2026-07-25 04:13:47 +00:00
|
|
|
# Job-container image for the LAN Forgejo Actions runner's `docker`-labeled
|
|
|
|
|
# jobs (see ../register-lan-runner.sh) — used by every backend/frontend
|
|
|
|
|
# build-push, deploy, and validation workflow that needs `docker build`.
|
|
|
|
|
#
|
|
|
|
|
# Base stays node:20-bookworm, NOT a Node-free slim image (v1 of this file
|
|
|
|
|
# tried that and broke every job: `actions/checkout@v4` is a JS action that
|
|
|
|
|
# Forgejo's runner execs as `node dist/index.js` *inside the job container*,
|
|
|
|
|
# so a Node runtime is a hard requirement regardless of whether the workflow
|
|
|
|
|
# itself uses npm/node — this repo's own workflows don't, but the checkout
|
|
|
|
|
# step every one of them starts with does).
|
|
|
|
|
#
|
|
|
|
|
# What this image actually fixes: every workflow using the `docker` label
|
|
|
|
|
# currently re-provisions the Docker CLI on each run via `apt-get install
|
|
|
|
|
# docker.io` — that step costs ~15-20s per job and, more importantly,
|
|
|
|
|
# installs the CLASSIC Docker builder rather than BuildKit, which mishandles
|
|
|
|
|
# `COPY --chown=<name>` group resolution on images without a matching system
|
|
|
|
|
# group (a real bug hit during the frontend Go rewrite). Installing
|
|
|
|
|
# docker-buildx-plugin here makes BuildKit the default, closing that bug
|
|
|
|
|
# class, and skips the per-job install entirely.
|
|
|
|
|
#
|
|
|
|
|
# Build/push (manual — see ../README.md for when to rebuild):
|
registry: move the registry host to dev.jinemi.com, MCP to mcp.jinemi.com
Completes the Forgejo domain migration. ROOT_URL moved to dev.jinemi.com
earlier; the registry half was deliberately deferred. Every image name,
REGISTRY_HOST default, runner label and --add-host pin now names
dev.jinemi.com, so the registry host and the bearer-token realm agree again.
Both names address the same Forgejo, so no image needs re-pushing and a
rollback to a tag pushed under the old prefix still resolves.
git.thermograph.org therefore stays served off the same Caddy site block --
one block, so the /v2/* mesh-only matcher keeps covering both names -- for
pre-migration tags and for runners holding it as their registered instance
URL.
Mesh clients now pin both names in /etc/hosts: the new one as registry host
and token realm, the old one for pre-migration tags. runner-vps2/config.yaml
carries both --add-host entries for the same reason.
Also renames Centralis' endpoint to mcp.jinemi.com in the two places this
repo names it; Centralis itself is provisioned outside this repo.
Host-side steps this cannot do (documented in deploy/forgejo/README.md,
"Host-side steps"): the Forgejo Actions variable REGISTRY_HOST, docker login
against the new host, and the /etc/hosts pins.
2026-08-01 23:06:22 +00:00
|
|
|
# docker build -t dev.jinemi.com/jinemi/thermograph/ci-runner:vN \
|
2026-07-25 04:13:47 +00:00
|
|
|
# infra/deploy/forgejo/ci-runner
|
registry: move the registry host to dev.jinemi.com, MCP to mcp.jinemi.com
Completes the Forgejo domain migration. ROOT_URL moved to dev.jinemi.com
earlier; the registry half was deliberately deferred. Every image name,
REGISTRY_HOST default, runner label and --add-host pin now names
dev.jinemi.com, so the registry host and the bearer-token realm agree again.
Both names address the same Forgejo, so no image needs re-pushing and a
rollback to a tag pushed under the old prefix still resolves.
git.thermograph.org therefore stays served off the same Caddy site block --
one block, so the /v2/* mesh-only matcher keeps covering both names -- for
pre-migration tags and for runners holding it as their registered instance
URL.
Mesh clients now pin both names in /etc/hosts: the new one as registry host
and token realm, the old one for pre-migration tags. runner-vps2/config.yaml
carries both --add-host entries for the same reason.
Also renames Centralis' endpoint to mcp.jinemi.com in the two places this
repo names it; Centralis itself is provisioned outside this repo.
Host-side steps this cannot do (documented in deploy/forgejo/README.md,
"Host-side steps"): the Forgejo Actions variable REGISTRY_HOST, docker login
against the new host, and the /etc/hosts pins.
2026-08-01 23:06:22 +00:00
|
|
|
# docker push dev.jinemi.com/jinemi/thermograph/ci-runner:vN
|
2026-07-25 04:13:47 +00:00
|
|
|
#
|
|
|
|
|
# Cutting over the live runner to a new tag means editing the `labels` array
|
|
|
|
|
# in ~/forgejo-runner/.runner on the runner host directly (same runner
|
|
|
|
|
# id/token, no re-registration needed) and updating register-lan-runner.sh's
|
|
|
|
|
# LABELS default so future re-provisioning picks it up too.
|
|
|
|
|
FROM node:20-bookworm
|
|
|
|
|
|
|
|
|
|
RUN apt-get update -qq \
|
|
|
|
|
&& apt-get install -y -qq --no-install-recommends \
|
|
|
|
|
ca-certificates curl gnupg git python3 python3-yaml \
|
|
|
|
|
&& install -m 0755 -d /etc/apt/keyrings \
|
|
|
|
|
&& curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \
|
|
|
|
|
&& chmod a+r /etc/apt/keyrings/docker.asc \
|
|
|
|
|
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" \
|
|
|
|
|
> /etc/apt/sources.list.d/docker.list \
|
|
|
|
|
&& apt-get update -qq \
|
|
|
|
|
&& apt-get install -y -qq --no-install-recommends docker-ce-cli docker-buildx-plugin \
|
|
|
|
|
&& rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/docker.list
|
|
|
|
|
|
|
|
|
|
RUN docker --version && docker buildx version && git --version \
|
|
|
|
|
&& node --version \
|
|
|
|
|
&& python3 -c "import yaml; print('PyYAML', yaml.__version__)"
|
