k8s/aux: add cert-manager longhorn dashboard forge dev-tools and shadowsocks

- cert-manager ClusterIssuers (LetsEncrypt + homelab-ca) - Longhorn storage dashboard - Portainer dashboard config - Forgejo git service - Claude terminal remote access - Shadowsocks tunnel for remote access
2026-07-11 19:19:59 -07:00
parent 18f2f94f8e
commit e1d0cfd70b
18 changed files with 1201 additions and 0 deletions
@@ -0,0 +1,95 @@
+# k8s/forge/runner-gc-cronjob.yaml
+# Garbage-collects the forgejo-runner's DinD layer cache (runner-dind PVC,
+# 30Gi). Every CI build/pull only adds images and build-cache layers — there
+# is no automatic pruning, so without this the PVC fills up and breaks builds.
+#
+# Runs `docker image prune` / `docker builder prune` inside the live dind
+# container via `kubectl exec`, rather than a sidecar in the runner pod itself,
+# so it can run on its own schedule independent of runner restarts.
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: runner-gc
+  namespace: cicd
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: runner-gc
+  namespace: cicd
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: runner-gc
+  namespace: cicd
+subjects:
+  - kind: ServiceAccount
+    name: runner-gc
+    namespace: cicd
+roleRef:
+  kind: Role
+  name: runner-gc
+  apiGroup: rbac.authorization.k8s.io
+
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: forgejo-runner-image-gc
+  namespace: cicd
+spec:
+  schedule: "0 3 * * *"   # daily 03:00
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 600
+      template:
+        spec:
+          serviceAccountName: runner-gc
+          restartPolicy: Never
+          tolerations:
+            - key: node-role.kubernetes.io/control-plane
+              operator: Exists
+              effect: NoSchedule
+          containers:
+            - name: gc
+              image: alpine/k8s:1.31.0
+              command:
+                - sh
+                - -c
+                - |
+                  set -e
+                  POD=$(kubectl -n cicd get pod -l app=forgejo-runner -o jsonpath='{.items[0].metadata.name}')
+                  if [ -z "$POD" ]; then
+                    echo "no forgejo-runner pod found, skipping"
+                    exit 0
+                  fi
+                  echo "before:"
+                  kubectl -n cicd exec "$POD" -c dind -- df -h /var/lib/docker
+                  echo "pruning images unused for >72h on $POD"
+                  kubectl -n cicd exec "$POD" -c dind -- docker image prune -af --filter "until=72h"
+                  echo "pruning build cache unused for >72h on $POD"
+                  kubectl -n cicd exec "$POD" -c dind -- docker builder prune -af --filter "until=72h"
+                  echo "after:"
+                  kubectl -n cicd exec "$POD" -c dind -- df -h /var/lib/docker
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 64Mi
+                limits:
+                  cpu: 250m
+                  memory: 128Mi