ inventory_hostname }}

          This will:
          1. Deploy runner container
          2. Register with Forgejo instance
          3. Start accepting CI/CD jobs
          ========================================

  roles:
    - role: forgejo_runner

  post_tasks:
    - name: Wait for runner registration
      ansible.builtin.pause:
        seconds: 5
        prompt: "Waiting for runner to register with Forgejo..."

    - name: Display runner status
      ansible.builtin.debug:
        msg: |
          ========================================
          Forgejo Runner Deployment Complete!
          ========================================

          Runner deployed successfully on {{ inventory_hostname }}

          Check status:
            docker logs forgejo-runner

          Verify in Forgejo UI:
            1. Login to Forgejo
            2. Go to: Site Administration → Actions → Runners
            3. You should see: runner-{{ inventory_hostname }} (idle/active)

          Test the runner:
            1. Create a repository with .forgejo/workflows/test.yml
            2. Push a commit
            3. Check Actions tab for workflow run

          Runner supports these labels:
            - ubuntu-latest, ubuntu-22.04, ubuntu-24.04
            - debian-latest, debian-12, debian-11
            - node-20, node-22
            - python-3.11, python-3.12
            - alpine-latest, arch-latest
            - nginx-latest, nginx-alpine

          Example workflow:
            .forgejo/workflows/test.yml:
            ---
            name: Test
            on: [push]
            jobs:
              test:
                runs-on: ubuntu-latest
                steps:
                  - uses: actions/checkout@v4
                  - run: echo "Hello from Forgejo Actions!"

          ========================================

- name: Verify runner in Forgejo
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Reminder to check Forgejo UI
      ansible.builtin.debug:
        msg: |

          ⚠️  FINAL STEP: Verify runner in Forgejo UI

          1. Open: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
          2. Login as admin
          3. Go to: Site Administration → Actions → Runners
          4. Verify runner-asxpio-services appears in the list
          5. Status should be "idle" (green) or "active"

          If the runner doesn't appear:
            - Check logs: docker logs forgejo-runner
            - Verify token is correct
            - Ensure runner can reach Forgejo at {{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}