# Values for the gitea-actions (Actions runner) chart.
#
# Hard resource caps: CI jobs can be very intensive, so every layer is capped
# so that a runaway job gets OOM-killed/throttled inside the runner pod instead
# of exhausting the node and taking it (and everything running on it) down.
#
# Layers of protection:
#   1. dind container limits  -> hard cap for the Docker daemon and ALL job
#      containers it spawns (they run inside the dind cgroup).
#   2. Per-job docker options -> each job container additionally capped below
#      the dind limit, keeping headroom for the daemon + image cache.
#   3. Low PriorityClass (injected via postRenderers in release-actions.yaml)
#      -> under node pressure the runner is evicted/OOM-killed first.
enabled: true
# Register against the in-cluster Gitea service (chart "gitea" release).
giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
existingSecret: gitea-actions-runner-token
existingSecretKey: token
statefulset:
    # Single-node cluster, no point in more replicas
    replicas: 1
    timezone: Europe/Paris
    runner:
        resources:
            requests:
                cpu: 100m
                memory: 128Mi
            limits:
                cpu: 500m
                memory: 512Mi
        config: |
            log:
                level: info
            cache:
                enabled: false
            runner:
                # One job at a time keeps resource usage predictable
                capacity: 1
                # Raise if jobs need longer than 3h (Gitea server-side job
                # timeout applies as well)
                #timeout: 3h
            container:
                require_docker: true
                docker_timeout: 300s
                # Hard per-job caps (docker create args). Slightly below the
                # dind limits so the daemon and image cache keep headroom.
                options: --memory=7g --cpus=1
    dind:
        resources:
            requests:
                cpu: 250m
                memory: 512Mi
            limits:
                cpu: 1500m
                memory: 8Gi
    tolerations:
        - key: ENC[AES256_GCM,data:wLfr0r+e9KYm,iv:BGZnWKQUlOje9RhAs7tBDzNcDt5LcfTnqRSqrdFc/A4=,tag:bb1f7NwEwmEzrf5k9ivFPg==,type:str]
          operator: Equal
          value: failover
          effect: NoSchedule
        - key: ENC[AES256_GCM,data:1kBsMuUlpluDmpVddyZCI/ylRbluHmQ62F88Q9LEoiZkgdpm5g==,iv:IlggVbY7s/xaSM2ljMkiTDwvIjf12g3SQzfL2fWWf78=,tag:2aNlCFumidKSbnoUV1IBzw==,type:str]
          operator: Exists
          effect: NoSchedule
    affinity:
        nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
                - weight: 100
                  preference:
                    matchExpressions:
                        - key: ENC[AES256_GCM,data:JuejrbDWeF+d/+d2Hq+q4V9vihk=,iv:VPgkBuv2hqJbTNFXpv3SzRGtFA6iVq1kFR8hfANg0cQ=,tag:D/wrkytnO8oZ3/+4yicq7Q==,type:str]
                          operator: NotIn
                          values:
                            - "true"
sops:
    lastmodified: "2026-08-26T19:28:03Z"
    mac: ENC[AES256_GCM,data:srIJjIgWx1OGgGwz71wQgT8c1gg64iV2VHrrb11SYXpaYg0VMp9d0maJHCaKt5rDVtWw/+Ft4WbR0z2FJBLEmr64/cFX8/SgrOR7pAc/vAgPKfxiSHg6iJoVCGHssGHm4NzvSUC2fkMqc8WUiZDR5hztUKSlp9oNPO2bKZmw7Zo=,iv:tgSmO28JZiGK9xO4uIH35zlRzJcW8lKxaggtqXlFq/w=,tag:+mIagmS+Z5RSFdSo/yDhjg==,type:str]
    pgp:
        - created_at: "2026-08-26T19:28:03Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiAQ//X9NxtKUDFkdKDmWQh3wRSriiq25U7gkL0Q7SE45Tz5V6
            03i6QmzCyBpI81TQQBRRzfdkuuqocBgplTRRRvFsNQNcwc5KCq1zHIDVYE+XlcmI
            /bwA0GpBZwDN6Mv+G8+6UwhSp+YgsiGFTVAIctfz90cRYPpABX4wRcDYInTlifHk
            weBq30iS6Nl9TajpgyyAUct6EBQ8u1YmxsII9RYWjdoTS/SAuAxNM2px7fwOPAoL
            fq6/AxXj1n+uKjxl1calL95768RmLUerdxDmac53/73Pj271hmbwrWqe+JzkSriu
            YMHYNOVLglf7nS3AQSqAa9PljBv7xHw9jOUqkJH14W7/NpSRvc4PICyIWA3Yfpfq
            ymMI/OOYosyl3ZYhfLGUIAIYLkA1StgGVfpmeOmUCPEn2FIInBmguzDRMrdnUkoz
            KYh/06Ug6YsgCTsy8Ffhzy724ITRADzqYlTU060tTwFN7cgFVHiIfZdYIFxDxNSL
            NELw8Nl7+9jkWjlnmPvtxfrN90L7nBm4s3mZrYeyZ1/ElcxDkJKb4r+PJuc6rCpM
            tuD9BXxjl5qa/trl/1+fVToDMMm5vws0MLl4DBkbNUNkD7wWko0I4rDSZ+X4SihM
            /V7XgzeQ41KMnDdZYwTKdIVhCpZOIBwZlLuZSYCn8uhqO0YMkkpB1x1EOb2fy3zS
            XgFdP2zpsUHWsy/iENHCgnMkQ+l2XwZZ2bgZGqwpRbLO0fDNX0kRZ45NzKl2+t79
            npggZ12JFTPPbQG+o0hY0p7LjnjbfBsp7m9ykvymizZXlzP9efoOq6kjD/CRBu0=
            =WgiB
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    version: 3.10.2