The renamed gitea/runner project (v1.0.0+) is a straight rename of
act_runner with the binary renamed to gitea-runner. While inspecting
its run.sh, found the actual root cause of the cache config being
ignored all along: run.sh builds --config from the CONFIG_FILE env
var, not from any command: override - it always execs the binary
itself regardless of passed args. The runner service never set
CONFIG_FILE, so runner-config.yaml was never actually loaded by the
daemon despite being correctly mounted.
The cache-server subcommand only checks the literal external_secret
field at startup and errors out if just external_secret_file is set
(unlike the daemon, which handles _file fine). Move its config out of
git entirely - it now has to hold the actual secret value - generated
straight into .data on the VPS instead.
run.sh (act_runner's default image entrypoint) ignores any command args
entirely - it always registers then execs `act_runner daemon`
regardless, with no cache-server mode. The cache-server container was
silently running as a second runner daemon instead. Override the
entrypoint directly to tini + act_runner, skipping run.sh.
Docker binds to both [::]:22 and 0.0.0.0:22 without an explicit IP,
conflicting with sshd on [::]:22.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
74.7.243.196 was crawling valknar/home SVG icon tree at 1.8 req/s.
- Denylist the IP in fail2ban dynamic config
- Add rate-limit@file middleware to Gitea's Traefik router to throttle
future scrapers on public repos
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Mount templates/custom/ directly to Gitea's default GITEA_CUSTOM templates
path. No entrypoint override or envsubst needed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Injects the Umami tracking script into every Gitea page using a custom
header.tmpl generated at startup via envsubst. Script URL and website ID
are externalized to UMAMI_SCRIPT_URL / UMAMI_WEBSITE_ID env vars.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Removes the watchtower container in favour of a host-side script that
runs daily at 2:00 AM via systemd timer. Mirrors the _backup pattern:
auto-discovers stacks, pulls images, recreates changed containers,
prunes dangling images, and notifies via n8n → Telegram.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Migrated 11 services from monolithic docker-compose project into independent stacks,
each with dedicated databases, minimal .env configuration, and bind-mount data volumes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
valknar
