feat: move GitHub Actions runner to Docker container

- Replace host systemd runner with myoung34/github-runner container
  in the main compose stack
- Mounts docker.sock (GID 1001), /valhalla-lab, and /config/caddy
  so the workflow can deploy compose and reload Caddy without SSH
- Update deploy.yml to write files via mounted paths and use a shared
  COMPOSE env var for cleaner step commands
- Add GITHUB_RUNNER_ACCESS_TOKEN placeholder to .env (fine-grained PAT
  with Administration:write needed for runner self-registration)

.env

@@ -103,3 +103,6 @@ HOMARR_SECRET_ENCRYPTION_KEY=98989838bf06c9e42d77944ce848963a22ab316b55a09b0d199
 # Required permissions: Zone > DNS > Edit  (for ginnoir.com zone only)
 # This is NOT the Zone ID or Account ID — it's the API Token secret value.
 CF_API_TOKEN=cfut_ijIT9HDjXWKgd0dtnyLqxv8L3deB7hSDivSqquwp905a6c51
+
+# GitHub Actions self-hosted runner (fine-grained PAT, Administration:write on homelabstack)
+GITHUB_RUNNER_ACCESS_TOKEN=

.github/workflows/deploy.yml

@@ -6,6 +6,7 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  COMPOSE: docker compose -f /valhalla-lab/docker-compose.yml --env-file /valhalla-lab/.env
 
 jobs:
   deploy:
@@ -14,20 +15,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Push .env
-        run: cp .env ~/valhalla-lab/.env
-
-      - name: Push and apply compose
+      - name: Push .env + compose
         run: |
-          cp docker-compose.yml ~/valhalla-lab/docker-compose.yml
-          docker compose -f ~/valhalla-lab/docker-compose.yml \
-            --env-file ~/valhalla-lab/.env pull
-          docker compose -f ~/valhalla-lab/docker-compose.yml \
-            --env-file ~/valhalla-lab/.env up -d
+          cp .env /valhalla-lab/.env
+          cp docker-compose.yml /valhalla-lab/docker-compose.yml
 
-      - name: Push and reload Caddyfile
+      - name: Pull and apply compose
+        run: |
+          $COMPOSE pull
+          $COMPOSE up -d
+
+      - name: Reload Caddyfile
         run: |
           cp Caddyfile /config/caddy/Caddyfile
-          docker compose -f ~/valhalla-lab/docker-compose.yml \
-            --env-file ~/valhalla-lab/.env exec -T caddy \
-            caddy reload --config /etc/caddy/Caddyfile
+          $COMPOSE exec -T caddy caddy reload --config /etc/caddy/Caddyfile

docker-compose.yml

@@ -595,6 +595,22 @@ services:
       - /config/homarr/icons:/app/public/icons
       - /config/homarr/data:/data
 
+  github-runner:
+    container_name: github_runner
+    image: myoung34/github-runner:latest
+    restart: unless-stopped
+    environment:
+      - ACCESS_TOKEN=${GITHUB_RUNNER_ACCESS_TOKEN}
+      - REPO_URL=https://github.com/ginnoir/homelabstack
+      - RUNNER_NAME=valhalla
+      - RUNNER_LABELS=self-hosted,Linux,x64
+      - RUNNER_SCOPE=repo
+      - DOCKER_GROUP_GID=1001
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /home/ginnoir/valhalla-lab:/valhalla-lab
+      - /config/caddy:/config/caddy
+
   # ============================================================
   # UTILITIES
   # ============================================================