rig/changelog.d/135.md

### Fixed

- Forgejo runners installed by rig can start their cache server — `$HOME/.cache` is created and punched through `ProtectHome` (#135)
fix(forgejo-runner): the cache server can start ProtectHome=read-only made the whole home read-only and only RUNNER_DIR was punched back through, so forgejo-runner could not create $HOME/.cache and disabled its cache server on every install. actions/cache was silently off on every rig-installed Forgejo runner, evidenced by one error line in the journal while `status` reported a healthy runner. Both halves are required, and the obvious one-line version is WORSE than the bug: a ReadWritePaths entry naming a path that does not exist makes systemd refuse to start the unit at all — "Failed to set up mount namespacing", three restart attempts, service down. Measured on a live runner before writing this. So the directory is created at install, owned by the runner user like RUNNER_DIR beside it, and the unit lists it. ProtectHome stays read-only: the runner supervises job containers on this box's docker socket, and the cache is not a reason to widen that. Verified live from scratch: directory removed, unit removed, converge, then zero cache-server errors and the two cache listeners bound. Closes #135 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> 2026-07-31 16:57:42 +00:00			`### Fixed`

			- Forgejo runners installed by rig can start their cache server — `$HOME/.cache` is created and punched through `ProtectHome` (#135)