diff --git a/runner_setup.yml b/runner_setup.yml
new file mode 100644
index 0000000..870887a
--- /dev/null
+++ b/runner_setup.yml
@@ -0,0 +1,174 @@
+---
+- name: Initial one-time setup
+  hosts: gitrunner
+  become: yes
+  vars:
+    runner_name: "act_runner"
+    gitea_runner_version: "0.2.13"
+    
+  tasks:
+    - name: Create act runner user
+      user:
+        name: "{{ runner_name }}"
+        system: yes
+        shell: /bin/bash
+        home: "/var/lib/{{ runner_name }}"
+        create_home: no
+
+    - name: Create /etc/act_runner directory
+      file:
+        path: /etc/"{{ runner_name }}"
+        state: directory
+        owner: "{{ runner_name }}"
+        group: "{{ runner_name }}"
+        mode: '0755'
+
+    - name: Install Act Runner
+      uri:
+        url: "https://gitea.com/gitea/act_runner/releases/download/v{{ gitea_runner_version }}/act_runner-{{ gitea_runner_version }}-linux-amd64"
+        dest: "/usr/local/bin/act-runner"
+        mode: '0755'
+        status_code: 200
+        follow_redirects: all
+    
+    - name: Creat Act Runner configuration file
+      copy:
+        content: |
+          log:
+            # The level of logging, can be trace, debug, info, warn, error, fatal
+            level: info
+
+          runner:
+            # Where to store the registration result.
+            file: .runner
+            # Execute how many tasks concurrently at the same time.
+            capacity: 1
+            # Extra environment variables to run jobs.
+            #envs:
+            #  A_TEST_ENV_NAME_1: a_test_env_value_1
+            #  A_TEST_ENV_NAME_2: a_test_env_value_2
+            # Extra environment variables to run jobs from a file.
+            # It will be ignored if it's empty or the file doesn't exist.
+            env_file: .env
+            # The timeout for a job to be finished.
+            # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+            # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+            timeout: 1h
+            # The timeout for the runner to wait for running jobs to finish when shutting down.
+            # Any running jobs that haven't finished after this timeout will be cancelled.
+            shutdown_timeout: 0s
+            # Whether skip verifying the TLS certificate of the Gitea instance.
+            insecure: false
+            # The timeout for fetching the job from the Gitea instance.
+            fetch_timeout: 5s
+            # The interval for fetching the job from the Gitea instance.
+            fetch_interval: 2s
+            # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+            # Like: "macos-arm64:host" or "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+            # Find more images provided by Gitea at https://gitea.com/docker.gitea.com/runner-images .
+            # If it's empty when registering, it will ask for inputting labels.
+            # If it's empty when execute `daemon`, will use labels in `.runner` file.
+            labels:
+              - "rocky-10:host:local"
+
+          cache:
+            # Enable cache server to use actions/cache.
+            enabled: true
+            # The directory to store the cache data.
+            # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+            dir: ""
+            # The host of the cache server.
+            # It's not for the address to listen, but the address to connect from job containers.
+            # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+            host: ""
+            # The port of the cache server.
+            # 0 means to use a random available port.
+            port: 0
+            # The external cache server URL. Valid only when enable is true.
+            # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+            # The URL should generally end with "/".
+            external_server: ""
+
+          container:
+            # Specifies the network to which the container will connect.
+            # Could be host, bridge or the name of a custom network.
+            # If it's empty, act_runner will create a network automatically.
+            network: ""
+            # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+            privileged: false
+            # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+            options:
+            # The parent directory of a job's working directory.
+            # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
+            # If the path starts with '/', the '/' will be trimmed.
+            # For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
+            # If it's empty, /workspace will be used.
+            workdir_parent:
+            # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+            # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+            # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+            # valid_volumes:
+            #   - data
+            #   - /src/*.json
+            # If you want to allow any volume, please use the following configuration:
+            # valid_volumes:
+            #   - '**'
+            valid_volumes: []
+            # overrides the docker client host with the specified one.
+            # If it's empty, act_runner will find an available docker host automatically.
+            # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+            # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+            docker_host: ""
+            # Pull docker image(s) even if already present
+            force_pull: true
+            # Rebuild docker image(s) even if already present
+            force_rebuild: false
+
+          host:
+            # The parent directory of a job's working directory.
+            # If it's empty, $HOME/.cache/act/ will be used.
+            workdir_parent:
+        dest: /etc/act_runner/config.yaml
+        mode: '0644'
+
+    - name: Register the runner with Gitea
+      command: >
+        /usr/local/bin/act-runner register 
+        --no-interactive 
+        --config /etc/act_runner/config.yaml 
+        --instance https://git.phyllo.me 
+        --token {{ registration_token }}
+      args:
+        chdir: /var/lib/{{ runner_name }}
+      become_user: "{{ runner_name }}"
+      changed_when: true
+
+    - name: Create Act Runner service file
+      copy:
+        content: |
+          [Unit]
+          Description=Gitea Actions Runner
+          After=network.target
+          
+          [Service]
+          Type=simple
+          User={{ runner_name }}
+          ExecStart=/usr/local/bin/act_runner daemon --config /etc/act_runner/config.yaml
+          ExecReload=/bin/kill -s HUP $MAINPID
+          WorkingDirectory=/var/lib/act_runner
+          TimeoutSec=0
+          Restart=always
+          RestartSec=10
+          User=act_runner
+          
+          [Install]
+          WantedBy=multi-user.target
+        dest: /etc/systemd/system/act-runner.service
+        mode: '0644'
+
+    - name: Ensure act-runner service is enabled and started
+      systemd:
+        name: act-runner
+        enabled: yes
+        state: started
+        daemon_reload: yes