nickandClaude Opus 5
90a2753a2a
Replaces the Debian VM that hosted the Gitea Actions runner and adds two new hosts on goose, all provisioned by Ignition instead of cloud-init: - oswald-runner: Gitea Actions runner, keeping its registration in /var/lib/oswald_runner on disk rather than running ephemeral, which was leaving stale offline runners behind whenever a job was interrupted. - ai: LiteLLM proxy and the Gitea MCP server. - oswl-connector: tailscaled against headscale, advertising 192.168.7.0/24 and itself as an exit node. Their registration tokens and keys come from Infisical through the new butane_vars plumbing, so nothing secret is committed -- but each one does land in plaintext in the rendered Ignition snippet on the node, which is the tradeoff for having no cloud-init here. The provider gains an ssh block on both nodes because Proxmox has no API for uploading snippets. That, the snippets content type, and the headscale preauth key all have to be set up by hand first; flatcar-todo.md has the steps and the reasoning behind the awkward parts. Co-Authored-By: Claude Opus 5 <[email protected]>
50 lines
2.0 KiB
Plaintext
50 lines
2.0 KiB
Plaintext
variant: flatcar
|
|
version: 1.0.0
|
|
|
|
systemd:
|
|
units:
|
|
# Gitea Actions runner. Registers once on first start and keeps its
|
|
# identity (the .runner file) in /var/lib/oswald_runner on the VM's own
|
|
# root disk -- not ephemeral, so it does not self-delete after each job
|
|
# (that caused stale offline entries whenever the container was
|
|
# interrupted before finishing a job; see flatcar-todo.md). Reusing the
|
|
# same registration also means the token never needs rotating.
|
|
#
|
|
# /var/lib/oswald_runner survives container restarts and VM reboots (it's
|
|
# on disk, not in the container), but not a VM rebuild (taint): that
|
|
# recreates the disk from the image, so the runner re-registers fresh
|
|
# next boot. Old entries from before this change, or from any future
|
|
# rebuild, still need manual cleanup in Gitea's runner admin page.
|
|
#
|
|
# GITEA_RUNNER_REGISTRATION_TOKEN is templated in from Infisical
|
|
# (GITEA_RUNNER_TOKEN in secrets.tmpl) by main.tf, not stored here. It
|
|
# still ends up in plaintext in the rendered Ignition snippet on the
|
|
# node's storage -- see the caveat in flatcar-todo.md.
|
|
- name: oswald_runner.service
|
|
enabled: true
|
|
contents: |
|
|
[Unit]
|
|
Description=Gitea Actions runner
|
|
After=docker.service
|
|
Requires=docker.service
|
|
[Service]
|
|
TimeoutStartSec=0
|
|
ExecStartPre=-/usr/bin/docker rm --force oswald_runner
|
|
ExecStart=/usr/bin/docker run --name oswald_runner \
|
|
-e GITEA_INSTANCE_URL=https://git.atlashorizon.net \
|
|
-e GITEA_RUNNER_REGISTRATION_TOKEN=${gitea_runner_token} \
|
|
-e GITEA_RUNNER_NAME=oswald_runner \
|
|
-v /var/lib/oswald_runner:/data \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
docker.io/gitea/runner:3
|
|
ExecStop=/usr/bin/docker stop oswald_runner
|
|
Restart=always
|
|
RestartSec=5s
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
storage:
|
|
directories:
|
|
- path: /var/lib/oswald_runner
|
|
mode: 0755
|