53e2eb7c84
All checks were successful
Sync infra to hosts / sync-beta (push) Has been skipped
Sync infra to hosts / sync-prod (push) Has been skipped
Sync infra to hosts / sync-centralis (push) Has been skipped
Sync infra to hosts / sync-dev (push) Successful in 9s
secrets-guard / encrypted (push) Successful in 5s
Validate observability stack / validate (push) Successful in 12s
shell-lint / shellcheck (push) Successful in 8s
Build + push images (Forgejo registry) / build-push (frontend) (push) Successful in 26s
Build + push images (Forgejo registry) / build-push (backend) (push) Successful in 1m10s
Deploy / deploy (backend) (push) Successful in 1m41s
Deploy / deploy (frontend) (push) Successful in 1m48s
secrets-guard / encrypted (pull_request) Successful in 8s
shell-lint / shellcheck (pull_request) Successful in 9s
PR build (required check) / changes (pull_request) Successful in 20s
PR build (required check) / validate-observability (pull_request) Successful in 15s
PR build (required check) / build-frontend (pull_request) Successful in 17s
PR build (required check) / build-backend (pull_request) Successful in 2m26s
PR build (required check) / gate (pull_request) Successful in 1s
Completes the Forgejo domain migration. ROOT_URL moved to dev.jinemi.com earlier; the registry half was deliberately deferred. Every image name, REGISTRY_HOST default, runner label and --add-host pin now names dev.jinemi.com, so the registry host and the bearer-token realm agree again. Both names address the same Forgejo, so no image needs re-pushing and a rollback to a tag pushed under the old prefix still resolves. git.thermograph.org therefore stays served off the same Caddy site block -- one block, so the /v2/* mesh-only matcher keeps covering both names -- for pre-migration tags and for runners holding it as their registered instance URL. Mesh clients now pin both names in /etc/hosts: the new one as registry host and token realm, the old one for pre-migration tags. runner-vps2/config.yaml carries both --add-host entries for the same reason. Also renames Centralis' endpoint to mcp.jinemi.com in the two places this repo names it; Centralis itself is provisioned outside this repo. Host-side steps this cannot do (documented in deploy/forgejo/README.md, "Host-side steps"): the Forgejo Actions variable REGISTRY_HOST, docker login against the new host, and the /etc/hosts pins.
61 lines
2.8 KiB
YAML
61 lines
2.8 KiB
YAML
# Forgejo Actions runner config for the vps2 runner. Mounted at /data/config.yaml
|
|
# by runner-vps2/docker-compose.yml.
|
|
#
|
|
# Values that differ from `forgejo-runner generate-config` defaults are the only
|
|
# ones written out below; everything else is left at its default deliberately, so
|
|
# a future runner upgrade inherits new defaults instead of a frozen copy of the
|
|
# old ones.
|
|
|
|
log:
|
|
level: info
|
|
job_level: info
|
|
|
|
runner:
|
|
file: .runner
|
|
|
|
# ONE job at a time. The desktop runner uses capacity 8, which is right for a
|
|
# box whose whole job is CI. This runner shares a host with prod, so the
|
|
# binding constraint is not throughput, it is that a CI burst must never be
|
|
# able to contend with thermograph_web for CPU. One job at a time also makes
|
|
# the resource ceiling below exact rather than a per-job estimate multiplied
|
|
# by an unknown.
|
|
capacity: 1
|
|
|
|
timeout: 3h
|
|
shutdown_timeout: 3h
|
|
|
|
container:
|
|
# 1) --add-host: both Forgejo names resolve publicly to vps1, but vps1's
|
|
# Caddy rejects the /v2/* registry API from off-mesh. Job containers that
|
|
# docker-pull or docker-push therefore need the MESH address, and DNS will
|
|
# not give it to them. Same line the desktop runner carries; the value is
|
|
# the same from vps2 because both boxes are on 10.10.0.0/24.
|
|
#
|
|
# BOTH names are pinned, and that is not belt-and-braces. dev.jinemi.com is
|
|
# the registry host in image names AND Forgejo's ROOT_URL, from which the
|
|
# registry's bearer-token realm is derived -- so a pull needs it twice over.
|
|
# git.thermograph.org stays pinned because already-pushed tags carry it as
|
|
# their prefix; unpinned, a rollback to such a tag takes the public route
|
|
# and gets a 403 that reads like a credential failure. See
|
|
# ../README.md, "Migrating the domain".
|
|
#
|
|
# 2) --cpus/--memory: vps2 runs prod. Without a ceiling a runaway job (a
|
|
# `docker build` that fans out, a test that leaks) competes with the
|
|
# production app for the same 6 cores. These bound the JOB container, which
|
|
# is a sibling of the runner rather than its child, so the runner's own
|
|
# compose limits do not cover it -- this is the only lever that does.
|
|
options: --add-host=dev.jinemi.com:10.10.0.2 --add-host=git.thermograph.org:10.10.0.2 --cpus=2 --memory=4g
|
|
|
|
# Jobs may mount NOTHING from the host. The workflows here do not need to:
|
|
# they check out into the job container's own workspace and reach the estate
|
|
# over SSH. An empty list is the difference between "a job can read
|
|
# /etc/thermograph.env" and "a job cannot", on the box where that file is
|
|
# prod's.
|
|
valid_volumes: []
|
|
|
|
privileged: false
|
|
|
|
# Mounts the host docker socket into the job container. build-push.yml runs
|
|
# `docker build`, so it needs a daemon; this points it at vps2's. See the
|
|
# README for what that does and does not mean for trust.
|
|
docker_host: "automount"
|