ci: Workflow für node:20-bookworm-Runner, Runner-Stack im Swarm-Muster des bestehenden gitrunner

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/gitea-runner/docker-compose.yml

@@ -1,24 +1,42 @@
-# Gitea Actions Runner (act_runner) für cluster-knaster.
-# Bewusst klein: 1 Job gleichzeitig, Job-Container auf 1 CPU / 2 GB begrenzt.
-# Registrierung nur auf Repo-Ebene (cluster-knaster → Einstellungen → Actions → Runner → Token).
-name: gitea-runner
-
+# Gitea Actions Runner (act_runner) für cluster-knaster als Swarm-Stack (Portainer).
+# Gleiches Muster wie der vorhandene Stack "gitrunner": Token als Swarm-Secret, Konfiguration als Swarm-Config.
+# Vorher anlegen:
+#   docker secret create gitea-runner-knaster-token <datei-mit-token>
+#   docker config create gitrunner_knaster_config_v1 config.yaml
 services:
-  act-runner:
-    image: gitea/act_runner:0.2.11
-    restart: unless-stopped
+  runner:
+    image: docker.io/gitea/act_runner:0.2.11
     environment:
-      GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:-https://gitea.mindboost.team}
-      GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:?Registrierungs-Token fehlt}
-      GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME:-knaster-runner}
       CONFIG_FILE: /config.yaml
+      GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:-https://gitea.mindboost.team}
+      GITEA_RUNNER_REGISTRATION_TOKEN_FILE: /run/secrets/gitea-runner-knaster-token
+      GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME:-knaster-runner-01}
+      GITEA_RUNNER_LABELS: ${GITEA_RUNNER_LABELS:-ubuntu-latest:docker://node:20-bookworm}
+    secrets:
+      - gitea-runner-knaster-token
+    configs:
+      - source: runner_config
+        target: /config.yaml
     volumes:
-      - ./config.yaml:/config.yaml:ro
-      - runner-data:/data
+      - runner_data_knaster:/data
       - /var/run/docker.sock:/var/run/docker.sock   # startet die Job-Container auf diesem Host
     deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy: {condition: any, delay: 10s}
+      placement:
+        constraints: [node.role == manager]
       resources:
         limits: {cpus: "0.5", memory: 256M}
 
+secrets:
+  gitea-runner-knaster-token:
+    external: true
+
+configs:
+  runner_config:
+    external: true
+    name: gitrunner_knaster_config_v1
+
 volumes:
-  runner-data: {}
+  runner_data_knaster: