personal_infra/ansible/roles/forgejo_runner/templates/healthcheck.sh.j2

#!/bin/bash
# Forgejo Runner healthcheck — managed by Ansible (roles/forgejo_runner)
#
# Answers "is forgejo-runner healthy" and records it two ways: this log, and the
# exit code. The exit code is the durable artefact — systemd keeps it, so
#     systemctl is-failed {{ healthcheck_service_name }}.service
# answers the question with no monitoring system involved.
#
# Reporting is optional and generic: if a push URL is configured it also pings
# it. Nothing here knows or cares which monitoring product is on the other end.

LOG_FILE="{{ healthcheck_log_file }}"
# Read from the environment rather than templated in, so the unit file is the
# only place the token lives and the script is not secret.
PUSH_URL="${HEALTHCHECK_PUSH_URL:-}"
PUSH_TOKEN="${HEALTHCHECK_PUSH_TOKEN:-}"

log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> "$LOG_FILE"
}

# Gatus external endpoint: a POST with a bearer token and success=true|false.
#
# This used to report ONLY success - it exited before pushing when the runner
# was down - so a failure was invisible until the heartbeat window expired.
# Reporting the failure is the whole point of having a check.
report() {
    local ok="$1" msg="$2"
    [ -n "$PUSH_URL" ] || return 0
    curl -s --max-time 15 --retry 2 -o /dev/null -X POST \
        -H "Authorization: Bearer ${PUSH_TOKEN}" \
        "${PUSH_URL}?success=${ok}&error=${msg// /%20}" || true
}

main() {
    if ! systemctl is-active --quiet forgejo-runner; then
        log_message "ERROR: forgejo-runner is not active"
        report false "forgejo-runner is not active"
        exit 1
    fi
{% if forgejo_runner_dind_enabled %}

    # An active runner is no longer the whole answer. With container.docker_host
    # pointing at dind, a dead dind means the runner keeps claiming jobs and
    # fails every one of them at container creation - green unit, red CI. So
    # check the daemon jobs actually build on, not just that its unit is up:
    # the unit can be active while dockerd inside it has died.
    if ! systemctl is-active --quiet {{ forgejo_runner_dind_service }}; then
        log_message "ERROR: {{ forgejo_runner_dind_service }} is not active"
        report false "{{ forgejo_runner_dind_service }} is not active"
        exit 1
    fi

    if ! docker -H tcp://{{ forgejo_runner_dind_bind_address }}:{{ forgejo_runner_dind_host_port }} version >/dev/null 2>&1; then
        log_message "ERROR: dind daemon not answering on {{ forgejo_runner_dind_bind_address }}:{{ forgejo_runner_dind_host_port }}"
        report false "dind daemon not answering"
        exit 1
    fi

    log_message "forgejo-runner is active and the dind daemon answers"
    report true "active"
    exit 0
{% else %}

    log_message "forgejo-runner is active"
    report true "active"
    exit 0
{% endif %}
}

main