rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
369 Commits 3 Branches 0 Tags
cfb1d88373eb112d7a10badf30c26e7ea9b9701a
Commit Graph
11 Commits
Author SHA1 Message Date
rock cfb1d88373 fix: pass DOCKER_HOST + TLS env vars to workflow containers
Build and push runner images / build-runners (pull_request) Failing after 38s
Details 
ROOT CAUSE: Workflow containers created by Forgejo runner don't inherit
the DOCKER_HOST/TLS env vars from the runner pod. Docker CLI defaults to
unix:///var/run/docker.sock which doesn't exist inside workflow containers.

The dind sidecar listens on tcp://localhost:2376 with TLS. With
network: host (already set), localhost inside the workflow container
reaches the dind daemon. But docker CLI needs DOCKER_HOST set explicitly.

FIX: Use runner.envs in config.yaml to pass these env vars to every
workflow container:
  DOCKER_HOST=tcp://localhost:2376
  DOCKER_TLS_VERIFY=1
  DOCKER_CERT_PATH=/docker-certs/client

The valid_volumes already allows /docker-certs/client (TLS certs).
 2026-09-06 07:09:40 -07:00
rock 51c66299e9 forgejo-runner: gc every 30min instead of daily 
- Fix template to use .Values.gc.schedule instead of hardcoded cron
- Change schedule from daily 03:00 UTC to every 30 minutes
- Prevents DinD PVC fill-up (was at 93% before manual prune)
 2026-09-02 19:52:41 -07:00
rock 686c962ea9 fix(ci): aggressive GC for heavy Rust cargo builds 
- GC CronJob runs 2x daily (02:00 & 05:00 UTC) instead of once (03:00)
- Delete incomplete actcache uploads immediately (tmp/ dirs from failed writes)
- Reduce actcache retention from 3 days to 1 day
- Prevents cargo cache backlog on rust runner under heavy commit load
- Incomplete entries were accumulating 900MB+ each, filling 1Gi PVC instantly
 2026-08-30 09:23:09 -07:00
rock 91729f65e9 feat(ci): add GC CronJob for runner cleanup, expand reg PVCs to 20Gi 
- Add gc-cronjob.yaml: daily prune of DinD Docker images/volumes/build-cache
  and actcache across all forgejo-runner pods. Keeps :latest tagged images,
  deletes non-latest older than 72h.
- Expand runner reg PVCs from 1Gi to 20Gi (all three runners) to prevent
  action tool cache from filling disk.
- Rust runner gets explicit 20Gi persistence override.
- GC only renders from golang (default) values to avoid duplicate resources.
 2026-08-30 07:08:59 -07:00
Story Crater Bot d6fcf1016e refactor(forgejo-runner): template PVC names off Release.Name for multi-instance reuse 2026-08-21 16:30:41 -07:00
Story Crater Bot 7234eb596f fix(forgejo-runner): job containers must use host network to reach dind 2026-08-21 16:22:19 -07:00
Story Crater Bot 7cb438e25d fix(forgejo-runner): egress to ingress-nginx by namespace, not a stale LB IP 2026-08-21 16:22:19 -07:00
Story Crater Bot c46e69fd43 fix(forgejo-runner): allow job containers to mount /docker-certs/client so docker login/build/push work 2026-08-21 16:22:19 -07:00
Story Crater Bot 720181c900 feat: let the runner build and the cluster pull from the Forgejo registry 
- Runner egress: allow 192.168.1.160/32:443. forgejo.riotpiao.com resolves to
  the ingress LB, inside the 192.168.1.0/24 block the NetworkPolicy denies, so
  docker push hung until timeout.
- dind CA: also mount homelab-ca at /etc/docker/certs.d/forgejo.riotpiao.com/,
  the path dockerd actually reads for per-registry trust.
- Pull secret: dockerconfigjson for the api namespace; /v2/ answers 401.
- AppProject: allow the Forgejo repo as a source for api-gw.
 2026-08-19 21:48:01 -07:00
Story Crater Bot b863b6974e fix(forgejo-runner): cicd ns PSS privileged (dind needs it) + mount homelab-ca as ConfigMap not Secret — runner RS created 0 pods under baseline PSS, then FailedMount because homelab-ca is a ConfigMap trust bundle, not a Secret 2026-08-18 15:08:04 -07:00
Story Crater Bot 41f5b05395 refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation) 2026-08-18 15:08:03 -07:00