ci: optimize build + deploy + migrate workflows #51

Merged

rock merged 8 commits from ci/optimize-workflows into main 2026-09-13 05:42:04 +00:00

Conversation 0 Commits 8 Files Changed 18

+693 -128

8 Commits

Author	SHA1	Message	Date
rock	bcda5617b5	infra: add CronJob for runner disk cleanup ... - Runs daily at 2 AM to clean Docker, Cargo cache, /tmp - Prevents 'no space left on device' errors in CI builds - Deploy to homelab: kubectl apply -f k8s/infra/runner-cleanup-cronjob.yaml - Adjust namespace and node selectors for your environment	2026-09-13 14:14:28 +09:00
rock	346a615535	fix: docker build out-of-disk issue - aggressive cleanup ... - .dockerignore: exclude build/cache/docs to reduce build context (59 lines) - Dockerfile: add aggressive cleanup (cache, registry, git) after cargo build - Dockerfile: use --locked flag for reproducible builds - build.yaml: add pre-build disk cleanup (docker + cargo cache) - build.yaml: clean cargo before Docker build to free space - build.yaml: show disk usage before/after for debugging Fixes 'No space left on device' error during Docker build in runner	2026-09-13 14:13:18 +09:00
rock	9b3dc839bf	local dev: .env for local development (gitignored) ... - .env.example: template with all service URIs for local development - LOCAL_DEV.md: guide for running poimen locally - Production: config.yaml (SOPS-encrypted K8s ConfigMap) - Local: .env file (gitignored, never committed) - Application reads from ENV in both cases (K8s ConfigMap + local dotenv) - Simplifies prod/dev: same code, different config sources	2026-09-13 11:16:11 +09:00
rock	985bb7ff46	config: env-based service URIs via ConfigMap (prod: SOPS-encrypted) ... - config.yaml: prod config with cluster-internal DNS (LLM, OpenSearch, Authentik, Temporal, API-GW) - config.local.yaml: dev config with external URLs via ingress - deployment.yaml: remove hardcoded URIs, read all from ConfigMap envFrom - All downstream service URIs now configurable per environment - Production config encrypted with SOPS (Age-based) - Application code reads LLM_ENDPOINT, OPENSEARCH_HOST, AUTHENTIK_ISSUER, etc. from ENV - Simplifies prod/dev switching: just swap ConfigMap, no code changes	2026-09-13 11:12:53 +09:00
rock	4fdbb48ae6	ci: optimize build + deploy + migrate workflows ... - build.yaml: merge 3 cargo steps into single compile pass (reuse artifacts) - build.yaml: remove cargo clean (wasted compiled artifacts before Docker) - build.yaml: add secret validation for registry credentials - deploy.yaml: skip checkout, fetch SHA via Gitea API (no clone overhead) - deploy.yaml: reuse FORGEJO_REGISTRY_TOKEN for API auth (existing privilege) - deploy.yaml: validate SHA image exists before tagging as latest - deploy.yaml: add secret validation for registry credentials - migrate.yaml: merge schema verification into both changed + manual paths - migrate.yaml: manual trigger now fails on first error (was silently masking)	2026-09-13 09:53:11 +09:00
rock	c142ff5109	fix(opensearch): rotate secrets to random passwords	2026-09-12 23:23:07 +09:00
rock	48bcf39a64	fix(opensearch): single-node discovery, fsGroup, encrypt secrets, drop obsidian ... - discovery.type: single-node (bypasses vm.max_map_count bootstrap check) - fsGroup: 1000 (fixes AccessDeniedException on PVC data dir) - control-plane tolerations (schedulable on CP nodes) - secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted) - remove orphaned obsidian-git-ssh-secret.enc.yaml	2026-09-12 23:18:33 +09:00
rock	78e7aa8302	feat: scale memory-db to 3 replicas for HA ... Sync with homelab/k8s/infra/databases/memory-db.yaml. Update CNPG Cluster instances from 2 to 3 for high availability.	2026-09-12 04:52:45 +09:00