rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
302 Commits 3 Branches 0 Tags
88c9f3047aaba514fcce2218088fa64d858dcd65
Commit Graph
12 Commits
Author SHA1 Message Date
rock 3b26d4435e refactor(ci): move forgejo-runners from worker-1 to talos-cp-2 
Schedule runners on az-b (talos-cp-2) which has more Longhorn storage
and breathing room (367Gi available vs worker-1's 369Gi but over-provisioned).

PVCs deleted and will recreate on new zone. Runners will re-register.
 2026-08-30 09:29:38 -07:00
rock 686c962ea9 fix(ci): aggressive GC for heavy Rust cargo builds 
- GC CronJob runs 2x daily (02:00 & 05:00 UTC) instead of once (03:00)
- Delete incomplete actcache uploads immediately (tmp/ dirs from failed writes)
- Reduce actcache retention from 3 days to 1 day
- Prevents cargo cache backlog on rust runner under heavy commit load
- Incomplete entries were accumulating 900MB+ each, filling 1Gi PVC instantly
 2026-08-30 09:23:09 -07:00
rock 91729f65e9 feat(ci): add GC CronJob for runner cleanup, expand reg PVCs to 20Gi 
- Add gc-cronjob.yaml: daily prune of DinD Docker images/volumes/build-cache
  and actcache across all forgejo-runner pods. Keeps :latest tagged images,
  deletes non-latest older than 72h.
- Expand runner reg PVCs from 1Gi to 20Gi (all three runners) to prevent
  action tool cache from filling disk.
- Rust runner gets explicit 20Gi persistence override.
- GC only renders from golang (default) values to avoid duplicate resources.
 2026-08-30 07:08:59 -07:00
rock 422ae3cf04 fix: update runner golang image from 1.25 to 1.26 
kmsvc-manage, kmsvc-cli require Go 1.26.0 in go.mod but runner was
using golang:1.25-bookworm container. Update to golang:1.26-bookworm
to match project requirements.
 2026-08-28 15:41:23 -07:00
Story Crater Bot dbc4a55b02 feat(forgejo-runner): split into golang/node/rust runners, retire generic docker runner 2026-08-21 16:49:26 -07:00
Story Crater Bot d6fcf1016e refactor(forgejo-runner): template PVC names off Release.Name for multi-instance reuse 2026-08-21 16:30:41 -07:00
Story Crater Bot 7234eb596f fix(forgejo-runner): job containers must use host network to reach dind 2026-08-21 16:22:19 -07:00
Story Crater Bot 7cb438e25d fix(forgejo-runner): egress to ingress-nginx by namespace, not a stale LB IP 2026-08-21 16:22:19 -07:00
Story Crater Bot c46e69fd43 fix(forgejo-runner): allow job containers to mount /docker-certs/client so docker login/build/push work 2026-08-21 16:22:19 -07:00
Story Crater Bot 720181c900 feat: let the runner build and the cluster pull from the Forgejo registry 
- Runner egress: allow 192.168.1.160/32:443. forgejo.riotpiao.com resolves to
  the ingress LB, inside the 192.168.1.0/24 block the NetworkPolicy denies, so
  docker push hung until timeout.
- dind CA: also mount homelab-ca at /etc/docker/certs.d/forgejo.riotpiao.com/,
  the path dockerd actually reads for per-registry trust.
- Pull secret: dockerconfigjson for the api namespace; /v2/ answers 401.
- AppProject: allow the Forgejo repo as a source for api-gw.
 2026-08-19 21:48:01 -07:00
Story Crater Bot b863b6974e fix(forgejo-runner): cicd ns PSS privileged (dind needs it) + mount homelab-ca as ConfigMap not Secret — runner RS created 0 pods under baseline PSS, then FailedMount because homelab-ca is a ConfigMap trust bundle, not a Secret 2026-08-18 15:08:04 -07:00
Story Crater Bot 41f5b05395 refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation) 2026-08-18 15:08:03 -07:00