enabled: true

giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
existingSecret: gitea-runner-token
existingSecretKey: token

statefulset:
  replicas: 0
  timezone: Etc/UTC
  serviceAccountName: gitea-actions
  extraVolumes:
    - name: spiffe-workload-api
      csi:
        driver: csi.spiffe.io
        readOnly: true
  securityContext:
    fsGroup: 1000
  # Chart 0.1.1 applies this block to both runner and DinD containers.
  resources:
    requests:
      cpu: 250m
      memory: 512Mi
      ephemeral-storage: 2Gi
    limits:
      cpu: "4"
      memory: 6Gi
      ephemeral-storage: 20Gi
  persistence:
    size: 1Gi

  runner:
    registry: docker.io
    repository: gitea/runner
    tag: 2.3.0
    pullPolicy: IfNotPresent
    extraVolumeMounts:
      - name: spiffe-workload-api
        mountPath: /run/spire/agent-sockets
        readOnly: true
    config: |
      log:
        level: info
      runner:
        file: .runner
        capacity: 4
        timeout: 3h
        shutdown_timeout: 3h
        labels:
          - self-hosted:docker://docker.gitea.com/runner-images:ubuntu-latest
      cache:
        enabled: false
      container:
        require_docker: true
        docker_timeout: 300s
        # Workflows must still request this exact bind mount explicitly. The
        # allowlist prevents arbitrary host paths from reaching job containers.
        valid_volumes:
          - /run/spire/agent-sockets

  dind:
    # The node enforces AppArmor's unprivileged-userns restriction, which blocks
    # rootlesskit even though this chart must run DinD privileged either way.
    rootless: false
    registry: docker.io
    repository: docker
    tag: 29.7.1-dind
    pullPolicy: IfNotPresent
    # Bind mounts are resolved by dockerd, so the CSI socket must exist in the
    # DinD container as well as in the runner container.
    extraVolumeMounts:
      - name: spiffe-workload-api
        mountPath: /run/spire/agent-sockets
        readOnly: true
    # k3s uses a 1450-byte pod MTU. Without matching it here, nested Actions
    # networks advertise 1500 and GitHub TLS packets disappear on the outer
    # overlay path while direct pod traffic remains healthy.
    extraArgs:
      - --mtu=1450
      # --mtu only changes Docker's default bridge. act creates a user-defined
      # bridge per job, so give every new bridge the same explicit default.
      - --default-network-opt=bridge=com.docker.network.driver.mtu=1450