From e6ff5faac1163e18e06b1da19e3a6e8921ebd018 Mon Sep 17 00:00:00 2001
From: Oleksandr Berezovskyi <berezovskyi.oleksandr@gmail.com>
Date: Mon, 11 May 2026 21:05:48 +0300
Subject: [PATCH] feat(k8s/gitea): add act_runner with DinD for Gitea Actions

---
 kubernetes/app/gitea/release-actions.yaml    | 59 ++++++++++++++++++++
 kubernetes/app/gitea/secret-runner.sops.yaml | 22 ++++++++
 2 files changed, 81 insertions(+)
 create mode 100644 kubernetes/app/gitea/release-actions.yaml
 create mode 100644 kubernetes/app/gitea/secret-runner.sops.yaml

diff --git a/kubernetes/app/gitea/release-actions.yaml b/kubernetes/app/gitea/release-actions.yaml
new file mode 100644
index 0000000..e73c3de
--- /dev/null
+++ b/kubernetes/app/gitea/release-actions.yaml
@@ -0,0 +1,59 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea-actions
+  namespace: flux-system
+spec:
+  chart:
+    spec:
+      chart: actions
+      version: 0.1.0
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: gitea
+        namespace: flux-system
+  targetNamespace: gitea
+  interval: 1m0s
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  dependsOn:
+    - name: gitea
+  values:
+    enabled: true
+    giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
+    existingSecret: gitea-runner-token
+    existingSecretKey: token
+    global:
+      storageClass: nfs-synology-ssd
+    statefulset:
+      replicas: 1
+      timezone: Europe/Kyiv
+      persistence:
+        size: 10Gi
+      resources:
+        requests:
+          cpu: 100m
+          memory: 256Mi
+        limits:
+          memory: 2Gi
+      actRunner:
+        config: |
+          log:
+            level: info
+          cache:
+            enabled: true
+          container:
+            require_docker: true
+            docker_timeout: 300s
+          runner:
+            labels:
+              - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+              - "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+              - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+      dind:
+        rootless: false
diff --git a/kubernetes/app/gitea/secret-runner.sops.yaml b/kubernetes/app/gitea/secret-runner.sops.yaml
new file mode 100644
index 0000000..7632541
--- /dev/null
+++ b/kubernetes/app/gitea/secret-runner.sops.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-runner-token
+    namespace: gitea
+stringData:
+    token: ENC[AES256_GCM,data:FyNROq6IY5SYfhiFTV5FoXcFrhyYaDh7x5alZw+J7KRNw4sUQEni2g==,iv:aEFhinL9lsD/Cja3ZIa70AguBtba1qUXC2JOGsSU+Nc=,tag:6Z6HPZQAUgVa6+bQ3weM/g==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaXZiU2RRZU9XbjY3S3Mz
+            anpQV1c4SDJuUEUyYjJldEE1RG9YdTMyMlg4CkFuU3NtMk9nbDEvWWlhUWtzNklI
+            bjBBMjdlQlNqK0dpeU9VdTkvZ3lCdFUKLS0tIE4yWWpsM3B3MSsxdjd0V3hoeUgy
+            UW5pcm01ZXk5cE8rZzR4K1RzcUdxYVEKWxiIA3KFYxXAx803x9GayNi3Sv9DkeC0
+            zbedDZCevB5xiQ5tFekmgu8A6FIMB/lF1IqSqYcUVa6YYcUVfIZmaw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    encrypted_regex: ^(data|stringData|email)$
+    lastmodified: "2026-05-11T18:04:32Z"
+    mac: ENC[AES256_GCM,data:a2l+uFG4HRJRqk7Gj0UsAzexaLwwv5ffNMjs6Oz7esCcAZf/941Yn13evk3hWOsqMTO3AWj5B9blgtakYYO5y5dmI8mD8GdoXiCZF69NCLSGvGuLL6HH3mvp/ZjQQypHQF0W1O4vntdbra4FJp1Nm9iulWeFG/DAO5F8eiv87tU=,iv:Z47KwItcBzBDA1lTZNB9UUGlFUV3jHDrrGyF6AaH+9Q=,tag:0h1dB/WL2MRThvnuj4VT+w==,type:str]
+    version: 3.13.0