# MANAGED BY ANSIBLE - roles/forgejo_runner
#
# The isolated Docker daemon that Forgejo Actions jobs use. It runs ON this
# host's daemon but is a separate daemon: nothing a workflow does here can see
# or touch the host's containers, images or volumes.
[Unit]
Description=Docker-in-Docker daemon for Forgejo Actions jobs
Documentation=https://forgejo.org/docs/latest/admin/actions/docker-access/
After=docker.service
Requires=docker.service

[Service]
Type=simple
Restart=always
RestartSec=10
# dind pulls its image on first start and initialises /var/lib/docker; neither
# is fast on a cold volume, and a deadline here would just flap it.
TimeoutStartSec=0

# A container left behind by a hard kill would make `docker run --name` fail.
# Leading "-" so a clean start is not an error.
ExecStartPre=-/usr/bin/docker rm -f {{ forgejo_runner_dind_container }}

ExecStart=/usr/bin/docker run --rm --name {{ forgejo_runner_dind_container }} \
    --privileged \
    --publish {{ forgejo_runner_dind_bind_address }}:{{ forgejo_runner_dind_host_port }}:{{ forgejo_runner_dind_container_port }} \
    --volume {{ forgejo_runner_dind_volume }}:/var/lib/docker \
    --env DOCKER_TLS_CERTDIR= \
    {{ forgejo_runner_dind_image }} \
    dockerd \
    --host=tcp://0.0.0.0:{{ forgejo_runner_dind_container_port }} \
    --host=unix:///var/run/docker.sock \
    --default-address-pool base={{ forgejo_runner_dind_address_pool }},size={{ forgejo_runner_dind_address_pool_size }}

# Hold the unit in "activating" until the daemon actually answers, so that
# forgejo-runner.service - which Requires= and After= this one - is never
# started against a socket that is not up yet. The runner does not retry: with
# an explicit container.docker_host it fails the connection and the job with it.
#
# Bounded by `timeout` rather than a counting loop, so a dind that never comes
# up FAILS this unit instead of hanging the boot. That is also the thing that
# catches a bad dockerd flag: the container exits, this never answers, and the
# unit goes red rather than the runner quietly losing Docker.
ExecStartPost=/usr/bin/timeout {{ forgejo_runner_dind_ready_timeout }} /bin/sh -c 'until /usr/bin/docker -H tcp://{{ forgejo_runner_dind_bind_address }}:{{ forgejo_runner_dind_host_port }} version >/dev/null 2>&1; do sleep 1; done'

ExecStop=/usr/bin/docker stop --time 30 {{ forgejo_runner_dind_container }}

StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target