7ff3873661
Bring the Swarm+Forgejo layer in line with the canonical topology in docs/runbooks/implementation-handoff.md: three nodes (prod, beta, and the desktop LAN dev machine) instead of two, with the Forgejo Actions runner registered on the desktop as a plain systemd service rather than a Swarm-scheduled Docker-in-Docker sidecar. - setup-wireguard.sh: full N-peer mesh instead of point-to-point - docker-stack.yml: drop the runner/runner-dind services, volumes, and runner-token secret; only forgejo_db_password remains - register-lan-runner.sh: register under both docker and thermograph-lan labels, since one runner now covers both job types - init-swarm.sh, join-swarm.sh, swarm/README.md, forgejo/README.md, INFRA.md: updated node lists, order of operations, and access-state table for three nodes - deploy.yml: renamed to "Deploy to beta VPS" and reconciled the main-vs-release branch question against terraform.tfvars.example (this workflow already targets beta; a release-triggered prod deploy doesn't exist yet and isn't invented here)
19 lines
615 B
Bash
Executable file
19 lines
615 B
Bash
Executable file
#!/usr/bin/env bash
|
|
# Run ONCE on EACH worker node (beta, and the desktop — not the manager,
|
|
# prod). Joins the Swarm initialized by init-swarm.sh, over the WireGuard
|
|
# tunnel. The join token is the same for both workers.
|
|
set -euo pipefail
|
|
|
|
MANAGER_WG_IP="${1:?usage: $0 <manager_wg_ip> <join_token>}"
|
|
JOIN_TOKEN="${2:?}"
|
|
|
|
if docker info 2>/dev/null | grep -q "Swarm: active"; then
|
|
echo "This node is already part of a swarm:"
|
|
docker info 2>/dev/null | grep -A2 "Swarm:"
|
|
exit 0
|
|
fi
|
|
|
|
docker swarm join --token "$JOIN_TOKEN" "${MANAGER_WG_IP}:2377"
|
|
|
|
echo
|
|
echo "Joined. Verify from the manager: docker node ls"
|