# GitLab CI runner for playground/makefuture.
#
#   docker compose -f /opt/web/apps/gitlab-runner/docker-compose.yml up -d
#
# Lives on the web box rather than next to GitLab, for two reasons: the GitLab
# box is a 4GB tier already leaning on swap under GitLab CE, and the only job
# this runner has is deploying to *this* machine. Registration is done once,
# out of band — see deploy/gitlab-runner/README.md — and persists in
# ./config/config.toml.

services:
  runner:
    image: gitlab/gitlab-runner:latest
    container_name: gitlab-runner
    restart: unless-stopped

    volumes:
      # config.toml, including the runner's authentication token. This is the
      # one piece of state here; losing it means re-registering.
      - ./config:/etc/gitlab-runner

      # The docker executor does not run jobs inside THIS container — it asks
      # the host's Docker to start a fresh container per job. That is what the
      # socket is for, and it is worth being honest about the trade: access to
      # this socket is equivalent to root on the host. Acceptable here because
      # the only project allowed to use this runner is one we control, but it
      # is the reason this runner is not shared with anything else.
      - /var/run/docker.sock:/var/run/docker.sock

    logging:
      driver: json-file
      options:
        max-size: '10m'
        max-file: '3'

    # No network block. The runner reaches git.makefuture.ro over the public
    # internet like any other client, and needs nothing from web-edge — the
    # deploy job connects outward over SSH rather than being reached.