podmanrunner/manifests/runner.pp

# Class for forgeo action runner.
class podmanrunner::runner (
  Integer           $replicas         = 2,
)
{
  $userpostfix='runner'
  $runnerdata = lookup("runners",undef,undef,undef)
  package { 'podman':
    ensure   => installed,
    provider => apt,
  }

  package { 'systemd-container':
    ensure   => installed,
    provider => apt,
  }

  package { 'python3-dotenv':
    ensure   => installed,
    provider => apt,
  }

    file { "/usr/local/bin/podman-compose":
      ensure => file,
      mode   => '0555',
      source => 'puppet:///modules/podmanrunner/podman-compose-1.0.6',
      owner  => "root",
      group  => "root",
    }

  if $aaa {

  $runnerdata.each |$user| {

    user { "${user}${}":
      ensure => present,
      home   => "/opt/${user}${userpostfix}",
      shell  => '/usr/sbin/nologin',
      managehome => true,
    }

    file { "/opt/${user}${userpostfix}/docker-compose.yaml":
      ensure  => file,
      content => template('podmanrunner/docker-compose.yaml.erb'),
      owner   => "${user}${userpostfix}",
      group   => "${user}${userpostfix}",
      mode    => '0400',
    }


    file { "/opt/${user}${userpostfix}/runnerimage":
      ensure => directory,
      mode   => '0700',
      owner  => "${user}${userpostfix}",
      group  => "${user}${userpostfix}",
    }

    file { "/opt/${user}${userpostfix}/runnerimage/Containerfile":
      ensure  => file,
      content => template('podmanrunner/runnerimage-Containerfile.erb'),
      owner   => "${user}${userpostfix}",
      group   => "${user}${userpostfix}",
      mode    => '0400',
    }

    unless find_file("/opt/${user}${userpostfix}/runnerdata") {
      file { "/opt/${user}${userpostfix}/runnerdata":
        ensure => directory,
        mode   => '0700',
        owner   => "${user}${userpostfix}",
        group   => "${user}${userpostfix}",
      }
    }

    file { "/opt/${user}${userpostfix}/runnerdata/config.yml":
      ensure  => file,
      source => 'puppet:///modules/podmanrunner/forgejo-runner-config.yml',
      owner   => "${user}${userpostfix}",
      group   => "${user}${userpostfix}",
      mode    => '0400',
    }

# Make sure the podman user can read the /data dir
    exec { "make-${user}${userpostfix}-own-runnerdata":
      command  => "systemd-run --wait --user --machine=${user}${userpostfix}@ /bin/bash -c 'podman unshare chown 1000:1000 /opt/${user}${userpostfix}/runnerdata'",
      path     => '/usr/bin:/usr/sbin:/bin',
      provider => shell,
      logoutput => false,
      unless   => "systemd-run --wait --user --machine=${user}${userpostfix}@ /bin/bash -c 'podman unshare stat --format %u /opt/${user}${userpostfix}/runnerdata | grep ^1000$ && podman unshare stat --format %g /opt/${user}${userpostfix}/runnerdata | grep ^1000$'",
    }

    exec { "enable-${user}${userpostfix}-linger":
      command  => "loginctl  enable-linger ${user}${userpostfix}",
      path     => '/usr/bin:/usr/sbin:/bin',
      provider => shell,
      logoutput => false,
      unless   => "test -f /var/lib/systemd/linger/${user}${userpostfix}",
    }

    }

    if $runnerdata and $runnerdata["${user}${userpostfix}"] and 'url' in $runnerdata["${user}${userpostfix}"] {
      notify {"runnercontent${userpostfix}":
        message => $runnerdata["${user}${userpostfix}"]
      }
    }

  }
}