init runner v2

.gitea/workflows/ansible-runner.yaml

@@ -4,99 +4,99 @@ on:
   workflow_call:
     inputs:
       playbook_path:
+        description: 'Path to playbook relative to the role repo (e.g. playbooks/deploy.yml)'
         required: true
         type: string
       role_repo:
+        description: 'Gitea repository of the role (e.g. ansible/role-samba)'
         required: true
         type: string
+      inventory:
+        description: 'Inventory file relative to ansible-runner repo'
+        required: false
+        type: string
+        default: 'inventory/raspberries.yaml'
+      ansible_extra_args:
+        description: 'Additional Ansible arguments (e.g. --tags install)'
+        required: false
+        type: string
+        default: ''
     secrets:
       TOKEN:
         required: true
 
 jobs:
-  install_ansible:
+  run_ansible:
-    runs-on: ubuntu-latest
+    # Uses the custom ansible-act-runner image with Node, Python and Ansible pre-installed
+    runs-on: ansible
     container:
-      image: cattheinvoker/ubuntu-act-baked:22.04
+      image: gitea.mod.home/${{ gitea.repository_owner }}/ansible-act-runner:latest
+
     steps:
-      - name: 🔐Setup SSH for submodules
+      - name: 🔑 Setup SSH
         run: |
-          echo "Key length: ${#SSH_PRIVATE_KEY}"
           mkdir -p $HOME/.ssh
           echo "$SSH_PRIVATE_KEY" | base64 -d > $HOME/.ssh/id_ed25519
           chmod 600 $HOME/.ssh/id_ed25519
-          ls -laR
+          cat > ~/.ssh/config << 'SSHEOF'
-          # ssh-keyscan -t rsa -p 2222 gitlab.mod.home > $HOME/.ssh/known_hosts
+          Host *
-          echo "Host *" >> ~/.ssh/config
+            StrictHostKeyChecking no
-          echo "  StrictHostKeyChecking no" >> ~/.ssh/config
+            UserKnownHostsFile /dev/null
-          echo "  UserKnownHostsFile /dev/null" >> ~/.ssh/config
+            IdentityFile ~/.ssh/id_ed25519
-          echo "Host gitea.mod.home" >> ~/.ssh/config
+          Host gitea.mod.home
-          echo "  port 2222" >> ~/.ssh/config
+            Port 2222
+          SSHEOF
+          chmod 600 ~/.ssh/config
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSHKEY_B64 }}
 
-      - name: 🛠️ Install Node.js fallback
+      - name: 🔎 Checkout ansible-runner (Inventory & Vault)
-        run: |
-          if ! command -v node &> /dev/null; then
-            echo "Node nicht gefunden. Installiere..."
-            sudo apt-get update && sudo apt-get install -y nodejs
-          fi
-
-      - name: 🔎Checkout Repository
         uses: actions/checkout@v4
         with:
-          submodules: recursive
+          repository: ${{ gitea.repository_owner }}/ansible-runner
+          token: ${{ secrets.TOKEN }}
           fetch-depth: 0
-      # Python 3 installieren, was für pip und Ansible notwendig ist
 
-      - name: ⚙️Setup Python
+      - name: 🔎 Checkout Role Repo
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.x" # Wählt die neueste Python 3 Version
-
-      # Abhängigkeiten aktualisieren und Ansible über pip installieren
-      - name: ⚙️Install Ansible via pip
-        run: |
-          python -m pip install --upgrade pip
-          pip install ansible
-
-      # vault file anlegen
-      - name: 🔑create vault file
-        run: echo "${{ secrets.ANSIBLE_VAULT_KEY }}" > .vault_pass.txt
-
-      - name: 📋Manuelles Submodule Update
-        run: |
-          git submodule init
-          git submodule update --recursive --init --force
-
-      - name: ⚙️Install Ansible roles
-        run: |
-          ansible-galaxy role install -r requirements.yml --roles-path ./roles
-
-      - name: 🔎Check Ansible roles exists
-        run: |
-          ansible-galaxy list
-
-      - name: 🔎 Checkout Triggering Role Repo
         uses: actions/checkout@v4
         with:
           token: ${{ secrets.TOKEN }}
           repository: ${{ inputs.role_repo }}
           path: active_role
+          fetch-depth: 0
 
-      - name: 🔎Check Ansible Playbook Syntax
+      - name: 🔑 Setup Vault Key
         run: |
-          ansible-playbook --syntax-check active_role/${{ inputs.playbook_path }}
+          echo "${{ secrets.ANSIBLE_VAULT_KEY }}" > .vault_pass.txt
+          chmod 600 .vault_pass.txt
 
-      - name: 🏃Run Ansible deploy_valkey.yml.ansible
+      - name: 🔎 Syntax Check
         run: |
-          ansible-playbook -i inventory/raspberries.yaml active_role/${{ inputs.playbook_path }} --vault-password-file .vault_pass.txt -v
+          ansible-playbook \
-      # Beispiel für den Benachrichtigungsschritt
+            --syntax-check \
-      - name: 📨Telegram Benachrichtigung senden
+            -i ${{ inputs.inventory }} \
+            active_role/${{ inputs.playbook_path }}
+
+      - name: 🏃 Run Playbook
+        run: |
+          ansible-playbook \
+            -i ${{ inputs.inventory }} \
+            active_role/${{ inputs.playbook_path }} \
+            --vault-password-file .vault_pass.txt \
+            ${{ inputs.ansible_extra_args }} \
+            -v
+
+      - name: 🧹 Cleanup Secrets
+        if: always()
+        run: |
+          rm -f .vault_pass.txt
+          rm -f $HOME/.ssh/id_ed25519
+
+      - name: 📨 Telegram Notification
         uses: chapvic/telegram-notify@master
-        if: always() # Stellt sicher, dass die Benachrichtigung immer gesendet wird
+        if: always()
         with:
-          token: ${{ secrets.TELEGRAM_BOT_TOKEN }} # Ihr Bot-Token Secret
+          token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
-          chat: ${{ secrets.TELEGRAM_CHAT_ID }} # Ihre Chat-ID Secret
+          chat: ${{ secrets.TELEGRAM_CHAT_ID }}
-          status: ${{ job.status }} # Sendet den Job-Status (success/failure/cancelled)
+          status: ${{ job.status }}
-          title: "Deploy: ${{ inputs.role_repo }}"
+          title: "Deploy: ${{ inputs.role_repo }} → ${{ inputs.playbook_path }}"

.gitea/workflows/build-image.yaml

@@ -0,0 +1,73 @@
+name: 🐳 Build Ansible Act Runner Image
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'docker/Dockerfile'
+  workflow_dispatch:
+    inputs:
+      force_rebuild:
+        description: 'Force rebuild without cache'
+        required: false
+        default: 'false'
+        type: boolean
+
+jobs:
+  build:
+    # Runs directly on the runner host to access the DinD sidecar
+    # DOCKER_HOST=tcp://localhost:2376 is already set via runner configmap
+    runs-on: docker
+
+    steps:
+      - name: 🔎 Checkout
+        uses: actions/checkout@v4
+
+      - name: 🏷️ Set Image Tags
+        id: tags
+        run: |
+          REGISTRY="gitea.mod.home"
+          ORG="${{ gitea.repository_owner }}"
+          IMAGE="ansible-act-runner"
+          SHORT_SHA="${{ gitea.sha }}"
+          SHORT_SHA="${SHORT_SHA:0:8}"
+
+          echo "image=${REGISTRY}/${ORG}/${IMAGE}" >> $GITHUB_OUTPUT
+          echo "tag_latest=${REGISTRY}/${ORG}/${IMAGE}:latest" >> $GITHUB_OUTPUT
+          echo "tag_sha=${REGISTRY}/${ORG}/${IMAGE}:${SHORT_SHA}" >> $GITHUB_OUTPUT
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: 🐳 Docker Login → Gitea Registry
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | \
+            docker login gitea.mod.home \
+              --username "${{ secrets.REGISTRY_USER }}" \
+              --password-stdin
+
+      - name: 🐳 Build Image
+        run: |
+          BUILD_ARGS=""
+          if [ "${{ inputs.force_rebuild }}" = "true" ]; then
+            BUILD_ARGS="--no-cache"
+          fi
+
+          docker build ${BUILD_ARGS} \
+            -t ${{ steps.tags.outputs.tag_latest }} \
+            -t ${{ steps.tags.outputs.tag_sha }} \
+            -f docker/Dockerfile \
+            docker/
+
+      - name: 🐳 Push Image
+        run: |
+          docker push ${{ steps.tags.outputs.tag_latest }}
+          docker push ${{ steps.tags.outputs.tag_sha }}
+
+      - name: 📨 Telegram Notification
+        uses: chapvic/telegram-notify@master
+        if: always()
+        with:
+          token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          chat: ${{ secrets.TELEGRAM_CHAT_ID }}
+          status: ${{ job.status }}
+          title: "🐳 Build: ansible-act-runner:${{ steps.tags.outputs.short_sha }}"

README.md

@@ -0,0 +1,173 @@
+# ansible-runner
+
+Centralized Ansible runner repository for the homelab. Contains the inventory,
+vault configuration, SSH credentials, and two reusable Gitea Actions workflows:
+one that builds the custom runner image, and one that executes Ansible playbooks
+from any role repository.
+
+---
+
+## Repository Structure
+
+```
+ansible-runner/
+├── docker/
+│   └── Dockerfile                          # Custom ansible-act-runner image
+├── inventory/
+│   └── raspberries.yaml                    # Ansible inventory
+├── .gitea/
+│   └── workflows/
+│       ├── build-image.yaml                # Builds and pushes the runner image
+│       └── ansible-runner.yaml             # Reusable workflow for all role repos
+└── example-caller-workflow.yaml            # Example: how to call from another repo
+```
+
+---
+
+## Workflows
+
+### `build-image.yaml` — Build the Ansible Act Runner Image
+
+Triggers automatically when `docker/Dockerfile` changes on `main`, or manually
+via `workflow_dispatch` with an optional force-rebuild flag.
+
+Runs on the `docker` label (directly on the runner host) to access the DinD
+sidecar that is configured in the OKD runner pod. Builds and pushes two tags:
+
+- `gitea.mod.home/ansible/ansible-act-runner:latest`
+- `gitea.mod.home/ansible/ansible-act-runner:<short-sha>`
+
+### `ansible-runner.yaml` — Reusable Ansible Playbook Runner
+
+A `workflow_call` workflow that can be called from any role repository.
+Runs on the `ansible` label using the custom image, which has Node.js, Python,
+Ansible, and all required collections pre-installed.
+
+**Inputs:**
+
+| Input | Required | Default | Description |
+|-------|----------|---------|-------------|
+| `role_repo` | ✅ | — | Gitea repo of the role, e.g. `ansible/role-samba` |
+| `playbook_path` | ✅ | — | Path to playbook inside the role repo |
+| `inventory` | ❌ | `inventory/raspberries.yaml` | Inventory file relative to this repo |
+| `ansible_extra_args` | ❌ | `''` | Additional Ansible CLI arguments |
+
+**Secrets passed through:**
+
+| Secret | Description |
+|--------|-------------|
+| `TOKEN` | Gitea access token for checking out private repos |
+
+---
+
+## Calling from a Role Repository
+
+Place a workflow file in `.gitea/workflows/` of your role repository:
+
+```yaml
+name: 🚀 Deploy
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    uses: ansible/ansible-runner/.gitea/workflows/ansible-runner.yaml@main
+    with:
+      role_repo: ansible/role-samba
+      playbook_path: playbooks/deploy.yml
+      ansible_extra_args: '--tags install'   # optional
+    secrets:
+      TOKEN: ${{ secrets.TOKEN }}
+```
+
+---
+
+## Required Secrets
+
+All secrets are configured at the **Organization level** in Gitea
+(`ansible` org → Settings → Secrets) so they are available to all role
+repositories without duplication.
+
+| Secret | Used in | Description |
+|--------|---------|-------------|
+| `SSHKEY_B64` | `ansible-runner.yaml` | Base64-encoded ED25519 private key for SSH access to managed hosts |
+| `ANSIBLE_VAULT_KEY` | `ansible-runner.yaml` | Ansible Vault password |
+| `TOKEN` | `ansible-runner.yaml` | Gitea access token (`repo` scope) for checking out role repos |
+| `REGISTRY_USER` | `build-image.yaml` | Gitea username for container registry login |
+| `REGISTRY_PASSWORD` | `build-image.yaml` | Gitea access token with `package:write` scope |
+| `TELEGRAM_BOT_TOKEN` | both | Telegram bot token for notifications |
+| `TELEGRAM_CHAT_ID` | both | Telegram chat ID for notifications |
+
+### Creating the Gitea Access Token
+
+In Gitea → User Settings → Applications → Generate Token:
+- For `TOKEN`: scopes `repo` (read/write)
+- For `GITEA_REGISTRY_PASSWORD`: scope `package` (read/write)
+
+---
+
+## OKD Runner Configuration
+
+The act runner pod in the OKD cluster (`gitea-act-runner` namespace) runs with
+a DinD sidecar. The `build-image.yaml` workflow uses `runs-on: docker` to
+execute directly on the runner host where `DOCKER_HOST=tcp://localhost:2376`
+is available via the sidecar.
+
+The `ansible-runner.yaml` workflow uses `runs-on: ansible` and spawns a
+container from the custom image. Node.js, Python, Ansible, and all collections
+are pre-installed — no runtime installation required.
+
+### Runner Labels (configured in OKD ConfigMap)
+
+The runner ConfigMap (`gitea-act-runner-config`) must have the following labels
+registered. Without the `docker` label, `build-image.yaml` will not be picked
+up by the runner.
+
+```yaml
+# configmap.yaml — labels section
+runner:
+  labels:
+    - "docker:host"         # required for build-image.yaml (runs-on: docker)
+    - "ansible:host"        # required for ansible-runner.yaml (runs-on: ansible)
+    - "ubuntu-latest:docker://..."
+```
+
+| Label | `runs-on` value | Purpose |
+|-------|----------------|---------|
+| `docker:host` | `docker` | Direct host execution with DinD sidecar — used for Docker builds |
+| `ansible:host` | `ansible` | Direct host execution — Ansible jobs via container image |
+| `ubuntu-latest` | `ubuntu-latest` | Container execution via DinD |
+
+> **Note:** After changing the ConfigMap labels, the runner pod must re-register.
+> Delete the pod to force a restart: `kubectl delete pod -n gitea-act-runner -l app=gitea-act-runner`
+
+---
+
+## Bootstrap: First Image Build
+
+No manual build from a laptop is required. The existing `gitea/act_runner:latest`
+pod already has a DinD sidecar and the `docker:host` label registered, so it can
+build and push the custom image itself.
+
+**Steps:**
+
+1. Create the repository in Gitea and push all files
+2. Set the required secrets in the `ansible` org (see above)
+3. Trigger the build manually via `workflow_dispatch` in Gitea Actions UI
+
+The runner will build the image and push it to `gitea.mod.home/ansible/ansible-act-runner:latest`.
+All subsequent builds are triggered automatically when `docker/Dockerfile` changes on `main`.
+
+---
+
+## Roadmap
+
+- [ ] TLS for Gitea registry via cert-manager (remove insecure flag)
+- [ ] Samba AD DC deployment playbook
+- [ ] Bind9 DNS backend playbook
+- [ ] Windows domain join playbook
+- [ ] Fluentbit → VictoriaLogs for Samba log shipping

docker/Dockerfile

@@ -0,0 +1,78 @@
+FROM ubuntu:24.04
+
+LABEL maintainer="homelab"
+LABEL description="Ansible Act Runner - Custom Image"
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV NODE_VERSION=20
+ENV ANSIBLE_FORCE_COLOR=1
+ENV PIP_NO_CACHE_DIR=1
+
+ARG ACT_RUNNER_VERSION=0.2.11
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl \
+    wget \
+    git \
+    ca-certificates \
+    gnupg \
+    unzip \
+    jq \
+    rsync \
+    openssh-client \
+    sshpass \
+    python3 \
+    python3-pip \
+    python3-venv \
+    python3-dev \
+    smbclient \
+    krb5-user \
+    libkrb5-dev \
+    python3-kerberos \
+    dnsutils \
+    build-essential \
+    libssl-dev \
+    libffi-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Node.js 20 LTS
+RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/*
+
+# act_runner binary
+RUN curl -fsSL \
+    https://gitea.com/gitea/act_runner/releases/download/v${ACT_RUNNER_VERSION}/act_runner-${ACT_RUNNER_VERSION}-linux-amd64 \
+    -o /usr/local/bin/act_runner \
+    && chmod +x /usr/local/bin/act_runner
+
+# Ansible + pip packages
+RUN python3 -m pip install --break-system-packages \
+    ansible-core \
+    ansible \
+    jmespath \
+    netaddr \
+    passlib \
+    cryptography \
+    pywinrm \
+    requests \
+    boto3
+
+# Ansible Collections
+RUN ansible-galaxy collection install \
+    community.general \
+    community.crypto \
+    ansible.posix \
+    kubernetes.core \
+    community.windows \
+    microsoft.ad
+
+RUN useradd -m -s /bin/bash runner
+
+WORKDIR /data
+
+# Smoke tests
+RUN node --version \
+    && python3 --version \
+    && ansible --version \
+    && act_runner --version

example-caller-workflow.yaml

@@ -0,0 +1,18 @@
+name: 🚀 Deploy
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    uses: ansible/ansible-runner/.gitea/workflows/ansible-runner.yaml@main
+    with:
+      role_repo: ansible/role-samba           # role repository to check out
+      playbook_path: playbooks/deploy.yml     # path inside the role repo
+      inventory: inventory/raspberries.yaml   # optional — this is the default
+      ansible_extra_args: '--tags install'    # optional
+    secrets:
+      TOKEN: ${{ secrets.TOKEN }}