jgrusewski
a47e0cb947
infra(ci): add Terragrunt-managed CI runner with Tailscale + act_runner
GP1-S instance (8 vCPU, 32GB, 100GB root) provisioned via Terraform
with cloud-init: Docker CE, Tailscale (pre-auth key), Gitea Actions
runner (act_runner v0.3.0). Security group drops all inbound — access
via Tailscale only. Solves: Kapsule pods cannot reach Tailscale IPs.
Also stores Tailscale API key in SCW Secret Manager for future auth
key generation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>