commit 34a5c69d8105a488c9fdd0b36e8650ecf2812f48
parent 624cdb4326390904edc4d711c1b546880badc879
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Fri, 10 Apr 2026 03:04:51 +0200
more fixes
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
2 files changed, 170 insertions(+), 174 deletions(-)
diff --git a/apps/talos_cluster/jenkins/instance/jenkins-casc-configmap.yaml b/apps/talos_cluster/jenkins/instance/jenkins-casc-configmap.yaml
@@ -4,7 +4,7 @@ metadata:
name: jenkins-casc
namespace: jenkins
data:
- jenkins-casc.yaml: ENC[AES256_GCM,data:bPbjTJRG4paeoJe6+pdWLpg3i7DPPL93AO4vLXLAGUSSZSVz/LuqNtF2PJqJWpW65aBv9CuWgfqXwzJPN1sdqRYPG+Nd0H0VUEHxli1Uc5RjH9TI6o1fYBLg7Lx4E8T0D7gre5OZ0bFJOTsmE3LNfFiBREutUVUc9o7JUHtfOnkcGaoDUepmS9t8Rj5n4Te1JL8KmiGhEniIf1Jt4fApJlqAqiw5W3dX1IJyc6MH6FfgY5jIU/va0E1gJHam41u6/kFw2vgJYA+grcopGDGSVl/Q4tPGex/ePWAAir9JNq+5eerJfgHW10zUf8mLIlDI/nSoTg+OALoSF3wITtdul1BfKUo1Vw8NHydzAZcZyhXxKF9Z6pNQj7f+Cw+427xRrrq6a82pNpnVTUJRRF3nhXysWDykSMg1lmEggcHE4qKfw/HH6lLzbKtFDqDE3ijmBO3x62lURc9mjVYrP21LBURrxeZiyG0u40/EHVCPNOGefunatJgIcM5CZ6JSSgpxqHWd1TeHdl7NiArwA1Ydj0GI0F69292FzbJNSCcEWwrmZ+3ml7qdYvvqj3ZsB3uMm+dgB20qy7vsFu4GV2PJVkSxFD9gQgrg7AdjB7plt93ZYfZ66R/7YQLwYyT5hCjhtvTE5f1IjzID6goRAE1+wfokj8+55i1jZlZyOmPxuveFQD3stQYdmXiDHUSr2VWNjimCdOe+dwXhcBW09JqZK2ePl90keE5tcr9wRhu2A20dqN+w2ur/8rzC/nGf1/VF9gOWLXb2DRroo6+Sc6qHcgNcKlEfPBWUKUGhfozU7c4tYF6+cDGY0FE4VKl3ARoHNtY0YdZEl+NPfCwBN7oxA1z5abcOxyHRWmMK2pWABXcR32OjpTbTkS0VmJj+fuiXqNPIAxLlYwqb4Ts1HafonCOqhp0CDf5spNuG+HmGe90zLxHKc7rHART/jWZQSIcQXWhAgaAMcmA2TznMJCFsM8EyCw5JD67paFUljxDEDn+aBT8G1uVtoHMSjpyBBjYdtUaq9a1+XdWfrHaCxzcP2N9mjdZVYjazn/XFycgBhLQLorJEJ3zCXkJ/4FNlUwuDOTU1ESZy5sdDnt+9fuzG8LFif+H2XUQVlQ8ZCIDJX69yGVTM2OsrLH+bhncTqOwBViOxhp9tu1sTK5iaHWgYncaB64dg579GLAQbtp9Xety1T5y71EKqMQpUA7WyQnNuIe2dCjqYTTOf+c6OJFoNA/KjZ27XD5vCX8Wp/MSudb95VWeThQkmpsj81a9ocLzDpUGjHFD58PbulqygacnwCv9fgxYY7HlKMysKCZfT2UB0F/2+qmccPkyXiQH6vdVoS9xUB/e2b60BCn5iRY1r7RVV7JyUuXVfaVcGPnBcd1ckA8fWL0rMjqrO7n/3D8JindrCuF6YfiIaQzBxbE8E9x0cFpnIG2OBA2By3Wd2SXOh9HgWi3cS85+QT3RnepRhU/A26J81pK3kZv7u2Cli02M2+1aFY438r73pAvGuqhJYwwKNOt8Meg9bCwQJDcK4uQWAq05bGc+DXeblWS8654lSieERzBOe2XVKea5z4wWzBVvqnud9Tt8Fv+O6/BBbvE6IzQ4D2LlNmwaW7cG6r3ycHoiufrSSMZyd9z6Lj4C7FdHIsCLHIuTeL35u8zh48kZct63c/wIPdThihqRnmj+xGzgYSyhZJ00/ZzrJfDosxrNYv4Nkim172xj/DhRFLnpO0T7lAH9ZU8dtfvI5CPa5OjQ4fmQGaX+v3Hi87Ziqzujf6UoHJm6fRuOD9qjiQOL7RZQAFBc8/r1BVo+fOKn8J0WUau2UuxGy4ShWWXY/34vU+xOY61jQn63owZfCnKc0NRJaQ5smsd8il5n6B352k8PDQHZkNGyvrQa7OfNvkPQbO3tDFMYlxDQIMzCecW0CpMd+8KbcAI0PT6LLra6xYYq+5dvaGAIpCXbatIaFS9GQ0uEh/510sqbA0yXqT7DiNvjrYW6HKzeD1cxTmqcc2HmxoOh5fx069sitsorssQRjP9Pq1usm+xbGK/6CgsSf9lBU8HE078nMxzvDRdi1Nl8ddw8xeBVEbCClVCoLNQgLdMMisLsD7VD2bWIVC6IssicfMe4pzC3rgZn//DIJPEph2zgCUd6GCPKvwcsnzqgr7he27uA4PdT76S6SbzORJXfKWyKIqZns2NFHuGGuyEDdc5RnjG+QPKn9pyyVdZWvh7eOLcpArKd2so3kocKuSzAlWZbJ53le7whdDRb/SmmZUiC7Rq/rPln7CwcRhdgy7ASwtI88SmQZRaDU8q7ak/CQAhdxKOimZrEGfqvmd+7SZuM3y1zTHutblXTuDq7c1m6ihvVB3+wuFDq3e7QmgA42CbWTnZoAgNlyPtCrtXYmuW7yTq3fF2sK8sqFotORV1xwfCyoHf8zz+O5TNHYUJ39TjTiq9fOLL4vr64DAiNJkTI15W2z2erHhg4yzw6qof/2BJ16Nsxa07+DPs1KspAQpNXx8p46ZzDWvWe0TmA3/d4iwSE2nHVGVPCikXSujGMavXAcgOr1qp/isCFcJR15a8DmA9aj1l9lqRisX8hn4Zf0sTXNGhJtL2aN5XHyPpa+sN3vglV36OVpQVrc4mx/+Y/Yt57G98Vu9kAmrakAitZw5itcFJBXowFzMv1OoF9qudw0,iv:eDC5hgg1nysXDN6fdSCmIxPZ4Lss5f4BCb2uvFSrCps=,tag:c4AJ10rFJKuanC2aDTLTgA==,type:str]
+ jenkins-casc.yaml: ENC[AES256_GCM,data:x59VvCM4HMIupISlqiqj4aXEt1HLfNW9CQeC6PHDEnEwo7aHr6XgRAk+k6OHD4L69cRXamEnqplBkQpuM+XljUdEzdvDCNYgr9Lw7JXgFimIYzfxgEvT7qwzAeJy9DkSUPGxXqIHxfv3kjR9iaNuNryBcQm7VaPS9p/PL29MqBPUTj3zuxoUVFYNNuvLcYQXP0XljTpVGDPwt72YBwsSTw0KDsp/JcNo4RxlKjDM66D/xSq4SYYEvAaEf87GyJuwdN53OvwnIfuElYCF5od+dMXhAOK90ENt3exj1i7kY8hREj4ZqOhWJh2X9dwh8BVUhGACYl+yfv0etmZsMcToKvT8OHVXwc3YdzVvBFu+mL5DfND04T85Mb9r0LqPcsf+YvbOlq3KamBAY3cxRgX1Fm0dLLIUbTKJg/RNMMvhX2iBH+cgcwSjhOnu69kg9cV3tJx8ajGcgeJ6aCpuKWIOiIMpPLxz2FFS+YPw1Dic/fVJGDpyJS0HaTK+6y42Y2Yt1Q7RRQ+wli8iK4qDGxQ294KTf8Mdhh4cBdrJzSc8dy2iu55dPRyj/cXOpUgXspauXp3itViGDOwL6IsmxurULp4Bsj8tLgOow/VT4vLVYDAkDD+K4RSsR7zF6aAR71hF65gHSSBFmY/JeThJM2sWRWit8ybxLxeyeRsEOs6aWFLR9vBSo1+6dut8HL+vRAIEqYJzkX/N/FR5+7RDpFi6cApKuAZV/kVbPaSW//8KIEhq5df5F2gDJYF1679d9rqx4kewyGNB552cHkM71QGWW+OSqOunTb/apNmtB2480g7O5EC24cA8MuhdNNGnkAqY+Se9wJb8rqNaT4j6QVtRpDAQGXpibFtdUS/Ujot+sYZO17nETipGvmcYlBXmyH1YOoPumF8tfLfmE9B2Wrb1jp8BFveKabx4nroV2XKwmyH3UTFSStVlmX3slWS8oSaIl72f38kiUj7ii5kyAe0HUlu+WQN3CoXxnb9I9uEStO6TW/wJuryv4xnwg4ReQv8VaroQciaXEnXZJYTwHuZMGKTIdbKF2TwG9mxDVBnAlIk7SqJKY1ag4BwCUeJnMv4nJLnhGzEQvVmAORcVBex1ex8Xwr0Tz/AAbeRnEHysC0hrF6THS4PF8P8gCEWJV3qVGVpWeeSd1meHFVQ2K3nX8dneHOKrh1JImvXTSFIzrUs58qvpWC0Mz6sWUAC0dvRpx2YNBwe9W2AwmIoV8bK9ucRfXwBogh+Z+h3zRkwciAsQ0zFmVz0oGGRnneo2PVjufam5EZ1YBol5m8JLScfl7fhu0Hd+O/l/pkxKk636icY6eEP0zXp9Az3FHEzcj0k+vIVMewbBnWyyzrEdQxQ8fSQW8jBFUQyPCMBAKJIhk4D7RaxtSlDssetOSUmsAiWNMOspdEH+7rQ4mvCP+uLIvrjGf+3jqTSFaNDJHXA7a/Na+JxgR7HUC4OObi1d5QcDDQT+NhRj+QnJiRVUkUaOqWYvCwZNv0sdkdaE1duTyJ/yB7ZTm/0kjgpjH2HYKi1NSzH9At5LVe5iZwePgniYo5qxFlo6VKGwA9sxDzDVQleTpXKhmPf/N2Dv7/UpyJTI3CYIqFHI7VVwJnbUmyf9mJFE+9As2qoyU0V/dWSR1yPpDDZN98vJbE4I81keVKho03frnoHyeqF9aoqtutse+4A+YnZhviqlPDRIDW2XI7Ntha+MbJW84S4grMGQYJCBaXLF+PSP1Qb2RkctiHVrHWbFYIY8Pl9ahXGInsntiSXac4DTfzMs9f4uWi1q8dvtnGk5R2o0QyWjJojuoD9q6/WLsu0ckjIdHTOFLSlx+Ox3d62ARhtQE5JgR1rI4oG66sv1MBCGruzLMNye8ng2QkIRzY69aWkAPk3oCiqiKi9AUy5CMU8CMSIs50gC/28C7Mx38VXffFsATrqTWxdU4czh5bgcDu7/jZJIXIva50kzh+0tzcGsUCFfJ2MmVGyfnKiubdMZd5CCLP0sljYSack7ePapvgw5l3lDTbXarkPdWbft3kM7jtUsnU5kM9/OkAQXLyXnO8A+L9s1W5GFQ7q+5NlUKBW7byRXT1XoJ0WPrEyNh1h+aM47beQwfiBqQILHelP7zPfpsjZ0hkCaL0jYofnb2ZkR5zWQIdcVJU4BtSkbtfuICjZrV5OIXbqjYksIbC2CH/gderyn+q8G5fHkDyGFZMC6JG2rww41lqWKon/RpHb3/BaJGhgpPA3ljWUQtu0jAkai2W+ec1yi7pxpfvyLOj3wleo5BGUStOC/W5a9IgL0Botr6zA/1umGB8hVf2kKeA8c6MDlPwZ630JmgKEstuJSftL0A5/REatFEAnprWnP1jOr7kYY1rHbMGPMQgqcehJtXMugunFrqH1illoND2aigXVvf0MTSFQt7vF5N1yLBfuVAga4nw7UiRmelCW0DHX1FQCynKI7K8a++DQMKAhty3/h7r/9zICUlgnMgwL0CLkjOhulhQ0KWkpfUeDWlA8ZENdwl53fOHym/Rj50PxDRBApnNO42SzVVUQXGIkdN98j388nfGBLOCUjd1x5xJ0uCnAtfg4W4G8oqv3PUa0UqtSGbVD7fy0Xw4bYFxpwVOk6P96+JdWKtcO+YJu8HocPFRgmn+NZYKiioXpMBuTSC0sa/3qqsj7m5ozPAZyJIf4koonv/XbNnffaRkw7ayTYNA2/VHw4ZzL4wu92Ps+2HmIBE0m8y1dSBlJQ1FozzSdPFpBGd/CAkterVMzzrOzFL9nU0UzLILj5eHCYw8RMyydIdEhyWzUcLsHL0ZYonQQ23dm6ivHOBTkS5bdlcDMl+2zN/DY7+gRnMZSsJhKjWr2XCdwwNysXPRjegInaePrDBXCSM7iOH9kosFZi2bRy2wJZWqnuyz88HBQ7sYobywnzm1Hif23yQWJ82lMBmjPxLY6jBbmxMia7g1oFZn4FA0u6TTGhmY6alW3dmIb438rQoKkna+dHx4eLIXo/0dY1idMXiDIxp40HoWd37zR5S0h6d8QgJUjjpPIEmO98xAyX3uSceYGxnFwae2VDjOmmA2EKBiYeEPhxBwtvIiNut5ITg4h1ydoY4dbMSD5bk3lYGbkF+0NszAQDLW8kZzPypbn5YmDia/jqFYC/coYNE6iBKyPLxM5+4vpbIVjyF/qsG5DnAURUADxBIXZTZfSmSb+j8C7/aySakhaih4ZSGBhGvZma32MeQFA8MLDnWiR8He4=,iv:DeNfXXcJZB7OFZ2aypZJ99KX6vIloruytlfBcTvjX/A=,tag:879ZCvVVCmCCcUDqZhkqXw==,type:str]
sops:
kms: []
gcp_kms: []
@@ -14,14 +14,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1NW9MUDFISjRmRHdOTFlP
- aHA4Q2tCalBsM0ZnVU1JazAyc0xMR0J3M1IwCktKU3grRWpqTDdFRG5XOWdRVUgx
- VnZzZnU2YU16eWxOcGhDcFZJanllVUUKLS0tIHRqS3lmYmVIM1dFWmY2VXJFdklR
- WTZmOFovNmJHRCtnTlByV2E5djZqZFkKEFk3ZvS65uNfL7oOYo0IgWb1y5pp4tQU
- s3yqzcDgJ0xBXlAv8FW+KnOWPQaqIJW9+SFDsjNWh6dtDObplzXc6Q==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3MzFKdlE0c1Exc3FpTmJl
+ WWZkTXNJQWJUa2RmdG1vb0pvWTJpV2tpV1VjCnE5VUxnVklzWEdNMldWR0VNUmJ3
+ Q3NDTXU0cXoyZHFmZkhqdHQvTE1LbWMKLS0tIG93QVFLYjZMNzFpUU5BZTdGZTNS
+ aEYrOTc0ejdDYkdSVkJwOU1RWWovMFUKJIbMffChdRjy2eHXxjqUKMRmyn1rsGp1
+ tGN/qTneIhbsFzozq9Qt12BRTCTknp0UnVThREc5S5Y/dsjqHY9Qyw==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-04-10T00:50:46Z"
- mac: ENC[AES256_GCM,data:obrRK7ryq89etQLSV98XmATOoXoYj6EHqtTWTxSQpWUfXi0O6ap8EkUzhvmohCA3/N+4PhuLRl6BR7VcrV8O/VdlTLjvte8KPvigDu7i1gz40mDYrHhpbTBcNOb+uzEDLguXDR9IHXtTsCnZPQw6FzUwl1gbzFhmLSNHpaO0TDw=,iv:PlW0Kb+MmrfWY7GOcFsrugwYxRBoUwpWMqia0wV/EMs=,tag:COnskFh/i33gHDPOgjCTBQ==,type:str]
+ lastmodified: "2026-04-10T01:03:22Z"
+ mac: ENC[AES256_GCM,data:nMOVWPrMLT7y5D0TdnY1tJ4au+BxIUaBN0e7p707U7pX/9l8GjoB/Y87aJuhdVvE2wfln7jbhhe6Oz158e/zYg/Xq+q+3GxkrZI8rli+r/rnNVt+/W14u26S12Kj0601NapU/48OCRoO/qILnVwjMw8wjqj0W8rGviZqqZPzM4k=,iv:AN2XKmTYs+Aot5BTzzSjlf9Z7dYTmy/my9asMfn0IM4=,tag:xSQCS7wNnIa9y91OfAaq1A==,type:str]
pgp: []
encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret|content)$
version: 3.9.1
diff --git a/apps/talos_cluster/jenkins/seeds/jobs/gitops_multiarch_builds.groovy b/apps/talos_cluster/jenkins/seeds/jobs/gitops_multiarch_builds.groovy
@@ -18,7 +18,11 @@ pipelineJob('gitops-multiarch-builds') {
cps {
script("""\
pipeline {
- agent any
+ agent {
+ kubernetes {
+ label 'build-agent'
+ }
+ }
options {
timestamps()
@@ -131,178 +135,170 @@ pipelineJob('gitops-multiarch-builds') {
}
def build_matrix_backup() {
- echo "=== Building matrix-backup ==="
- docker.image('docker:latest').inside('--privileged') {
- sh '''
- set -eu
-
- mkdir -p ~/.docker
- cp ${DOCKER_CONFIG}/config.json ~/.docker/config.json 2>/dev/null || true
-
- TAG_TS=$(date -u +%Y%m%d-%H%M%S)
- TAG_SHA="sha-$(git rev-parse --short HEAD)"
- IMAGE="${REGISTRY}/mtrnord/cluster/matrix-backup"
-
- echo "Building multi-arch image: ${IMAGE}"
- echo "Tags: ${TAG_TS}, main, ${TAG_SHA}"
-
- docker buildx build \\
- --platform linux/amd64,linux/arm64 \\
- --tag "${IMAGE}:${TAG_TS}" \\
- --tag "${IMAGE}:main" \\
- --tag "${IMAGE}:${TAG_SHA}" \\
- --push \\
- -f apps/talos_cluster/image-builder/matrix-backup/Dockerfile \\
- apps/talos_cluster/image-builder/matrix-backup/
-
- docker run --rm \\
- -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
- -v ~/.docker:/root/.docker:ro \\
- gcr.io/projectsigstore/cosign:latest \\
- sign --key /cosign/key "${IMAGE}:${TAG_TS}"
-
- docker run --rm \\
- -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
- -v ~/.docker:/root/.docker:ro \\
- gcr.io/projectsigstore/cosign:latest \\
- sign --key /cosign/key "${IMAGE}:main"
-
- docker run --rm \\
- -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
- -v ~/.docker:/root/.docker:ro \\
- gcr.io/projectsigstore/cosign:latest \\
- sign --key /cosign/key "${IMAGE}:${TAG_SHA}"
- '''
- }
+ sh '''
+ set -eu
+
+ echo "=== Building matrix-backup ==="
+ mkdir -p ~/.docker
+ cp ${DOCKER_CONFIG}/config.json ~/.docker/config.json 2>/dev/null || true
+
+ TAG_TS=$(date -u +%Y%m%d-%H%M%S)
+ TAG_SHA="sha-$(git rev-parse --short HEAD)"
+ IMAGE="${REGISTRY}/mtrnord/cluster/matrix-backup"
+
+ echo "Building multi-arch image: ${IMAGE}"
+ echo "Tags: ${TAG_TS}, main, ${TAG_SHA}"
+
+ docker buildx build \\
+ --platform linux/amd64,linux/arm64 \\
+ --tag "${IMAGE}:${TAG_TS}" \\
+ --tag "${IMAGE}:main" \\
+ --tag "${IMAGE}:${TAG_SHA}" \\
+ --push \\
+ -f apps/talos_cluster/image-builder/matrix-backup/Dockerfile \\
+ apps/talos_cluster/image-builder/matrix-backup/
+
+ docker run --rm \\
+ -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
+ -v ~/.docker:/root/.docker:ro \\
+ gcr.io/projectsigstore/cosign:latest \\
+ sign --key /cosign/key "${IMAGE}:${TAG_TS}"
+
+ docker run --rm \\
+ -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
+ -v ~/.docker:/root/.docker:ro \\
+ gcr.io/projectsigstore/cosign:latest \\
+ sign --key /cosign/key "${IMAGE}:main"
+
+ docker run --rm \\
+ -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
+ -v ~/.docker:/root/.docker:ro \\
+ gcr.io/projectsigstore/cosign:latest \\
+ sign --key /cosign/key "${IMAGE}:${TAG_SHA}"
+ '''
}
def build_continuwuity() {
- echo "=== Building continuwuity ==="
- docker.image('docker:latest').inside('--privileged') {
- sh '''
- set -eu
-
- mkdir -p ~/.docker
- cp ${DOCKER_CONFIG}/config.json ~/.docker/config.json 2>/dev/null || true
-
- TAG_SHA="sha-$(git rev-parse --short HEAD)"
- IMAGE="${REGISTRY}/mtrnord/cluster/continuwuity"
-
- echo "Building multi-arch image: ${IMAGE}"
- echo "Tags: main, ${TAG_SHA}"
-
- docker buildx build \\
- --platform linux/amd64,linux/arm64 \\
- --tag "${IMAGE}:main" \\
- --tag "${IMAGE}:${TAG_SHA}" \\
- --push \\
- -f apps/talos_cluster/image-builder/continuwuity/Dockerfile \\
- apps/talos_cluster/image-builder/continuwuity/
-
- docker run --rm \\
- -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
- -v ~/.docker:/root/.docker:ro \\
- gcr.io/projectsigstore/cosign:latest \\
- sign --key /cosign/key "${IMAGE}:main"
-
- docker run --rm \\
- -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
- -v ~/.docker:/root/.docker:ro \\
- gcr.io/projectsigstore/cosign:latest \\
- sign --key /cosign/key "${IMAGE}:${TAG_SHA}"
- '''
- }
+ sh '''
+ set -eu
+
+ echo "=== Building continuwuity ==="
+ mkdir -p ~/.docker
+ cp ${DOCKER_CONFIG}/config.json ~/.docker/config.json 2>/dev/null || true
+
+ TAG_SHA="sha-$(git rev-parse --short HEAD)"
+ IMAGE="${REGISTRY}/mtrnord/cluster/continuwuity"
+
+ echo "Building multi-arch image: ${IMAGE}"
+ echo "Tags: main, ${TAG_SHA}"
+
+ docker buildx build \\
+ --platform linux/amd64,linux/arm64 \\
+ --tag "${IMAGE}:main" \\
+ --tag "${IMAGE}:${TAG_SHA}" \\
+ --push \\
+ -f apps/talos_cluster/image-builder/continuwuity/Dockerfile \\
+ apps/talos_cluster/image-builder/continuwuity/
+
+ docker run --rm \\
+ -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
+ -v ~/.docker:/root/.docker:ro \\
+ gcr.io/projectsigstore/cosign:latest \\
+ sign --key /cosign/key "${IMAGE}:main"
+
+ docker run --rm \\
+ -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
+ -v ~/.docker:/root/.docker:ro \\
+ gcr.io/projectsigstore/cosign:latest \\
+ sign --key /cosign/key "${IMAGE}:${TAG_SHA}"
+ '''
}
def build_blog() {
- echo "=== Building blog ==="
- docker.image('docker:latest').inside('--privileged') {
- sh '''
- set -eu
-
- mkdir -p ~/.docker
- cp ${DOCKER_CONFIG}/config.json ~/.docker/config.json 2>/dev/null || true
-
- TAG_TS=$(date -u +%Y%m%d-%H%M%S)
- TAG_SHA="sha-$(git rev-parse --short HEAD)"
- IMAGE="${REGISTRY}/mtrnord/blog"
-
- echo "Building multi-arch image: ${IMAGE}"
- echo "Tags: ${TAG_TS}, latest, ${TAG_SHA}"
-
- docker buildx build \\
- --platform linux/amd64,linux/arm64 \\
- --tag "${IMAGE}:${TAG_TS}" \\
- --tag "${IMAGE}:latest" \\
- --tag "${IMAGE}:${TAG_SHA}" \\
- --push \\
- -f apps/talos_cluster/image-builder/blog/Dockerfile \\
- apps/talos_cluster/image-builder/blog/
-
- docker run --rm \\
- -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
- -v ~/.docker:/root/.docker:ro \\
- gcr.io/projectsigstore/cosign:latest \\
- sign --key /cosign/key "${IMAGE}:${TAG_TS}"
-
- docker run --rm \\
- -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
- -v ~/.docker:/root/.docker:ro \\
- gcr.io/projectsigstore/cosign:latest \\
- sign --key /cosign/key "${IMAGE}:latest"
-
- docker run --rm \\
- -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
- -v ~/.docker:/root/.docker:ro \\
- gcr.io/projectsigstore/cosign:latest \\
- sign --key /cosign/key "${IMAGE}:${TAG_SHA}"
- '''
- }
+ sh '''
+ set -eu
+
+ echo "=== Building blog ==="
+ mkdir -p ~/.docker
+ cp ${DOCKER_CONFIG}/config.json ~/.docker/config.json 2>/dev/null || true
+
+ TAG_TS=$(date -u +%Y%m%d-%H%M%S)
+ TAG_SHA="sha-$(git rev-parse --short HEAD)"
+ IMAGE="${REGISTRY}/mtrnord/blog"
+
+ echo "Building multi-arch image: ${IMAGE}"
+ echo "Tags: ${TAG_TS}, latest, ${TAG_SHA}"
+
+ docker buildx build \\
+ --platform linux/amd64,linux/arm64 \\
+ --tag "${IMAGE}:${TAG_TS}" \\
+ --tag "${IMAGE}:latest" \\
+ --tag "${IMAGE}:${TAG_SHA}" \\
+ --push \\
+ -f apps/talos_cluster/image-builder/blog/Dockerfile \\
+ apps/talos_cluster/image-builder/blog/
+
+ docker run --rm \\
+ -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
+ -v ~/.docker:/root/.docker:ro \\
+ gcr.io/projectsigstore/cosign:latest \\
+ sign --key /cosign/key "${IMAGE}:${TAG_TS}"
+
+ docker run --rm \\
+ -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
+ -v ~/.docker:/root/.docker:ro \\
+ gcr.io/projectsigstore/cosign:latest \\
+ sign --key /cosign/key "${IMAGE}:latest"
+
+ docker run --rm \\
+ -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
+ -v ~/.docker:/root/.docker:ro \\
+ gcr.io/projectsigstore/cosign:latest \\
+ sign --key /cosign/key "${IMAGE}:${TAG_SHA}"
+ '''
}
def build_bookwyrm() {
- echo "=== Building bookwyrm ==="
- docker.image('docker:latest').inside('--privileged') {
- sh '''
- set -eu
-
- mkdir -p ~/.docker
- cp ${DOCKER_CONFIG}/config.json ~/.docker/config.json 2>/dev/null || true
-
- VERSION=$(docker run --rm curlimages/curl:latest \\
- curl -sf "https://api.github.com/repos/bookwyrm-social/bookwyrm/releases/latest" | \\
- grep '"tag_name"' | head -1 | cut -d'"' -f4)
-
- if [ -z "$VERSION" ]; then
- echo "ERROR: could not determine upstream version"
- exit 1
- fi
-
- IMAGE="${REGISTRY}/mtrnord/cluster/bookwyrm"
-
- echo "Building multi-arch image: ${IMAGE}"
- echo "Tags: ${VERSION}, latest"
-
- docker buildx build \\
- --platform linux/amd64,linux/arm64 \\
- --build-arg VERSION="${VERSION}" \\
- --tag "${IMAGE}:${VERSION}" \\
- --tag "${IMAGE}:latest" \\
- --push \\
- -f apps/talos_cluster/image-builder/bookwyrm/Dockerfile \\
- apps/talos_cluster/image-builder/bookwyrm/
-
- docker run --rm \\
- -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
- -v ~/.docker:/root/.docker:ro \\
- gcr.io/projectsigstore/cosign:latest \\
- sign --key /cosign/key "${IMAGE}:${VERSION}"
-
- docker run --rm \\
- -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
- -v ~/.docker:/root/.docker:ro \\
- gcr.io/projectsigstore/cosign:latest \\
- sign --key /cosign/key "${IMAGE}:latest"
- '''
- }
+ sh '''
+ set -eu
+
+ echo "=== Building bookwyrm ==="
+ mkdir -p ~/.docker
+ cp ${DOCKER_CONFIG}/config.json ~/.docker/config.json 2>/dev/null || true
+
+ VERSION=$(docker run --rm curlimages/curl:latest \\
+ curl -sf "https://api.github.com/repos/bookwyrm-social/bookwyrm/releases/latest" | \\
+ grep '"tag_name"' | head -1 | cut -d'"' -f4)
+
+ if [ -z "$VERSION" ]; then
+ echo "ERROR: could not determine upstream version"
+ exit 1
+ fi
+
+ IMAGE="${REGISTRY}/mtrnord/cluster/bookwyrm"
+
+ echo "Building multi-arch image: ${IMAGE}"
+ echo "Tags: ${VERSION}, latest"
+
+ docker buildx build \\
+ --platform linux/amd64,linux/arm64 \\
+ --build-arg VERSION="${VERSION}" \\
+ --tag "${IMAGE}:${VERSION}" \\
+ --tag "${IMAGE}:latest" \\
+ --push \\
+ -f apps/talos_cluster/image-builder/bookwyrm/Dockerfile \\
+ apps/talos_cluster/image-builder/bookwyrm/
+
+ docker run --rm \\
+ -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
+ -v ~/.docker:/root/.docker:ro \\
+ gcr.io/projectsigstore/cosign:latest \\
+ sign --key /cosign/key "${IMAGE}:${VERSION}"
+
+ docker run --rm \\
+ -v ${COSIGN_KEY_PATH}:/cosign/key:ro \\
+ -v ~/.docker:/root/.docker:ro \\
+ gcr.io/projectsigstore/cosign:latest \\
+ sign --key /cosign/key "${IMAGE}:latest"
+ '''
}
