From f6ba60bda6e8406beebef66ae7536cca870c0ea6 Mon Sep 17 00:00:00 2001
From: emil User <emil.simeonov@tutanota.com>
Date: Thu, 16 Jul 2026 17:39:31 +0000
Subject: [PATCH] GRM-154: fix: load tun module and pre-configure systemd
 override for Arch rootless Docker

---
 .../gitea_runner/tasks/rootless_docker.yml    | 62 ++++++++++++++++---
 1 file changed, 53 insertions(+), 9 deletions(-)

diff --git a/ansible/roles/gitea_runner/tasks/rootless_docker.yml b/ansible/roles/gitea_runner/tasks/rootless_docker.yml
index add87af..ad17a6c 100644
--- a/ansible/roles/gitea_runner/tasks/rootless_docker.yml
+++ b/ansible/roles/gitea_runner/tasks/rootless_docker.yml
@@ -68,6 +68,29 @@
     state: present
   when: ansible_facts['os_family'] == 'Archlinux'
 
+# The tun kernel module is required by rootlesskit (both slirp4netns and pasta
+# drivers create a tap device inside a user namespace). On Arch Linux, CONFIG_TUN=m
+# so the module must be loaded. If the running kernel doesn't match the installed
+# kernel (e.g. after a pacman -Syu that upgraded linux but didn't reboot), modprobe
+# will fail — in that case we warn but don't fail, as a reboot will fix it.
+- name: Load tun kernel module for rootless networking
+  community.general.modprobe:
+    name: tun
+    state: present
+  ignore_errors: true
+  register: gitea_runner_tun_module
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Warn if tun module could not be loaded (kernel mismatch — reboot needed)
+  ansible.builtin.debug:
+    msg: >-
+      WARNING: Could not load the tun kernel module. This is likely because the
+      running kernel ({{ ansible_facts['kernel'] }}) does not match the installed
+      kernel modules. A reboot is required before rootless Docker can start.
+  when:
+    - ansible_facts['os_family'] == 'Archlinux'
+    - gitea_runner_tun_module is failed
+
 # Arch Linux's "docker" package does not ship the rootless setup scripts (dockerd-rootless-setuptool.sh
 # and dockerd-rootless.sh), unlike Debian/Ubuntu's docker-ce-rootless-extras. No official Arch package
 # provides them, so fetch them from the upstream moby/moby contrib/ directory. They are installed
@@ -90,6 +113,35 @@
     path: "{{ gitea_runner_home }}/.config/systemd/user/docker.service"
   register: gitea_runner_rootless_docker_check
 
+# Create the systemd override BEFORE running the setuptool so that when
+# the setuptool starts docker.service, it picks up the pasta network driver
+# instead of the default slirp4netns (which may fail on some kernels).
+- name: Ensure systemd user override directory exists
+  ansible.builtin.file:
+    path: "{{ gitea_runner_home }}/.config/systemd/user/docker.service.d"
+    state: directory
+    mode: "0755"
+    owner: "{{ gitea_runner_service_user }}"
+    group: "{{ gitea_runner_service_user }}"
+  when:
+    - gitea_runner_docker_rootless_setup
+    - not gitea_runner_rootless_docker_check.stat.exists
+
+- name: Pre-configure rootless Docker network driver override
+  ansible.builtin.copy:
+    dest: "{{ gitea_runner_home }}/.config/systemd/user/docker.service.d/override.conf"
+    content: |
+      [Service]
+      Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_NET={{ gitea_runner_docker_rootless_net_driver }}"
+      Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=implicit"
+      Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS=--ipv6"
+    mode: "0644"
+    owner: "{{ gitea_runner_service_user }}"
+    group: "{{ gitea_runner_service_user }}"
+  when:
+    - gitea_runner_docker_rootless_setup
+    - not gitea_runner_rootless_docker_check.stat.exists
+
 - name: Set up rootless Docker for runner user
   ansible.builtin.command: dockerd-rootless-setuptool.sh install
   args:
@@ -98,6 +150,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DOCKERD_ROOTLESS_ROOTLESSKIT_NET: "{{ gitea_runner_docker_rootless_net_driver }}"
   when:
     - gitea_runner_docker_rootless_setup
     - not gitea_runner_rootless_docker_check.stat.exists
@@ -129,15 +182,6 @@
     group: "{{ gitea_runner_service_user }}"
   when: gitea_runner_docker_rootless_setup
 
-- name: Ensure systemd user override directory exists
-  ansible.builtin.file:
-    path: "{{ gitea_runner_home }}/.config/systemd/user/docker.service.d"
-    state: directory
-    mode: "0755"
-    owner: "{{ gitea_runner_service_user }}"
-    group: "{{ gitea_runner_service_user }}"
-  when: gitea_runner_docker_rootless_setup
-
 - name: Configure rootless Docker to use pasta with IPv6
   ansible.builtin.copy:
     dest: "{{ gitea_runner_home }}/.config/systemd/user/docker.service.d/override.conf"