54 lines
2.3 KiB
YAML
54 lines
2.3 KiB
YAML
|
# Forgejo Actions runner config for the vps2 runner. Mounted at /data/config.yaml
|
||
|
|
# by runner-vps2/docker-compose.yml.
|
||
|
|
#
|
||
|
|
# Values that differ from `forgejo-runner generate-config` defaults are the only
|
||
|
|
# ones written out below; everything else is left at its default deliberately, so
|
||
|
|
# a future runner upgrade inherits new defaults instead of a frozen copy of the
|
||
|
|
# old ones.
|
||
|
|
|
||
|
|
log:
|
||
|
|
level: info
|
||
|
|
job_level: info
|
||
|
|
|
||
|
|
runner:
|
||
|
|
file: .runner
|
||
|
|
|
||
|
|
# ONE job at a time. The desktop runner uses capacity 8, which is right for a
|
||
|
|
# box whose whole job is CI. This runner shares a host with prod, so the
|
||
|
|
# binding constraint is not throughput, it is that a CI burst must never be
|
||
|
|
# able to contend with thermograph_web for CPU. One job at a time also makes
|
||
|
|
# the resource ceiling below exact rather than a per-job estimate multiplied
|
||
|
|
# by an unknown.
|
||
|
|
capacity: 1
|
||
|
|
|
||
|
|
timeout: 3h
|
||
|
|
shutdown_timeout: 3h
|
||
|
|
|
||
|
|
container:
|
||
|
|
# 1) --add-host: git.thermograph.org resolves publicly to vps1, but vps1's
|
||
|
|
# Caddy rejects the /v2/* registry API from off-mesh. Job containers that
|
||
|
|
# docker-pull or docker-push therefore need the MESH address, and DNS will
|
||
|
|
# not give it to them. Same line the desktop runner carries; the value is
|
||
|
|
# the same from vps2 because both boxes are on 10.10.0.0/24.
|
||
|
|
#
|
||
|
|
# 2) --cpus/--memory: vps2 runs prod. Without a ceiling a runaway job (a
|
||
|
|
# `docker build` that fans out, a test that leaks) competes with the
|
||
|
|
# production app for the same 6 cores. These bound the JOB container, which
|
||
|
|
# is a sibling of the runner rather than its child, so the runner's own
|
||
|
|
# compose limits do not cover it -- this is the only lever that does.
|
||
|
|
options: --add-host=git.thermograph.org:10.10.0.2 --cpus=2 --memory=4g
|
||
|
|
|
||
|
|
# Jobs may mount NOTHING from the host. The workflows here do not need to:
|
||
|
|
# they check out into the job container's own workspace and reach the estate
|
||
|
|
# over SSH. An empty list is the difference between "a job can read
|
||
|
|
# /etc/thermograph.env" and "a job cannot", on the box where that file is
|
||
|
|
# prod's.
|
||
|
|
valid_volumes: []
|
||
|
|
|
||
|
|
privileged: false
|
||
|
|
|
||
|
|
# Mounts the host docker socket into the job container. build-push.yml runs
|
||
|
|
# `docker build`, so it needs a daemon; this points it at vps2's. See the
|
||
|
|
# README for what that does and does not mean for trust.
|
||
|
|
docker_host: "automount"
|