chef-recipes/containers/drone-runner/tasks.yml

# code: language=ansible

---
- hosts: all
  name: Drone CI runner agent
  tasks:
    - name: Stop running containers
      become_user: containers
      become: true
      ansible.builtin.systemd:
        scope: user
        name: container-{{ item }}.service
        state: stopped
      loop:
        - drone-runner
      failed_when: false

    - name: Get containers UID
      ansible.builtin.command: "id -u containers"
      register: uid_containers
      changed_when: uid_containers.rc != 0

    - name: Create podman networks
      containers.podman.podman_network:
        name: "{{ item }}"
        recreate: false
        state: "present"
      become_user: containers
      become: true
      loop:
        - traefik-drone-runner

    # - name: Login to private registry and create ${XDG_RUNTIME_DIR}/containers/auth.json
    #   become_user: containers
    #   become: true
    #   containers.podman.podman_login:
    #     username: "{{ vault_private_docker_registry_username }}"
    #     password: "{{ vault_private_docker_registry_password }}"
    #     registry: "{{ vault_private_docker_registry_url }}"

    - name: Pull an image
      become_user: containers
      become: true
      containers.podman.podman_image:
        name: docker.io/drone/drone-runner-docker:linux-{{ [ansible_architecture] | map('extract', arch_friendly_name) | first }}

    - name: Add a drone runner
      become_user: containers
      become: true
      containers.podman.podman_container:
        name: drone-runner
        image: docker.io/drone/drone-runner-docker:linux-{{ [ansible_architecture] | map('extract', arch_friendly_name) | first }}
        state: present
        network:
          - traefik-drone-runner
        security_opt:
          - label=type:container_runtime_t
        volume:
          - /run/user/{{ uid_containers.stdout }}/podman/podman.sock:/var/run/docker.sock:z
        label:
          io.containers.autoupdate: "registry"
          traefik.enable: "true"
          traefik.http.routers.drone-runner.entrypoints: "https"
          traefik.http.routers.drone-runner.rule: "Host(`{{ vault_domain }}`) && (PathPrefix(`/ci-runner/`) || Path(`/ci-runner`))"
          traefik.http.routers.drone-runner.tls: "true"
          traefik.http.routers.drone-runner.tls.certresolver: "wildcard"
          traefik.http.routers.drone-runner.service: "drone-runner"
          traefik.http.routers.drone-runner.middlewares: "force-trailing-slash@file,drone-runner-prefixstrip@docker"
          traefik.http.middlewares.drone-runner-prefixstrip.stripprefix.prefixes: "/ci-runner"
          traefik.http.services.drone-runner.loadbalancer.server.port: "3000"
          traefik.docker.network: "traefik-drone-runner"
        env:
          # https://docs.drone.io/runner/reference/
          DRONE_RPC_PROTO: "https"
          DRONE_RPC_HOST: "{{ vault_drone_server_url }}"
          DRONE_RPC_SECRET: "{{ vault_drone_rpc_secret }}"
          DRONE_RUNNER_NAME: "{{ inventory_hostname_short }}"
          DRONE_RUNNER_LABELS: "hostname:{{ inventory_hostname_short }}"
          DRONE_RUNNER_CAPACITY: 4
          DRONE_RUNNER_PRIVILEGED_IMAGES: "plugins/docker"
          DRONE_UI_USERNAME: "{{ vault_drone_runner_user }}"
          DRONE_UI_PASSWORD: "{{ vault_drone_runner_password }}"
          # DRONE_DEBUG: "true"
        generate_systemd:
          path: /home/containers/.config/systemd/user/
          restart_policy: on-failure
          names: true
          new: true

    - name: Change start and stop timeout limits
      become_user: containers
      become: true
      community.general.ini_file:
        path: /home/containers/.config/systemd/user/container-drone-runner.service
        section: Service
        option: "{{ item }}"
        value: 3600
        mode: "0664"
        state: "present"
        no_extra_spaces: true
      loop:
        - TimeoutStartSec
        - TimeoutStopSec

    - name: Start containers at boot
      become_user: containers
      become: true
      ansible.builtin.systemd:
        scope: user
        name: container-{{ item }}.service
        enabled: true
        state: started
        daemon_reload: true
      loop:
        - drone-runner

    - name: Add systemd timer to periodically clean unused volumes
      become_user: containers
      become: true
      ansible.builtin.copy:
        src: files/
        dest: /home/containers/.config/systemd/user/
        owner: containers
        group: containers
        mode: "0644"

    - name: Start garbage collector systemd timer
      become_user: containers
      become: true
      ansible.builtin.systemd:
        scope: user
        name: "{{ item }}.timer"
        enabled: true
        state: started
        daemon_reload: true
      loop:
        - drone-runner-gc