Commit e8a1f72

@@ -22,6 +22,7 @@
           };
           codeberg = {
             name = "runner-codeberg";
+            cacheProxyPort = 4001;
             servers = {
               codeberge = {
                 url = "https://codeberg.org";

@@ -38,6 +38,11 @@
               type = lib.types.listOf lib.types.str;
               default = [];
             };
+            cacheProxyPort = lib.mkOption {
+              type = lib.types.port;
+              default = 4000;
+              description = "Port of the internal cache proxy. Must be unique per instance, as each runner binds it on the same host.";
+            };
             extraEnvironments = lib.mkOption {
               type = lib.types.attrsOf lib.types.str;
               default = {};
@@ -70,6 +75,12 @@
     }: let
       cfg = host.settings.services.forgejo.runner;
       mkServerTokenSecretName = instance: server: "forgejo-runner-${instance}-${server}-token";
+      cacheProxyPorts = lib.mapAttrsToList (_: instanceCfg: instanceCfg.cacheProxyPort) cfg.instances;
+
+      matchPodmanNetwork =
+        if config.networking.nftables.enable
+        then "podman*"
+        else "podman+";
     in {
       # If you would like to use docker runners in combination with cache actions,
       # be sure to add docker bridge interfaces “br-*” to the firewalls’ trusted interfaces.
@@ -79,6 +90,10 @@
         then ["br-*"]
         else ["br-+"];
 
+      # The cache proxy is bound on the host side of the podman bridge networks
+      # the job containers run on, so it must be reachable from them.
+      networking.firewall.interfaces."${matchPodmanNetwork}".allowedTCPPorts = cacheProxyPorts;
+
       services.forgejo-runner.instances =
         lib.mapAttrs (instance: instanceCfg: {
           enable = true;
@@ -95,8 +110,8 @@
                 enabled = true;
                 # See https://forgejo.org/docs/latest/user/actions/advanced-features/#cache
                 # ONLY for podman backend
-                proxy_port = 4000;
-                actions_cache_url_override = "http://host.containers.internal:4000";
+                proxy_port = instanceCfg.cacheProxyPort;
+                actions_cache_url_override = lib.mkDefault "http://host.containers.internal:${toString instanceCfg.cacheProxyPort}";
               };
               container = {
                 enable_ipv6 = true;