stack.env.example

# ─────────────────────────────────────────────────────────────────────────────
# PASTE BLOCK — everything above the dashed line below, and nothing else.
#
# Portainer's environment editor parses every line as KEY=VALUE. Comments are
# not reliably stripped, and a comment containing an equals sign can become a
# variable of its own. So the block below carries no comments at all; every
# value is explained at
# https://docs.noix.dev/portainer-github-runner/reference/configuration/
# ─────────────────────────────────────────────────────────────────────────────

REPO_URL=https://github.com/ORG/REPO
RUNNER_SCOPE=repo
RUNNER_NAME=ci-host-e2e
RUNNER_LABELS=e2e
RUNNER_TOKEN=
RUNNER_WORK_ROOT=/srv/e2e-ci/_work
RUNNER_EPHEMERAL=
RUNNER_PAT=
RUNNER_ORG_NAME=
RUNNER_NETWORK_MODE=bridge
PRUNE_KEEP=24h
PRUNE_VOLUMES=false

# ─────────────────── end of the paste block ──────────────────────────────────
#
# The five you must fill
#
#   REPO_URL           the repository this runner serves
#   RUNNER_NAME        how you recognise it under Settings, Actions, Runners
#   RUNNER_LABELS      what a workflow asks for in its runs-on list
#   RUNNER_TOKEN       Settings, Actions, Runners, New self-hosted runner.
#                      One hour, single use. The runner holds its own
#                      credentials afterwards.
#   RUNNER_WORK_ROOT   an absolute host path you created beforehand, unique per
#                      stack on this host. It appears three times in the
#                      compose file and all three must stay identical.
#
# Three that look harmless and are not
#
#   RUNNER_TOKEN is the registration token. RUNNER_PAT is a personal access
#   token, a different thing: upstream uses it to call the API and fetch a
#   registration token itself. A registration token put in RUNNER_PAT is used
#   as a PAT, and GitHub answers 404 — which reads like a wrong URL rather
#   than a wrong variable. Fill one or the other, not both.
#
#   RUNNER_EPHEMERAL is tested for PRESENCE upstream, not for truth. Any
#   non-empty value turns it on, the word false included. Off means empty.
#
#   RUNNER_ORG_NAME is only read when RUNNER_SCOPE is org or enterprise. With
#   scope org and no org name, upstream prints a complaint and then carries on
#   anyway, because its exit runs in a subshell: what you actually see is a 404
#   from a URL with an empty org in it.
#
# The one that decides whether a job can reach the host at all
#
#   RUNNER_NETWORK_MODE  bridge by default. Inside a bridged container,
#                        127.0.0.1 is the container and not the host. Set it to
#                        host, on Linux, if the job starts something that
#                        publishes on the host's loopback and then waits for it
#                        — a local dev-environment router, for instance, which
#                        binds 127.0.0.1:80 and 127.0.0.1:443 on purpose. From
#                        a bridged container that wait never ends.
#                        host does NOT work on Docker Desktop for Mac or
#                        Windows: the daemon is in a VM there, so a runner for
#                        such a job has to run natively on the host instead of
#                        in this stack.
#
# Optional, with their defaults
#
#   RUNNER_IMAGE        myoung34/github-runner:2.338.0-ubuntu-noble
#   RUNNER_SCOPE        repo
#   PRUNE_IMAGE         docker:29-cli
#   PRUNE_KEEP          24h
#   PRUNE_EVERY_SECONDS 3600
#   PRUNE_VOLUMES       false, and dangerous on a shared host: a volume whose
#                       container was removed counts as unused, so pruning
#                       volumes can destroy another stack's data.