concourse-app/POSTINSTALL.md

### Running workers

In order to run builds, you will need to set up a worker somewhere. Since this requires `sudo` and/or Docker running as `privileged`, it cannot be started by Cloudron and requires this manual step. It's easiest to do this with Docker on the same host. Executing the following commands will start up your worker connected to your main Concourse application. 

    tsa_container=$(cloudron list | awk '/io.concourse.cloudron/{print $1;}')
    tsa_hostname=$(cloudron exec --app $tsa_container env | grep HOSTNAME | sed s/.*=//)
    tsa_port=$(cloudron exec --app $tsa_container env | grep TSA_PORT | sed s/.*=//)
    docker run \
      --rm \
      --name concourse_worker \
      --privileged \
      --network cloudron \
      --volumes-from $tsa_container \
      concourse/concourse worker \
        --tsa-host $tsa_hostname \
        --tsa-port $tsa_port \
        --tsa-public-key /app/data/tsa_host_key.pub \
        --tsa-worker-private-key /app/data/worker_key

If you wish to do this with the binary or on another server, you will need to download your keys to facilitate the connection. This can be done using the following commands:

    cloudron pull /app/data/worker_key ./
    cloudron pull /app/data/tsa_host_key.pub ./

Then run a worker either with the binary, you should be able to execute the following from any server:

    sudo concourse worker \
      --tsa-host ${APP_URL} \
      --tsa-port ${TSA_PORT} \
      --tsa-public-key tsa_host_key.pub \
      --tsa-worker-private-key worker_key

If you would like to generate new worker keys, you must add them to `/app/data/authorized_worker_keys` in order for the workers to connect.