1660de6cc6
All checks were successful
PR build (required check) / changes (pull_request) Successful in 6s
secrets-guard / encrypted (pull_request) Successful in 5s
PR build (required check) / build-backend (pull_request) Has been skipped
shell-lint / shellcheck (pull_request) Successful in 8s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Has been skipped
PR build (required check) / gate (pull_request) Successful in 3s
A single PR push fires pr-build, secrets-guard, and shell-lint as three independent workflows with no dependency between them, so the previous capacity (3, an earlier undocumented hand-tune of the tool's default of 1) already serializes build-backend/build-frontend/validate-observability behind them even with 16 idle cores on the runner host. Raise to 8 and track it in register-lan-runner.sh so a re-provision doesn't silently drop back to the default. Also document why more capacity belongs on the desktop rather than a runner on prod/beta: docker_host: automount gives job containers the host's own Docker socket, which on a live app or Forgejo host means any CI job gets root-equivalent access to what else is running there. An earlier stack revision did run the runner on beta and was reverted for this reason.
108 lines
4.5 KiB
Bash
Executable file
108 lines
4.5 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Re-points the existing LAN dev self-hosted runner from GitHub Actions to
|
|
# Forgejo Actions. Run on the SAME machine that already runs the GitHub
|
|
# runner (see DEPLOY-DEV.md) — this replaces that runner, it doesn't add a
|
|
# second one. Sudo-free, systemd --user, same pattern as the app service.
|
|
#
|
|
# This is THE runner (docs/runbooks/implementation-handoff.md Track B step 5
|
|
# — canonical placement is the desktop, not a Swarm-hosted container), so it
|
|
# registers with BOTH labels the workflows need, where one runner used to be
|
|
# two: general CI/build/deploy.yml jobs (`docker`, containerized via this
|
|
# machine's own already-installed Docker — no Docker-in-Docker sidecar needed,
|
|
# unlike the Swarm-hosted design this replaces, since a real host with a real
|
|
# Docker install needs no such indirection) and the LAN-deploy job
|
|
# (`thermograph-lan`, bare/host-native — it writes to ~/thermograph-dev and
|
|
# restarts a systemd --user service, which only works running directly on the
|
|
# host, not inside a container).
|
|
#
|
|
# bash deploy/forgejo/register-lan-runner.sh <forgejo_url> <registration_token>
|
|
#
|
|
# Get <registration_token> from the Forgejo web UI:
|
|
# repo -> Settings -> Actions -> Runners -> Create new Runner
|
|
# (or an org/instance-level runner page, if you want it to serve more than
|
|
# this one repo — same as the GitHub runner did).
|
|
set -euo pipefail
|
|
|
|
FORGEJO_URL="${1:?usage: $0 <forgejo_url> <registration_token>}"
|
|
TOKEN="${2:?}"
|
|
RUNNER_DIR="${RUNNER_DIR:-$HOME/forgejo-runner}"
|
|
LABELS="${LABELS:-docker:docker://git.thermograph.org/emi/thermograph/ci-runner:v2,thermograph-lan}"
|
|
|
|
echo "==> Stopping and disabling the old GitHub Actions runner service, if present"
|
|
systemctl --user stop github-actions-runner 2>/dev/null || true
|
|
systemctl --user disable github-actions-runner 2>/dev/null || true
|
|
|
|
if ! id -nG "$USER" 2>/dev/null | grep -qw docker; then
|
|
echo "WARNING: $USER is not in the 'docker' group — the 'docker:docker://...'"
|
|
echo "labeled jobs (general CI) will fail to start a container until this is"
|
|
echo "fixed: sudo usermod -aG docker $USER && (log out and back in)."
|
|
fi
|
|
|
|
echo "==> Installing forgejo-runner into $RUNNER_DIR"
|
|
mkdir -p "$RUNNER_DIR"
|
|
cd "$RUNNER_DIR"
|
|
if [ ! -x ./forgejo-runner ]; then
|
|
ARCH="$(uname -m)"
|
|
case "$ARCH" in
|
|
x86_64) BIN_ARCH=amd64 ;;
|
|
aarch64) BIN_ARCH=arm64 ;;
|
|
*) echo "Unsupported arch: $ARCH — download the right binary by hand from" \
|
|
"https://code.forgejo.org/forgejo/runner/releases" >&2; exit 1 ;;
|
|
esac
|
|
VER="${FORGEJO_RUNNER_VERSION:-6.3.1}"
|
|
curl -fsSL -o forgejo-runner \
|
|
"https://code.forgejo.org/forgejo/runner/releases/download/v${VER}/forgejo-runner-${VER}-linux-${BIN_ARCH}"
|
|
chmod +x forgejo-runner
|
|
fi
|
|
|
|
echo "==> Registering with $FORGEJO_URL (label: $LABELS)"
|
|
./forgejo-runner register --no-interactive \
|
|
--instance "$FORGEJO_URL" \
|
|
--token "$TOKEN" \
|
|
--name "thermograph-lan-$(hostname -s)" \
|
|
--labels "$LABELS"
|
|
|
|
echo "==> Runner config (docker.sock automount so docker:-labeled jobs like"
|
|
echo " build-push.yml can actually run 'docker build/push'; capacity raised"
|
|
echo " from the default of 1 -- a single PR push fires 3+ independent"
|
|
echo " workflows (pr-build, secrets-guard, shell-lint) simultaneously, so"
|
|
echo " anything less than that serializes jobs that could run in parallel)"
|
|
CAPACITY="${CAPACITY:-8}"
|
|
./forgejo-runner generate-config \
|
|
| sed -e 's/docker_host: "-"/docker_host: "automount"/' \
|
|
-e "s/capacity: 1/capacity: ${CAPACITY}/" \
|
|
> "${RUNNER_DIR}/config.yaml"
|
|
|
|
echo "==> systemd --user unit"
|
|
mkdir -p "$HOME/.config/systemd/user"
|
|
cat > "$HOME/.config/systemd/user/forgejo-runner.service" <<EOF
|
|
[Unit]
|
|
Description=Forgejo Actions runner (docker + thermograph-lan)
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
WorkingDirectory=${RUNNER_DIR}
|
|
ExecStart=${RUNNER_DIR}/forgejo-runner daemon -c config.yaml
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|
|
EOF
|
|
|
|
systemctl --user daemon-reload
|
|
systemctl --user enable --now forgejo-runner
|
|
loginctl enable-linger "$USER" 2>/dev/null || true
|
|
|
|
cat <<EOF
|
|
|
|
Done. The runner now serves Forgejo, not GitHub — one runner, both labels
|
|
($LABELS), replacing what used to be a separate Swarm-hosted runner for
|
|
general CI plus this machine's own GitHub runner for LAN deploys.
|
|
status: systemctl --user status forgejo-runner
|
|
logs: journalctl --user -u forgejo-runner -f
|
|
restart: systemctl --user restart forgejo-runner
|
|
|
|
The old github-actions-runner unit was stopped and disabled but not deleted —
|
|
remove ~/actions-runner by hand once you've confirmed Forgejo deploys work.
|
|
EOF
|