fix(deploy): the runner's config folder readable by runner (ADR 0039, D6)
Some checks failed
CI / check (push) Has been cancelled

Host step 7 made /etc/forgejo-runner root's alone (0700), so the runner, as
the user runner, couldn't open config.yml and failed every 30 s from 10 Nov
on; no night's window ran a job. The folder is 0755; the token in it stays
root's (0600), which systemd hands over as a credential.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-11-11 22:49:36 +01:00
commit 9b343f2d9e
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64

View file

@ -194,7 +194,7 @@ databases, the first start, the first operator, the backups). Then:
--home-dir /var/lib/forgejo-runner --shell /usr/sbin/nologin runner --home-dir /var/lib/forgejo-runner --shell /usr/sbin/nologin runner
sudo install -d -o runner -g runner -m 700 /data/forgejo-runner /var/lib/forgejo-runner sudo install -d -o runner -g runner -m 700 /data/forgejo-runner /var/lib/forgejo-runner
sudo install -m 755 forgejo-runner /usr/local/bin/forgejo-runner # v13.1.0, its checksum checked sudo install -m 755 forgejo-runner /usr/local/bin/forgejo-runner # v13.1.0, its checksum checked
sudo install -d -m 700 /etc/forgejo-runner sudo install -d -m 755 /etc/forgejo-runner # runner reads config.yml in it; the token stays 0600
sudo install -m 644 deploy/runner/config.yml /etc/forgejo-runner/config.yml sudo install -m 644 deploy/runner/config.yml /etc/forgejo-runner/config.yml
sudo install -m 644 deploy/runner/forgejo-runner.service deploy/runner/forgejo-runner.timer \ sudo install -m 644 deploy/runner/forgejo-runner.service deploy/runner/forgejo-runner.timer \
deploy/runner/halkyon-night.service deploy/runner/halkyon-night.timer \ deploy/runner/halkyon-night.service deploy/runner/halkyon-night.timer \