Chilly Willy Agent: a Private Woodpecker Runner on Hetzner Cloud

Codeberg ships Woodpecker CI, but the shared runners are - understandably - limited: runtime, parallel jobs, and especially how secrets are handled. As soon as you run larger builds or deployments regularly, you’ll want a runner of your own. That’s what Chilly Willy Agent is for.

What It Does

#

Chilly Willy Agent provisions a private Woodpecker runner on Hetzner Cloud , registers it with a Woodpecker instance (e.g. Codeberg’s), and takes care of the lifecycle around it.

• IPv6-only by default: the runner has no IPv4 address; outbound IPv4 traffic goes through NAT66, optionally via DNS64 for IPv4-only upstreams. Saves an IPv4 (and the cost) and reduces attack surface.
• Fedora CoreOS + Podman: a minimal, transactionally updated host OS and a daemonless container runtime. Updates via rpm-ostree, container workloads in rootless Podman.
• CLI and Make targets: the ./chilly-willy-agent wrapper covers the usual actions (up, down, status, …); equivalent make targets are there too. Both talk directly to the Hetzner Cloud API via curl - no Terraform or Ansible dependency.
• Image pin enforcement: the Woodpecker agent image is pinned by digest, with the pinned state checked into the repo. Nothing can swap underneath the runner unnoticed.
• Optional firewall, multi-agent: multiple runners side by side, on the same host or spread across hosts, optionally fronted by a Hetzner Cloud firewall.

What It’s For

#

Primarily Codeberg CI , but it works against any Woodpecker instance you can register a runner with. Typical scenarios:

• Builds whose runtime exceeds the shared Codeberg limit
• Pipelines with secrets that shouldn’t pass through third-party runners
• Pipeline-driven deployments to private infrastructure (see also the deployment article about this site )

License

#

Apache 2.0. Contributions, issues and forks welcome.

Acknowledgments

#

• Woodpecker CI - container-native CI runner
• Hetzner Cloud - cloud provider with IPv6-only servers
• Fedora CoreOS - minimal, transactional container host OS
• Podman - daemonless container runtime
• Codeberg - Forgejo-based Git forge with Woodpecker CI integration