diff --git a/runner-config.yaml b/runner-config.yaml
index 3764b6c..e490e5e 100644
--- a/runner-config.yaml
+++ b/runner-config.yaml
@@ -1,8 +1,12 @@
 container:
   privileged: true
   network: "container:forgejo-runner"
-  options: "-v /var/run/docker.sock:/var/run/docker.sock"
+  
+  # KORRIGIERT: Der Docker-Socket UND das zentrale Terraform-Binary werden global injiziert!
+  options: "-v /var/run/docker.sock:/var/run/docker.sock -v /home/bast/build/mytfenv/terraform:/usr/local/bin/terraform:ro"
+
   extra_hosts:
     - "forgejo:host-gateway"
+
   valid_volumes:
     - '**'
diff --git a/runner-config.yaml.old b/runner-config.yaml.old
index b6e0baf..3764b6c 100644
--- a/runner-config.yaml.old
+++ b/runner-config.yaml.old
@@ -2,11 +2,7 @@ container:
   privileged: true
   network: "container:forgejo-runner"
   options: "-v /var/run/docker.sock:/var/run/docker.sock"
-  
-  # --- HIER IST DIE DNS-RETTUNG FÜR DEN HOST-DAEMON ---
-  # Sobald Forgejo die Token-URL mit "forgejo:3005" ausgibt, weiß der Server-Daemon sofort, wohin damit!
   extra_hosts:
     - "forgejo:host-gateway"
-    
   valid_volumes:
     - '**'
diff --git a/sync_kubeconfig.sh b/sync_kubeconfig.sh
index 9409b31..9346464 100755
--- a/sync_kubeconfig.sh
+++ b/sync_kubeconfig.sh
@@ -13,12 +13,18 @@ ESCAPED_KUBE=$(awk '{
   printf "%s\\n", $0
 }' /output/config)
 
-# Schiesst das absolut valide JSON-Paket an die Forgejo-API
-curl -s -X PUT "http://forgejo:3000/api/v1/repos/bast/my-app-sandbox/actions/secrets/KUBECONFIG_DATA" \
-  -H "accept: application/json" \
-  -H "Authorization: token eb834b313f4ffe99bc507abc08c46eb74913707a" \
-  -H "Content-Type: application/json" \
-  -d "{\"data\": \"$ESCAPED_KUBE\"}"
+# HIER DEFINIEREN WIR DEINE REPOSITORIES (Einfach mit Leerzeichen getrennt eintragen)
+REPOS="my-app-sandbox boday_tf cloudmon"
+
+# Die Schleife aktualisiert alle Repositories nacheinander
+for REPO in $REPOS; do
+  echo "=> Synchronisiere Repo: $REPO"
+  curl -s -X PUT "http://forgejo:3000/api/v1/repos/bast/$REPO/actions/secrets/KUBECONFIG_DATA" \
+    -H "accept: application/json" \
+    -H "Authorization: token eb834b313f4ffe99bc507abc08c46eb74913707a" \
+    -H "Content-Type: application/json" \
+    -d "{\"data\": \"$ESCAPED_KUBE\"}"
+done
 
 echo ""
-echo "Secret erfolgreich synchronisiert!"
+echo "Alle Secrets erfolgreich synchronisiert!"
diff --git a/terraform b/terraform
new file mode 100755
index 0000000..2daf18d
Binary files /dev/null and b/terraform differ