fix(runner): point unit at /usr/local/sbin, gitignore bare .runner, fix step 5

- ExecStart path matches the actual install location (/usr/local/sbin)
- .gitignore: bare '.runner' so the secret is ignored in any dir (was only runner/.runner)
- step 5: register inside ~/forgejo-runner (subshell), fix stray cd that broke
  the later 'cp runner/...' paths; note how to relocate a misplaced .runner

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,4 +1,6 @@
 # Forgejo runner registration file — contains a secret, never commit.
+# Bare `.runner` (no slash) matches it in any directory, incl. the repo root.
+.runner
 runner/.runner
 *.env
 

README.md

@@ -132,22 +132,30 @@ On the **home desktop** (already has Docker + is in the `docker` group). Put the
 binary in place, register in a home-dir working folder (snap Docker needs the
 build context under `$HOME`), then install the systemd unit so it survives
 reboots and auto-claims jobs:
+Run these from the cloned `jb-infra` repo:
 ```sh
-sudo install -m 0755 forgejo-runner /usr/local/bin/forgejo-runner
+# 1. Binary — skip if already present (check: command -v forgejo-runner).
+#    The unit's ExecStart points at /usr/local/sbin/forgejo-runner.
+sudo install -m 0755 forgejo-runner /usr/local/sbin/forgejo-runner
+
+# 2. Working dir + config (under $HOME so snap Docker can read build contexts).
 mkdir -p ~/forgejo-runner && cp runner/config.yml ~/forgejo-runner/
-cd ~/forgejo-runner
 
-# Registration token: Forgejo → Site Admin → Actions → Runners → Create
+# 3. Register IN the working dir so .runner lands there (token: Forgejo →
-forgejo-runner register --no-interactive \
+#    Site Admin → Actions → Runners → Create). The subshell keeps cwd in the repo.
-  --instance https://git.joshbairstow.com \
+( cd ~/forgejo-runner && forgejo-runner register --no-interactive \
-  --token <REGISTRATION_TOKEN> \
+    --instance https://git.joshbairstow.com \
-  --name desktop --labels desktop:host        # ':host' => run jobs on the host, use host Docker
+    --token <REGISTRATION_TOKEN> \
+    --name desktop --labels desktop:host )     # ':host' => run on host, use host Docker
 
+# 4. Install + enable the always-on service.
 sudo cp runner/forgejo-runner.service /etc/systemd/system/
 sudo systemctl daemon-reload
 sudo systemctl enable --now forgejo-runner
-systemctl status forgejo-runner               # expect active (running); runner shows green in Forgejo
+systemctl status forgejo-runner                # expect active (running); runner shows green in Forgejo
 ```
+Already registered in the wrong directory? Don't re-register — just
+`mv .runner ~/forgejo-runner/` (it's location-independent credentials).
 The `:host` label is what lets the `docker build` step work (the job runs on the
 host using its Docker, not in a socket-less container). See
 [`runner/config.yml`](runner/config.yml) and

runner/forgejo-runner.service

@@ -5,7 +5,7 @@
 # in the `docker` group) so host-execution jobs can run `docker build`.
 #
 # Install:
-#   sudo install -m 0755 forgejo-runner /usr/local/bin/forgejo-runner   # the binary
+#   sudo install -m 0755 forgejo-runner /usr/local/sbin/forgejo-runner   # the binary
 #   mkdir -p ~/forgejo-runner && cp config.yml ~/forgejo-runner/
 #   cd ~/forgejo-runner
 #   forgejo-runner register --no-interactive \
@@ -39,7 +39,7 @@ SupplementaryGroups=docker
 WorkingDirectory=/home/joshbairstow/forgejo-runner
 Environment=HOME=/home/joshbairstow
 Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
-ExecStart=/usr/local/bin/forgejo-runner daemon --config /home/joshbairstow/forgejo-runner/config.yml
+ExecStart=/usr/local/sbin/forgejo-runner daemon --config /home/joshbairstow/forgejo-runner/config.yml
 Restart=on-failure
 RestartSec=5