rock
913cfc2f40
1. Forgejo CI is broken across all repos Every workflow fails because runner labels point to a bare Alpine image with nothing in it. ┌────────────────────────────────────────┬──────────────────────────────────────┐ │ Before │ After │ ├────────────────────────────────────────┼──────────────────────────────────────┤ │ golang:docker://forgejo/runner:6 │ golang:docker://golang:1.26-bookworm │ ├────────────────────────────────────────┼──────────────────────────────────────┤ │ No Go, no Node.js, no apt-get, no root │ Go, git, apt-get, root │ └────────────────────────────────────────┴──────────────────────────────────────┘ Plus the docker socket isn't shared between dind sidecar and runner, so even if docker CLI existed, it can't reach the daemon. ┌───────────────────────────────────────────┬─────────────────────────────────────────────────────────────┐ │ Before │ After │ ├───────────────────────────────────────────┼─────────────────────────────────────────────────────────────┤ │ dind creates socket in its own filesystem │ Shared /run emptyDir volume │ ├───────────────────────────────────────────┼─────────────────────────────────────────────────────────────┤ │ Runner can't see it │ Both containers see /run/docker.sock │ ├───────────────────────────────────────────┼─────────────────────────────────────────────────────────────┤ │ No docker_host config │ docker_host: automount passes socket to workflow containers │ Co-authored-by: rock <[email protected]>
57 lines
2.7 KiB
Plaintext
57 lines
2.7 KiB
Plaintext
.:53 {
|
|
errors
|
|
health {
|
|
lameduck 5s
|
|
}
|
|
ready
|
|
log . {
|
|
class error
|
|
}
|
|
prometheus :9153
|
|
|
|
# VPN access: map api-server.cluster.local to the cluster API service.
|
|
rewrite name api-server.cluster.local kubernetes.default.svc.cluster.local
|
|
|
|
# Forgejo: route through nginx ingress (TLS on :443, /v2/ registry + web).
|
|
# Do NOT point at forgejo-gitea-http directly (port 3000 only) — image pulls
|
|
# use https/:443 and would time out. SSH stays on its own LB service.
|
|
rewrite name forgejo.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name git.riotpiao.com forgejo-gitea-ssh.cicd.svc.cluster.local
|
|
|
|
# Homelab hostnames -> nginx ingress controller so in-cluster pods hit nginx
|
|
# TLS termination (cert-manager cert) and preserve the Host header. Routing
|
|
# via nginx (not the backend service) is critical: a direct rewrite bypasses
|
|
# nginx TLS and exposes each app's own self-signed cert, trusted by nothing.
|
|
rewrite name authentik.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name grafana.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name minio.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name minio-api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name argocd.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name vault.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name loki.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name prometheus.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name portainer.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name paperless.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name img.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
|
|
kubernetes cluster.local in-addr.arpa ip6.arpa {
|
|
pods insecure
|
|
fallthrough in-addr.arpa ip6.arpa
|
|
ttl 30
|
|
}
|
|
forward . 8.8.8.8 1.1.1.1 {
|
|
max_concurrent 1000
|
|
}
|
|
cache 30 {
|
|
disable success cluster.local
|
|
disable denial cluster.local
|
|
}
|
|
loop
|
|
reload
|
|
loadbalance
|
|
}
|