halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

build(ci,deploy)!: the runner at home in a nightly window, deploys by hand (ADR 0039, D6, D13, D16)
Some checks failed
CI / check (push) Has been cancelled
Details

Browse source 
The CI runner moves to halkyon.li's host at home and runs from 02:00 to
05:00 alone: a timer starts it, its unit's RuntimeMaxSec ends it, and
night.sh rests the instance's heavy sidecars around it as deploy, while
Caddy, PostgreSQL and the apps' servers keep serving. Jobs pushed during the
day wait in Forgejo's queue.

Its sandbox fits the new host: its folder on the HDD, the rest of /data
hidden, containerd's store out of reach, no private IPv4 network and no
IPv6 at all (the home network's IPv6 addresses are public ones under a
changing prefix, on the internet's own interface), 5 GB of memory with swap
beyond. The Sandbox step checks the tunnel, the home router and IPv6.

BREAKING CHANGE: CI deploys nothing any more: the deploy job goes with
learn.halkyon.eu's server, and halkyon.li deploys by hand with redeploy.sh
once a commit's night's run passed. Jobs run on the runner labelled
balthasar; sahaquiel's runner picks up none.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-11-08 19:20:11 +01:00
commit c8d67b1eb7
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 401 additions and 76 deletions
Download patch file Download diff file Expand all files Collapse all files

35
deploy/host/README.md
View file

@ -129,5 +129,36 @@ for the later.
6. **Reboot**, at home, to see each step hold: the passphrase over SSH (step 2), no
desktop (step 3), Docker on the HDD (step 4), the tunnel up before Docker (step 5).
The instance itself follows (its users, checkout, `.env` and first deploy), once its
compose files for Meditate and Jellyfin are built.
The instance itself follows (its users, checkout, `.env` and first deploy). Then:
7. **The CI runner in its nightly window** (D6, D16), once `deploy` and its checkout
exist. Its user, its folder on the HDD, Forgejo's runner (v13.1.0, the version
`../runner/config.yml` is written for) and the units:
```sh
sudo useradd --system --uid 61000 --user-group --no-create-home \
--home-dir /var/lib/forgejo-runner --shell /usr/sbin/nologin runner
sudo install -d -o runner -g runner -m 700 /data/forgejo-runner /var/lib/forgejo-runner
sudo install -m 755 forgejo-runner /usr/local/bin/forgejo-runner # v13.1.0, its checksum checked
sudo install -d -m 700 /etc/forgejo-runner
sudo install -m 644 deploy/runner/config.yml /etc/forgejo-runner/config.yml
sudo install -m 644 deploy/runner/forgejo-runner.service deploy/runner/forgejo-runner.timer \
deploy/runner/halkyon-night.service deploy/runner/halkyon-night.timer \
deploy/runner/halkyon-morning.service deploy/runner/halkyon-morning.timer \
/etc/systemd/system/
```
In Forgejo (`code.halkyon.app`, the repository's *Settings › Actions › Runners*): a new
runner, `balthasar`, its UUID into `/etc/forgejo-runner/config.yml` (`RUNNER_UUID`) and
its token into `/etc/forgejo-runner/token` (root, 0600); sahaquiel's runner removed
there once it is gone. Then:
```sh
sudo systemctl daemon-reload
sudo systemctl enable --now forgejo-runner.timer halkyon-night.timer halkyon-morning.timer
systemctl list-timers 'forgejo-runner*' 'halkyon-*' # 01:55, 02:00, 05:00
```
To try it by day: `sudo systemctl start forgejo-runner` (it stops itself three hours
later) and push a branch. The job's first step, *Sandbox*, fails if the runner
reaches the instance, the home network, the tunnel or any IPv6 address, or sees `/data`.