c966ac4801
All checks were successful
secrets-guard / encrypted (pull_request) Successful in 5s
PR build (required check) / changes (pull_request) Successful in 9s
shell-lint / shellcheck (pull_request) Successful in 8s
PR build (required check) / build-backend (pull_request) Has been skipped
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Has been skipped
PR build (required check) / gate (pull_request) Successful in 2s
docker-stack.yml previously had no cpu/memory limits on db or forgejo, unlike every service in the app stack. Add generous limits (several times observed steady-state usage) as a backstop, overridable via env vars matching the app stack's convention. Also add ci-runner/Dockerfile: a slim Debian base with the Docker CLI + buildx preinstalled, replacing node:20-bookworm (leftover from when the frontend was Python/Jinja; nothing in CI uses npm/node anymore). Closes a COPY --chown group-resolution bug in the classic Docker builder that apt-get install docker.io currently pulls in on every build-push job, and drops that install step's cost once cut over. Built and verified locally; not yet pushed to the registry (needs a write:package-scoped token) or wired into the live runner. |
||
|---|---|---|
| .. | ||
| db | ||
| forgejo | ||
| migrations | ||
| openmeteo | ||
| secrets | ||
| stack | ||
| swarm | ||
| twa | ||
| Caddyfile | ||
| deploy-dev.sh | ||
| deploy.sh | ||
| migrate-db.py | ||
| POSTGRES-MIGRATION.md | ||
| provision-agent-access.sh | ||
| provision-dev-lan.sh | ||
| provision-mail.sh | ||
| provision-secrets.sh | ||
| render-secrets.sh | ||
| thermograph-dev.service | ||
| thermograph.env.example | ||
| thermograph.service | ||