Gitea Actions runner for docker-1 (deploy/runner), DEPLOY.md and PLAN.md notes

Co-Authored-By: Claude Fable 5.1 <[email protected]>

docs/DEPLOY.md

@@ -158,6 +158,23 @@ The DC runs with `cap_add: [SYS_ADMIN]`, which Samba needs to set the sysvol ACL
 
 The real PESCO domain controllers are never used by CI. The test and production stacks do not run the DC.
 
+## Gitea Actions runner (phase 2)
+
+`.gitea/workflows/ci.yml` runs on a Gitea Actions runner named `docker-1`, installed on docker-1 at
+`~/gitea/runner` from [deploy/runner/](../deploy/runner/): one `act_runner` container (pinned by digest) with
+the host Docker socket, label `ubuntu-latest` mapped to `docker.gitea.com/runner-images:ubuntu-latest`,
+capacity 2. The server, frontend and image jobs run in job containers from that image. The e2e job starts
+the CI compose stack through the runner's Docker proxy on docker-1's daemon, which maps the job workspace so
+the stack's bind mounts resolve and removes the stack when the job ends. The runner was registered on
+2026-10-16 with a token generated by `gitea actions generate-runner-token` inside the `gitea` container; the
+token was never written down. [deploy/runner/README.md](../deploy/runner/README.md) has the install, update
+and re-register steps.
+
+The repository must exist on Gitea (`spencerm/packetstation`) with Actions enabled, and the image job needs
+the repository secrets `REGISTRY_USER` and `REGISTRY_TOKEN` (a Gitea token with package write). Until the
+first push, the workflow has not run on the runner; open question 15 in PLAN.md records what is still to be
+seen (the Samba DC's `cap_add` through the proxy).
+
 ## Backup (planned, phase 9)
 
 `pg_dump` of both stacks from a systemd timer on the host at 02:00 America/Denver, before the 03:00 PBS run. Seven dumps kept in `/var/backups/packetstation/<stack>/` with last-success and last-failure markers. The worker's backup-check job alerts if the newest dump is missing or older than 26 hours. Scripts and units go in `scripts/`.