Log real client IPs and enable Gitea Actions with a runner

- Trust X-Forwarded-For from the pod network (10.244.0.0/16) via
  security.REVERSE_PROXY_TRUSTED_PROXIES / REVERSE_PROXY_LIMIT so Gitea
  logs the external client address instead of the ingress-nginx pod IP.
- Set actions.ENABLED explicitly and deploy an instance-wide runner via
  the gitea/actions chart (release "gitea-actions", pinned to 0.1.2).
  The registration token is generated in-cluster and stored in a Secret
  on first run, so no token lives in git or the vault.
- Fix the old actions.yaml, which reused the "gitea" release name and
  would have clobbered the main Gitea release.
- Add a demo workflow (.gitea/workflows/demo.yaml).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/actions.yaml

@@ -1,23 +1,77 @@
-- name: deploy actions
+---
+# Deploys an instance-wide Gitea Actions runner (act_runner + DinD).
+- name: check for existing runner registration token secret
+  kubernetes.core.k8s_info:
+    kind: Secret
+    namespace: gitea
+    name: "{{ gitea_actions_runner_token_secret }}"
+  register: runner_token_secret
+
+- name: generate and store a runner registration token
+  when: runner_token_secret.resources | length == 0
+  block:
+    - name: find a running gitea pod
+      kubernetes.core.k8s_info:
+        kind: Pod
+        namespace: gitea
+        label_selectors:
+          - app.kubernetes.io/name=gitea
+          - app.kubernetes.io/instance=gitea
+        field_selectors:
+          - status.phase=Running
+      register: gitea_pods
+
+    - name: generate instance-level runner registration token
+      kubernetes.core.k8s_exec:
+        namespace: gitea
+        pod: "{{ gitea_pods.resources[0].metadata.name }}"
+        container: gitea
+        command: gitea actions generate-runner-token
+      register: runner_token
+      no_log: true
+
+    - name: store runner registration token
+      kubernetes.core.k8s:
+        state: present
+        definition:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: "{{ gitea_actions_runner_token_secret }}"
+            namespace: gitea
+          type: Opaque
+          stringData:
+            token: "{{ runner_token.stdout | trim }}"
+      no_log: true
+
+- name: deploy gitea actions runner
   kubernetes.core.helm:
-    name: gitea
+    name: gitea-actions
     chart_ref: gitea/actions
+    chart_version: "{{ gitea_actions_chart_version }}"
     release_namespace: gitea
     create_namespace: true
     values:
       enabled: true
-      provisioning:
-        enabled: true
+      giteaRootURL: https://gitea.eom.dev
+      existingSecret: "{{ gitea_actions_runner_token_secret }}"
+      existingSecretKey: token
       statefulset:
-        actRunner:
+        replicas: "{{ gitea_actions_runner_replicas }}"
+        persistence:
+          size: 1Gi
+        runner:
           config: |
-            log:                                                                                                                            
-              level: debug                                                                                                                  
-            cache:                                                                                                                          
-              enabled: false                                                                                                                
+            log:
+              level: info
+            cache:
+              enabled: false
+            container:
+              require_docker: true
+              docker_timeout: 300s
             runner:
+              capacity: 2
               labels:
-                - "ubuntu-latest:docker://node:16-bullseye"
-                - "ubuntu-22.04:docker://node:16-bullseye"
-                - "ubuntu-20.04:docker://node:16-bullseye"
-                - "ubuntu-18.04:docker://node:16-buster"
+                - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+                - "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+                - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"