test runner services

.env.example

@@ -9,5 +9,6 @@ WEBHOOK_SECRET=
 REPO_DIR=/home/djoser/webgpu-portfolio
 
 # Bind address and port for the webhook listener
-LISTEN_HOST=0.0.0.0
+# Must be 127.0.0.1 — the webhook is served through system nginx proxy
+LISTEN_HOST=127.0.0.1
 LISTEN_PORT=9000

.gitea/workflows/ci.yml

@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  test-and-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type-check
+        run: npm run typecheck
+
+      - name: Tests
+        run: npm test
+
+      - name: Build
+        run: npm run build

webhook/gitea-runner.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=Gitea Actions Runner (webgpu-portfolio)
+After=network.target docker.service
+Requires=docker.service
+
+[Service]
+Type=simple
+User=djoser
+ExecStart=/usr/local/bin/act_runner daemon --config /home/djoser/.gitea-act-runner/config.yaml
+WorkingDirectory=/home/djoser/.gitea-act-runner
+Restart=always
+RestartSec=5
+
+# Security
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=/home/djoser/.gitea-act-runner /home/djoser/.cache/actcache /var/run/docker.sock
+
+[Install]
+WantedBy=multi-user.target

webhook/webhook.service

@@ -17,8 +17,7 @@ NoNewPrivileges=yes
 PrivateTmp=yes
 ProtectSystem=strict
 ProtectHome=read-only
-ReadWritePaths=/home/djoser/webgpu-portfolio
+ReadWritePaths=/home/djoser/webgpu-portfolio /var/run/docker.sock /home/djoser/.docker
-ReadOnlyPaths=/var/run/docker.sock
 
 [Install]
 WantedBy=multi-user.target