Techie GainInfrastructure Operations Platform
Free trial

Template

CI/CD Self-Hosted Runner Host

Docker, the tools CI jobs expect, and GitHub Actions or GitLab runners, with SSH hardening.

Steps, in order · version 1.0

  1. Update Packages
  2. Install Docker
  3. Install CI Dependencies
  4. Prepare CI Runner
  5. Advanced Security: Fail2Ban & Firewall Hardening (optional)

Options

As they appear on the run form, with their defaults.

Runners

Any of the choices

Choose at least one.

  • GitHub Actions
  • GitLab Runner

Default: GitHub Actions

Let runner accounts use Docker

On or off

Needed for jobs that run containers. Docker access equals root on the server.

Default: On

Install a compiler and make

On or off

Default: On

Security hardening

One choice

Fail2Ban and safe SSH settings in both cases. SSH always stays reachable.

  • Firewall allowing SSH only
  • Firewall allowing SSH and ports services already listen on
  • No hardening

Default: Firewall allowing SSH only

What you get

A server ready to run CI jobs: Docker with Compose, git and the other commands jobs expect, a compiler if you choose, and GitHub Actions or GitLab runners installed with their own accounts, ready for you to register. By default it also turns on the firewall with only SSH allowed (runners only make outgoing connections), installs Fail2Ban and applies safe SSH settings.

The platform never registers a runner or asks for a registration token. The run ends with the command to register on the server.

Choosing the options

Runners — GitHub Actions, GitLab Runner, or both.

Let runner accounts use Docker — needed for jobs that run containers. Docker access equals root on the server: keep this server for CI only.

Install a compiler and make — for jobs that build native code.

Security hardening

  • Firewall allowing SSH only — the right choice for a dedicated runner.
  • Firewall allowing SSH and ports services already listen on — when the server also serves something.
  • No hardening — when your provider's firewall already filters traffic and you manage SSH yourself.

What happens

  1. Update Packages.
  2. Install Docker.
  3. Install CI Dependencies.
  4. Prepare CI Runner.
  5. Advanced Security: Fail2Ban & Firewall Hardening, unless you chose no hardening.

After the run

Register each runner with the token your provider shows you; the Prepare CI Runner page has the steps for GitHub and GitLab. Then run a workflow or pipeline that targets the runner's labels.

Common problems

  • GitHub's release information could not be read — a network or rate-limit problem; the step retries. See Prepare CI Runner.
  • Turning off password or root logins is refused — the platform signs in that way. See Advanced Security.