Tizian 「ティツィアーン」
c8d67b1eb7
Some checks failed
CI / check (push) Has been cancelled
The CI runner moves to halkyon.li's host at home and runs from 02:00 to 05:00 alone: a timer starts it, its unit's RuntimeMaxSec ends it, and night.sh rests the instance's heavy sidecars around it as deploy, while Caddy, PostgreSQL and the apps' servers keep serving. Jobs pushed during the day wait in Forgejo's queue. Its sandbox fits the new host: its folder on the HDD, the rest of /data hidden, containerd's store out of reach, no private IPv4 network and no IPv6 at all (the home network's IPv6 addresses are public ones under a changing prefix, on the internet's own interface), 5 GB of memory with swap beyond. The Sandbox step checks the tunnel, the home router and IPv6. BREAKING CHANGE: CI deploys nothing any more: the deploy job goes with learn.halkyon.eu's server, and halkyon.li deploys by hand with redeploy.sh once a commit's night's run passed. Jobs run on the runner labelled balthasar; sahaquiel's runner picks up none. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
48 lines
1.8 KiB
YAML
48 lines
1.8 KiB
YAML
# The Forgejo Actions runner of this repository's CI, on halkyon.li's host at home (ADR 0039,
|
|
# D16), in the nightly window alone (forgejo-runner.timer). Installed as
|
|
# /etc/forgejo-runner/config.yml, read by forgejo-runner.service (next to this file).
|
|
# Written for forgejo-runner v13.1.0; its full reference: `forgejo-runner generate-config`.
|
|
#
|
|
# Jobs run directly on the host as the unprivileged user `runner`, never in containers:
|
|
# running containers would take Docker access, which is root on the instance's host.
|
|
# The systemd unit keeps the jobs away from the instance and the home network.
|
|
|
|
log:
|
|
level: info
|
|
job_level: info
|
|
|
|
runner:
|
|
# One job at a time: CI shares the machine with the instance.
|
|
capacity: 1
|
|
timeout: 1h
|
|
shutdown_timeout: 10m
|
|
fetch_timeout: 30s
|
|
# How often to ask Forgejo for work. The default (2 s) is needless load on
|
|
# code.halkyon.app's server, a one-core one.
|
|
fetch_interval: 10s
|
|
report_interval: 1s
|
|
# `runs-on: sahaquiel` in a workflow means: here, on the instance's server, on the host.
|
|
labels: ["balthasar:host"]
|
|
|
|
cache:
|
|
# No cache server (it would listen on a port of its own); the SDKs and package
|
|
# caches of host jobs stay in the runner's home between jobs anyway.
|
|
enabled: false
|
|
|
|
container:
|
|
# Never talk to Docker.
|
|
docker_host: "-"
|
|
|
|
host:
|
|
workdir_parent: /var/lib/forgejo-runner/work
|
|
|
|
server:
|
|
connections:
|
|
code.halkyon.app:
|
|
url: https://code.halkyon.app/
|
|
# From the repository's Settings → Actions → Runners → Create new runner. Not a
|
|
# secret; the installation replaces the placeholder.
|
|
uuid: RUNNER_UUID
|
|
# The token is kept in /etc/forgejo-runner/token (root only) and handed over by
|
|
# systemd (LoadCredential in the unit).
|
|
token_url: file:$CREDENTIALS_DIRECTORY/token
|