quarkshologridledger/infra/cloud-init/forgejo.yml

#cloud-config
# ──────────────────────────────────────────────────────────────
# Quark's Holo-Grid Ledger — Forgejo server cloud-init
# Provisions: Docker, deploy user, Forgejo + Actions runner
# ──────────────────────────────────────────────────────────────

package_update: true
package_upgrade: true

packages:
  - ca-certificates
  - curl
  - gnupg
  - lsb-release

# ── Install Docker from official apt repository ─────────────
runcmd:
  # Add Docker GPG key
  - install -m 0755 -d /etc/apt/keyrings
  - curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
  - chmod a+r /etc/apt/keyrings/docker.asc

  # Add Docker apt repository
  - |
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
      > /etc/apt/sources.list.d/docker.list    

  - apt-get update -y
  - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

  # Enable and start Docker
  - systemctl enable docker
  - systemctl start docker

  # Create deploy user with docker group access
  - useradd -m -s /bin/bash -G docker deploy
  - mkdir -p /home/deploy/.ssh
  - echo "${ssh_public_key}" > /home/deploy/.ssh/authorized_keys
  - chmod 700 /home/deploy/.ssh
  - chmod 600 /home/deploy/.ssh/authorized_keys
  - chown -R deploy:deploy /home/deploy/.ssh

  # Harden SSH — disable root login
  - sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
  - systemctl restart sshd

  # Create Forgejo directory
  - mkdir -p /opt/forgejo

  # Start Forgejo stack (automatic HTTPS via Caddy; runner remains stopped until registered)
  - cd /opt/forgejo && docker compose up -d caddy forgejo

# ── Configuration Files ─────────────────────────────────────
write_files:
  # ── Caddy Proxy Rule Configuration ────────────────────────
  - path: /opt/forgejo/Caddyfile
    permissions: "0644"
    content: |
      ${forgejo_domain} {
          reverse_proxy forgejo:3000
      }      

  # ── Write docker-compose.yml for Forgejo + Actions runner ───
  - path: /opt/forgejo/docker-compose.yml
    permissions: "0644"
    content: |
      # Quark's Holo-Grid Ledger — Forgejo stack
      services:
        caddy:
          image: caddy:2-alpine
          container_name: caddy
          restart: unless-stopped
          ports:
            - "80:80"
            - "443:443"
          volumes:
            - ./Caddyfile:/etc/caddy/Caddyfile:ro
            - caddy-data:/data
            - caddy-config:/config
          depends_on:
            - forgejo

        forgejo:
          image: codeberg.org/forgejo/forgejo:9
          container_name: forgejo
          restart: unless-stopped
          expose:
            - "3000"
          ports:
            - "2222:22"
          volumes:
            - forgejo-data:/data
          environment:
            - FORGEJO__server__ROOT_URL=https://${forgejo_domain}
            - FORGEJO__actions__ENABLED=true

        # Docker-in-Docker sidecar for the Actions runner
        runner-dind:
          image: docker:dind
          container_name: runner-dind
          restart: unless-stopped
          privileged: true
          command: dockerd -H tcp://0.0.0.0:2375 --tls=false
          volumes:
            - runner-dind-data:/var/lib/docker

        # Forgejo Actions runner
        # NOTE: After first boot, register the runner manually:
        #   1. Get a registration token from Forgejo admin → Actions → Runners
        #   2. docker exec -it runner forgejo-runner register --instance https://${forgejo_domain} --token <TOKEN> --name hologrid-runner
        #   3. docker compose up -d runner
        runner:
          image: data.forgejo.org/forgejo/runner:6.2.0
          container_name: runner
          restart: unless-stopped
          depends_on:
            - runner-dind
          environment:
            - DOCKER_HOST=tcp://runner-dind:2375
          volumes:
            - runner-data:/data
          command: forgejo-runner daemon --config /data/config.yml

      volumes:
        caddy-data:
        caddy-config:
        forgejo-data:
        runner-dind-data:
        runner-data: