cluster

commit c301af184b38ad25551a331d4ec34b22e17bdc49
parent ce781caebfa24af762273f0175812f9ffb841f56
Author: MTRNord <mtrnord1@gmail.com>
Date:   Tue, 30 Jul 2024 09:08:45 +0200

setup runner for codeberg

Diffstat:
M
apps/2024_cluster/kustomization.yaml
 | 
1
+
M
apps/2024_cluster/secrets/kustomization.yaml
 | 
1
+
A
apps/2024_cluster/secrets/zertrixt-runner.yaml
 | 
27
+++++++++++++++++++++++++++
A
apps/base/codeberg-runners/kustomization.yaml
 | 
5
+++++
A
apps/base/codeberg-runners/zertrixt.yaml
 | 
77
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

5 files changed, 111 insertions(+), 0 deletions(-)
diff --git a/apps/2024_cluster/kustomization.yaml b/apps/2024_cluster/kustomization.yaml
@@ -21,5 +21,6 @@ resources:
   #- ../base/matrix/syntainer_main_synapse
   - ../base/minecraft
   - ../base/minecraft_homeassistant
+  - ../base/codeberg-runners
 patchesStrategicMerge:
   - postgres-operator-values.yaml
diff --git a/apps/2024_cluster/secrets/kustomization.yaml b/apps/2024_cluster/secrets/kustomization.yaml
@@ -9,3 +9,4 @@ resources:
   - matrix-synapse-signingkey.yaml
   - draupnir-freifunk-config.yaml
   - cloudflare_ext_dns.yaml
+  - zertrixt-runner.yaml
diff --git a/apps/2024_cluster/secrets/zertrixt-runner.yaml b/apps/2024_cluster/secrets/zertrixt-runner.yaml
@@ -0,0 +1,27 @@
+apiVersion: v1
+stringData:
+    token: ENC[AES256_GCM,data:UbQ7i/kxPRrN9mIPUWGXtVLwU3TV1KvGaxawMGxUQOAi9Mt0+qhrtA==,iv:TRXytq3kFLpqrm6emLurq16DwfICrY39zv8MqvEcECw=,tag:+6ndBe82Al0lqfwbiDIJag==,type:str]
+kind: Secret
+metadata:
+    name: zertrixt-runner-secret
+    namespace: matrix
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGTWFTenBkOFFTclphSk5j
+            L2JvYjhpWWFuZ2hpREtXVUVQbERpZjl0dFd3Cnl6R3RBRkRCaWlYajdvTWJXMmZH
+            L0ovT0h3Vk80SmMwSTBVb01xK1oxbjQKLS0tIDVSaThKd0Q4ODN1YzcyTERoM0ZO
+            RXViRERVdFpiOXUzUDcrZkFHbjhCMEUKL4j7dcPFwxHzolMXDRnaZocH2INLuvjs
+            sHTdbZ6AkMbwCylY2ybBtrr0zaLMXt/r4C0tLDg3IuvQjniDFyUwqA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-07-30T07:08:16Z"
+    mac: ENC[AES256_GCM,data:U8bp/SyuN1EHHbDSIssb+j4YuwLpptV0EeBW54Qcmc3r6B/Ylz0m1Gj84kDM3st74Y4hPSckQ+LWgU1wELIpzzvFhlAm5AgwiOQr3gKJhrPeY8olB8hh/+j9WaDvy6hhRj3Pma4dCoM5isLAGtzhLgQbpzAtvuQdgFb3qZUh4ug=,iv:jWpVe8sI0ApZEpe769uBQWl4/SP8sRoUD9FC80dPSH8=,tag:K75bRAqYQi7ILEhl7CDo2g==,type:str]
+    pgp: []
+    encrypted_regex: ^(admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|PASSWD|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+    version: 3.8.1
diff --git a/apps/base/codeberg-runners/kustomization.yaml b/apps/base/codeberg-runners/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: codeberg-runners
+resources:
+  - zertrixt.yaml
diff --git a/apps/base/codeberg-runners/zertrixt.yaml b/apps/base/codeberg-runners/zertrixt.yaml
@@ -0,0 +1,76 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: zertrixt
+  name: zertrixt
+  namespace: codeberg-runners
+spec:
+  # Two replicas means that if one is busy, the other can pick up jobs.
+  replicas: 2
+  selector:
+    matchLabels:
+      app: zertrixt
+  strategy: {}
+  template:
+    metadata:
+      labels:
+        app: zertrixt
+    spec:
+      restartPolicy: Always
+      volumes:
+      - name: docker-certs
+        emptyDir: {}
+      - name: runner-data
+        emptyDir: {}
+      # Initialise our configuration file using offline registration
+      # https://forgejo.org/docs/v1.21/admin/actions/#offline-registration
+      initContainers:
+        - name: runner-register
+          image: code.forgejo.org/forgejo/runner:3.5.0
+          command: ["forgejo-runner", "register", "--no-interactive", "--token", $(RUNNER_SECRET), "--name", $(RUNNER_NAME), "--instance", $(FORGEJO_INSTANCE_URL)]
+          env:
+            - name: RUNNER_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: RUNNER_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: zertrixt-runner-secret
+                  key: token
+            - name: FORGEJO_INSTANCE_URL
+              value: https://codeberg.org
+          resources:
+            limits:
+              cpu: "0.50"
+              memory: "64Mi"
+          volumeMounts:
+            - name: runner-data
+              mountPath: /data
+      containers:
+      - name: runner
+        image: code.forgejo.org/forgejo/runner:3.5.0
+        command: ["sh", "-c", "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; forgejo-runner daemon"]
+        env:
+        - name: DOCKER_HOST
+          value: tcp://localhost:2376
+        - name: DOCKER_CERT_PATH
+          value: /certs/client
+        - name: DOCKER_TLS_VERIFY
+          value: "1"
+        volumeMounts:
+        - name: docker-certs
+          mountPath: /certs
+        - name: runner-data
+          mountPath: /data
+      - name: daemon
+        image: docker:27.1.1-dind
+        env:
+        - name: DOCKER_TLS_CERTDIR
+          value: /certs
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: docker-certs
+          mountPath: /certs
+\ No newline at end of file