I allow crow runners to access some of my servers via the crow ansible plugin, some of them behind VPN. Most of the time I just get the default runner (Artemis), but there are some cases where I force another runner, e.g., an ARM runner via labels or Artemis is just busy, so I get Minerva.
So far I’ve used crow to find out Artemis’ runner’s IPv6 and allowed it explicitly in my firewall settings. In other cases I split the process into buildnpush, pushing the ARM image build by the arm runner into my forgejo registry and then deploying again via artemis.
Even though I got a solution I wonder whether IPs couldn’t be listed here for example: Hardware | CodeFloe ?