From 5b00a9809d8e3f762607db197bc582628cc8cd5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Kr=C3=BCger?= <valknar@pivoine.art>
Date: Mon, 24 Aug 2026 10:58:15 +0200
Subject: [PATCH] fix(gitea): runner config for caching 2

---
 gitea/compose.yml        | 10 ++++++++++
 gitea/runner-config.yaml | 18 ++++++++++++++----
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/gitea/compose.yml b/gitea/compose.yml
index 83880bf..a97fb88 100644
--- a/gitea/compose.yml
+++ b/gitea/compose.yml
@@ -74,6 +74,16 @@ services:
       GITEA_RUNNER_NAME: docker-runner
       GITEA_RUNNER_LABELS: ubuntu-latest:docker://catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://catthehacker/ubuntu:act-20.04
       DOCKER_HOST: unix:///var/run/docker.sock
+    ports:
+      # Fixed cache-server port (see runner-config.yaml's cache.port) so
+      # job containers - isolated on their own per-task Docker network,
+      # unreachable via container name regardless of the `network` setting
+      # below - can still reach it via host.docker.internal, which resolves
+      # to their own network's gateway and routes back to this published
+      # port. Exposed on the VPS's public interface too; consider a
+      # firewall rule restricting it to Docker's private bridge ranges
+      # (172.16.0.0/12) if that's a concern.
+      - "8088:8088"
     volumes:
       - ../.data/gitea/runner:/data
       - /var/run/docker.sock:/var/run/docker.sock
diff --git a/gitea/runner-config.yaml b/gitea/runner-config.yaml
index 781123e..072a119 100644
--- a/gitea/runner-config.yaml
+++ b/gitea/runner-config.yaml
@@ -15,14 +15,24 @@ runner:
 cache:
   enabled: true
   dir: ""
-  host: "gitea_runner"
-  port: 0
+  # "gitea_runner" (relying on shared networking via container.network below)
+  # didn't work - job containers get their own auto-created per-task network
+  # regardless of container.network (a known act_runner limitation, confirmed
+  # by inspecting a live job container: it was never attached to falcon_network
+  # at all). host.docker.internal resolves to that per-task network's own
+  # gateway instead, which *does* route back to this container's published
+  # port on the host - see https://docs.gitea.com/runner/cache/.
+  host: "host.docker.internal"
+  port: 8088
   external_server: ""
 
 container:
-  network: "falcon_network"
+  network: ""
   privileged: false
-  options: "-v /var/run/docker.sock:/var/run/docker.sock"
+  # --add-host is what makes host.docker.internal (used for cache.host above)
+  # resolve inside job containers on Linux - Docker only wires it up
+  # automatically on Docker Desktop (Mac/Windows), not here.
+  options: "-v /var/run/docker.sock:/var/run/docker.sock --add-host=host.docker.internal:host-gateway"
   workdir_parent: ""
   valid_volumes: []
   docker_host: ""