From 6353f662fadd3062178382e18bacd760c44534e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Kr=C3=BCger?= <valknar@pivoine.art>
Date: Mon, 24 Aug 2026 11:08:48 +0200
Subject: [PATCH] fix(gitea): runner config for caching 3

---
 gitea/compose.yml        | 18 ++++++++----------
 gitea/runner-config.yaml | 27 +++++++++++++--------------
 2 files changed, 21 insertions(+), 24 deletions(-)

diff --git a/gitea/compose.yml b/gitea/compose.yml
index a97fb88..0b9fcdb 100644
--- a/gitea/compose.yml
+++ b/gitea/compose.yml
@@ -74,16 +74,6 @@ services:
       GITEA_RUNNER_NAME: docker-runner
       GITEA_RUNNER_LABELS: ubuntu-latest:docker://catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://catthehacker/ubuntu:act-20.04
       DOCKER_HOST: unix:///var/run/docker.sock
-    ports:
-      # Fixed cache-server port (see runner-config.yaml's cache.port) so
-      # job containers - isolated on their own per-task Docker network,
-      # unreachable via container name regardless of the `network` setting
-      # below - can still reach it via host.docker.internal, which resolves
-      # to their own network's gateway and routes back to this published
-      # port. Exposed on the VPS's public interface too; consider a
-      # firewall rule restricting it to Docker's private bridge ranges
-      # (172.16.0.0/12) if that's a concern.
-      - "8088:8088"
     volumes:
       - ../.data/gitea/runner:/data
       - /var/run/docker.sock:/var/run/docker.sock
@@ -91,6 +81,11 @@ services:
     restart: always
     networks:
       - compose_network
+      # Job containers join Docker's real "bridge" network (see
+      # runner-config.yaml's container.network) - this container needs to be
+      # on it too so its auto-detected cache-server address is one they can
+      # actually reach.
+      - default_bridge
   db:
     image: postgres:16-alpine
     container_name: gitea_db
@@ -112,3 +107,6 @@ networks:
   compose_network:
     name: ${NETWORK_NAME}
     external: true
+  default_bridge:
+    name: bridge
+    external: true
diff --git a/gitea/runner-config.yaml b/gitea/runner-config.yaml
index 072a119..e02f039 100644
--- a/gitea/runner-config.yaml
+++ b/gitea/runner-config.yaml
@@ -15,24 +15,23 @@ runner:
 cache:
   enabled: true
   dir: ""
-  # "gitea_runner" (relying on shared networking via container.network below)
-  # didn't work - job containers get their own auto-created per-task network
-  # regardless of container.network (a known act_runner limitation, confirmed
-  # by inspecting a live job container: it was never attached to falcon_network
-  # at all). host.docker.internal resolves to that per-task network's own
-  # gateway instead, which *does* route back to this container's published
-  # port on the host - see https://docs.gitea.com/runner/cache/.
-  host: "host.docker.internal"
-  port: 8088
+  # Leave empty for auto-detection - it correctly finds gitea_runner's own
+  # address once job containers actually share a network with it (see
+  # container.network below; a custom network name didn't work, but Docker's
+  # real default "bridge" network does).
+  host: ""
+  port: 0
   external_server: ""
 
 container:
-  network: ""
+  # A custom network name (e.g. falcon_network) was silently ignored - job
+  # containers still got their own isolated per-task network regardless.
+  # "bridge" (Docker's real, always-present default network) is honored
+  # instead - gitea_runner joins it too (see compose.yml) so both sides can
+  # reach each other by container name/IP.
+  network: "bridge"
   privileged: false
-  # --add-host is what makes host.docker.internal (used for cache.host above)
-  # resolve inside job containers on Linux - Docker only wires it up
-  # automatically on Docker Desktop (Mac/Windows), not here.
-  options: "-v /var/run/docker.sock:/var/run/docker.sock --add-host=host.docker.internal:host-gateway"
+  options: "-v /var/run/docker.sock:/var/run/docker.sock"
   workdir_parent: ""
   valid_volumes: []
   docker_host: ""