fix: 代理 Runner 仓库 HTTP 流量

internal/runnerfacade/server.go

@@ -7,6 +7,8 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/http/httputil"
+	"net/url"
 	"time"
 
 	"github.com/spiffe/go-spiffe/v2/spiffeid"
@@ -25,19 +27,40 @@ func APIHandler(facade *Facade) http.Handler {
 	return mux
 }
 
+// Handler keeps RunnerService calls inside the authenticated facade while
+// forwarding repository and artifact HTTP traffic to the real Gitea server.
+// Official Runner derives checkout URLs from its registration instance URL,
+// which intentionally points at the executor-local SPIFFE proxy.
+func Handler(facade *Facade, upstreamURL string) (http.Handler, error) {
+	target, err := url.Parse(upstreamURL)
+	if err != nil || (target.Scheme != "http" && target.Scheme != "https") || target.Host == "" {
+		return nil, errors.New("Gitea upstream must be an absolute HTTP URL")
+	}
+	path, service := facade.Handler()
+	mux := http.NewServeMux()
+	mux.Handle(APIBasePath+path, http.StripPrefix(APIBasePath, SPIFFEMiddleware(service)))
+	mux.Handle("/", httputil.NewSingleHostReverseProxy(target))
+	return mux, nil
+}
+
 type Server struct {
 	Facade          *Facade
 	ListenAddress   string
 	TrustDomain     string
 	WorkloadAPIAddr string
+	UpstreamURL     string
 }
 
 // Run serves the RunnerService facade with workload-to-workload mTLS. Any
 // identity in the local trust domain may complete TLS; the facade then requires
 // the exact logical task identity stored in its assignment registry.
 func (s Server) Run(ctx context.Context) error {
-	if s.Facade == nil || s.ListenAddress == "" || s.TrustDomain == "" {
-		return errors.New("runner facade, listen address, and trust domain are required")
+	if s.Facade == nil || s.ListenAddress == "" || s.TrustDomain == "" || s.UpstreamURL == "" {
+		return errors.New("runner facade, listen address, trust domain, and Gitea upstream are required")
+	}
+	handler, err := Handler(s.Facade, s.UpstreamURL)
+	if err != nil {
+		return err
 	}
 	trustDomain, err := spiffeid.TrustDomainFromString(s.TrustDomain)
 	if err != nil {
@@ -61,7 +84,7 @@ func (s Server) Run(ctx context.Context) error {
 	tlsListener := tls.NewListener(listener, tlsconfig.MTLSServerConfig(
 		source, source, tlsconfig.AuthorizeMemberOf(trustDomain),
 	))
-	httpServer := &http.Server{Handler: APIHandler(s.Facade), ReadHeaderTimeout: 10 * time.Second}
+	httpServer := &http.Server{Handler: handler, ReadHeaderTimeout: 10 * time.Second}
 	serverErrors := make(chan error, 1)
 	go func() { serverErrors <- httpServer.Serve(tlsListener) }()