personal_infra/ansible/roles/forgejo_runner/tasks/dind.yml

---
# The isolated Docker daemon jobs build against.
#
# Runs BEFORE configure.yml and service.yml on purpose: config.yml names this
# daemon's address, and forgejo-runner.service Requires= this unit. Creating it
# after either would mean one run where the runner points at nothing.

# ── Disabled: undo it, do not just skip it ─────────────────────────────────
# A flag that only ever adds is not a flag. If dind is switched off the runner
# goes back to container.docker_host "-" a few tasks from now, and a dind still
# running would be a privileged container nothing uses. The volume and the
# image are deliberately left: they are the image cache, they hold no secrets,
# and destroying them on a toggle is not this role's call.
- name: Find the dind unit when dind is disabled
  ansible.builtin.stat:
    path: "/etc/systemd/system/{{ forgejo_runner_dind_service }}.service"
  register: dind_unit_leftover
  when: not forgejo_runner_dind_enabled

- name: Stop and disable dind
  ansible.builtin.systemd:
    name: "{{ item }}"
    state: stopped
    enabled: no
  loop:
    - "{{ forgejo_runner_dind_service }}.service"
    - "{{ forgejo_runner_dind_service }}-prune.timer"
  failed_when: false
  when:
    - not forgejo_runner_dind_enabled
    - dind_unit_leftover.stat.exists | default(false)

- name: Remove the dind units
  ansible.builtin.file:
    path: "/etc/systemd/system/{{ item }}"
    state: absent
  loop:
    - "{{ forgejo_runner_dind_service }}.service"
    - "{{ forgejo_runner_dind_service }}-prune.service"
    - "{{ forgejo_runner_dind_service }}-prune.timer"
  when: not forgejo_runner_dind_enabled
  notify: Reload systemd

# ── Enabled ───────────────────────────────────────────────────────────────
- name: Pull the dind image
  ansible.builtin.command: "docker image pull {{ forgejo_runner_dind_image }}"
  register: dind_pull
  changed_when: "'Downloaded newer image' in dind_pull.stdout"
  when: forgejo_runner_dind_enabled

# Created explicitly rather than left to `docker run`, so that the name is
# declared here and a later `docker volume ls` has an obvious owner.
- name: Check for the dind image-store volume
  ansible.builtin.command: "docker volume inspect {{ forgejo_runner_dind_volume }}"
  register: dind_volume
  changed_when: false
  failed_when: false
  check_mode: false
  when: forgejo_runner_dind_enabled

- name: Create the dind image-store volume
  ansible.builtin.command: "docker volume create {{ forgejo_runner_dind_volume }}"
  when:
    - forgejo_runner_dind_enabled
    - dind_volume.rc | default(1) != 0

- name: Create the dind systemd unit
  ansible.builtin.template:
    src: forgejo-dind.service.j2
    dest: "/etc/systemd/system/{{ forgejo_runner_dind_service }}.service"
    owner: root
    group: root
    mode: '0644'
  when: forgejo_runner_dind_enabled
  notify:
    - Reload systemd
    - Restart dind

- name: Create the dind prune service
  ansible.builtin.template:
    src: forgejo-dind-prune.service.j2
    dest: "/etc/systemd/system/{{ forgejo_runner_dind_service }}-prune.service"
    owner: root
    group: root
    mode: '0644'
  when: forgejo_runner_dind_enabled and forgejo_runner_dind_prune_enabled
  notify: Reload systemd

- name: Create the dind prune timer
  ansible.builtin.template:
    src: forgejo-dind-prune.timer.j2
    dest: "/etc/systemd/system/{{ forgejo_runner_dind_service }}-prune.timer"
    owner: root
    group: root
    mode: '0644'
  when: forgejo_runner_dind_enabled and forgejo_runner_dind_prune_enabled
  notify: Reload systemd

- name: Apply pending unit changes before starting dind
  ansible.builtin.meta: flush_handlers

- name: Enable and start dind
  ansible.builtin.systemd:
    name: "{{ forgejo_runner_dind_service }}.service"
    enabled: yes
    state: started
    daemon_reload: yes
  when: forgejo_runner_dind_enabled

- name: Enable and start the dind prune timer
  ansible.builtin.systemd:
    name: "{{ forgejo_runner_dind_service }}-prune.timer"
    enabled: yes
    state: started
    daemon_reload: yes
  when: forgejo_runner_dind_enabled and forgejo_runner_dind_prune_enabled

# The unit's own ExecStartPost already blocks until the daemon answers, so by
# here this should be instant. It is asserted anyway, from the same address the
# runner will use, because "the unit is active" and "the daemon on that port
# answers" are different claims and it is the second one the runner depends on.
- name: Verify the dind daemon answers on the address the runner will use
  ansible.builtin.command: >-
    docker -H tcp://{{ forgejo_runner_dind_bind_address }}:{{ forgejo_runner_dind_host_port }}
    version --format {{ '{{.Server.Version}}' }}
  register: dind_version
  changed_when: false
  retries: 10
  delay: 3
  until: dind_version.rc == 0
  when: forgejo_runner_dind_enabled and not ansible_check_mode

- name: Show which daemon the jobs will build on
  ansible.builtin.debug:
    msg: >-
      dind daemon {{ dind_version.stdout }} is up on
      {{ forgejo_runner_dind_bind_address }}:{{ forgejo_runner_dind_host_port }}
      (host daemon is untouched); jobs reach it as
      tcp://{{ forgejo_runner_dind_internal_host }}:{{ forgejo_runner_dind_container_port }}
  when: forgejo_runner_dind_enabled and not ansible_check_mode