Enable public Actions with an isolated resource-limited runner

Hop-State: A_06FN89T43A6YAKVVRPJ85G8
Hop-Proposal: R_06FN89NC0WV0HY32HS771N8
Hop-Task: T_06FN82XHMVA9Y1SCV577AD8
Hop-Attempt: AT_06FN82XHMS7KSMMM343RTC8

compose.yaml

@@ -46,6 +46,26 @@ services:
       - gitea-data:/data
     networks: [hopweb]
 
+  actions-runner:
+    image: docker.io/gitea/act_runner:latest-dind-rootless
+    depends_on:
+      gitea:
+        condition: service_started
+    environment:
+      GITEA_INSTANCE_URL: http://gitea:3000
+      GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
+      GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME:-cyphers-public}
+      GITEA_RUNNER_LABELS: ${GITEA_RUNNER_LABELS:-ubuntu-latest:docker://gitea/runner-images:ubuntu-latest,ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04}
+      CONFIG_FILE: /data/config.yaml
+    cpus: "2.0"
+    mem_limit: 4g
+    pids_limit: 1024
+    security_opt:
+      - no-new-privileges:true
+    volumes:
+      - actions-runner-data:/data
+    networks: [hopweb]
+
   control-plane:
     build:
       context: ./services/control-plane
@@ -74,5 +94,6 @@ networks:
   hopweb:
 
 volumes:
+  actions-runner-data:
   gitea-data:
   postgres-data: