enhance: trust a private CA with runner.ca_file and add container.volumes (#1366)

Adds `container.volumes`, mounted into every Docker job, service and action container. Sources are paths on the Docker daemon's host and need no `valid_volumes` entry, and workflow volumes may use them only with the same access.

Adds `runner.ca_file`, a private CA trusted for the Gitea instance besides the system's by the runner's connections and its artifact proxy. Runner-side git and `builtin:checkout` use it as their CA bundle for the instance, persisted with the checkout's credentials. Jobs get it at `/var/run/act/ca.crt` with `NODE_EXTRA_CA_CERTS` pointing there unless the job or its image sets it. Git in jobs, as run by `actions/checkout`, needs the CA in the image's bundle, for example through `container.volumes`.

Fixes: https://gitea.com/gitea/runner/issues/568
Fixes: https://gitea.com/gitea/runner/issues/671
Co-authored-by: silverwind <[email protected]>
Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1366
Reviewed-by: silverwind <[email protected]>
Co-authored-by: bircni <[email protected]>

internal/pkg/config/config.example.yaml

@@ -44,6 +44,12 @@ runner:
   # PEM client certificate and key for a Gitea instance that requires mutual TLS.
   #client_cert_file: /etc/gitea-runner/client.crt
   #client_key_file: /etc/gitea-runner/client.key
+  # PEM CA certificates of a Gitea instance with a private CA, trusted besides the system's.
+  # Runner-side git and builtin:checkout use it instead of the system's bundle for the instance.
+  # Jobs get it at /var/run/act/ca.crt, or in their act directory on the host, with NODE_EXTRA_CA_CERTS
+  # pointing there unless the job, or on Docker its image, sets it. Other tools in jobs, such as the
+  # git that actions/checkout runs, need the CA in the image's bundle, for example via container.volumes.
+  #ca_file: /etc/gitea-runner/ca.crt
   # The timeout for fetching the job from the Gitea instance.
   # Values above the 60s RPC timeout are capped to it.
   #fetch_timeout: 5s
@@ -264,6 +270,15 @@ container:
   # valid_volumes:
   #   - '**'
   #valid_volumes: []
+  # Volumes and bind mounts the runner adds to every job, service and docker action container, as in
+  # `docker run --volume`, with sources on the docker daemon's host. One the workflow mounts on the same
+  # container path takes its place. Their sources need no valid_volumes entry, and workflow volumes may
+  # use them only with the same access, though a job given the docker socket can mount anything.
+  # Docker only, use pod_template on Kubernetes. For example, to trust a private CA in Debian and
+  # Ubuntu based images:
+  # volumes:
+  #   - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
+  #volumes: []
   # Overrides the docker client host with the specified one.
   # If it's empty, runner will find an available docker host automatically.
   # If it's "-", runner will find an available docker host automatically, but won't mount it into the job and action containers.