Standardize CI/CD: use homelab-frontend pattern (REGISTRY_PAT, docker:27-cli, all repos)
This commit is contained in:
Story Crater Bot
+105
-81
@@ -1,40 +1,45 @@
|
||||
# CI/CD Setup — Forgejo Actions Registry Credentials
|
||||
# CI/CD Setup — Registry Push Configuration
|
||||
|
||||
## Required Configuration
|
||||
## One-Time Setup
|
||||
|
||||
The CI pipeline (`.forgejo/workflows/build.yaml`) automatically builds and pushes Docker images on each push to `main`. However, it requires registry credentials to be configured as repository secrets.
|
||||
The CI/CD pipeline automatically builds and pushes Docker images when you push to `main`.
|
||||
|
||||
### Setup Steps
|
||||
### 1. Create or Get Registry Token
|
||||
|
||||
#### 1. **Get Registry Credentials**
|
||||
|
||||
From the homelab setup:
|
||||
**Option A: Use Organization Token** (Recommended)
|
||||
```bash
|
||||
# Get ci-bot token (or use your personal access token)
|
||||
kubectl get secret -n poimen $(kubectl get secret -n poimen -l app.kubernetes.io/name=ci-bot -o name | head -1) -o jsonpath='{.data.token}' | base64 -d
|
||||
# Ask Rock for the existing 'rock' organization PAT
|
||||
# It should already have write:package permissions
|
||||
```
|
||||
|
||||
Or use a personal Forgejo access token:
|
||||
- URL: https://forgejo.riotpiao.com/user/settings/tokens
|
||||
- Create token with `write:package` scope
|
||||
**Option B: Create Personal Token**
|
||||
```bash
|
||||
# In browser: https://git.riotpiao.com/user/settings/tokens
|
||||
# 1. Click "Generate New Token"
|
||||
# 2. Name: "Docker Registry"
|
||||
# 3. Scope: Check `write:package`
|
||||
# 4. Generate and copy the token
|
||||
```
|
||||
|
||||
#### 2. **Set Repository Secrets**
|
||||
### 2. Add Repository Secret
|
||||
|
||||
Go to: **https://git.riotpiao.com/rock/poimen-memory/settings/secrets**
|
||||
|
||||
Add two secrets:
|
||||
- **`REGISTRY_USER`**: `ci-bot` (or your username)
|
||||
- **`REGISTRY_TOKEN`**: `<token-from-step-1>`
|
||||
Add secret:
|
||||
- **Name**: `REGISTRY_PAT`
|
||||
- **Value**: `<token-from-step-1>`
|
||||
- **Save**
|
||||
|
||||
#### 3. **Verify Setup**
|
||||
### 3. Verify Setup
|
||||
|
||||
Push a commit and check:
|
||||
```bash
|
||||
# Via web UI
|
||||
https://git.riotpiao.com/rock/poimen-memory/actions
|
||||
# Push a commit (any change will do)
|
||||
cd ~/workplace/Poimen/memory
|
||||
git commit --allow-empty -m "Trigger CI build"
|
||||
git push origin main
|
||||
|
||||
# Or check if image exists
|
||||
docker pull forgejo.riotpiao.com/rock/poimen-memory:latest
|
||||
# Check Actions tab
|
||||
# https://git.riotpiao.com/rock/poimen-memory/actions
|
||||
```
|
||||
|
||||
---
|
||||
@@ -42,82 +47,101 @@ docker pull forgejo.riotpiao.com/rock/poimen-memory:latest
|
||||
## How It Works
|
||||
|
||||
```
|
||||
┌─────────────────┐
|
||||
│ Push to main │
|
||||
└────────┬────────┘
|
||||
│
|
||||
↓
|
||||
┌─────────────────────────────────────────┐
|
||||
│ Forgejo Actions (rust runner) │
|
||||
│ 1. cargo build --workspace │
|
||||
│ 2. cargo test --all │
|
||||
└────────┬────────────────────────────────┘
|
||||
│
|
||||
↓ (only if tests pass)
|
||||
┌─────────────────────────────────────────┐
|
||||
│ Build Docker Image │
|
||||
│ docker build -t forgejo.../latest . │
|
||||
└────────┬────────────────────────────────┘
|
||||
│
|
||||
↓
|
||||
┌─────────────────────────────────────────┐
|
||||
│ Push to Registry │
|
||||
│ docker login + push │
|
||||
│ Uses: REGISTRY_USER + REGISTRY_TOKEN │
|
||||
└────────┬────────────────────────────────┘
|
||||
│
|
||||
↓
|
||||
┌─────────────────────────────────────────┐
|
||||
│ ArgoCD Detects Image │
|
||||
│ Syncs k8s/app/ with new image │
|
||||
└────────┬────────────────────────────────┘
|
||||
│
|
||||
↓
|
||||
┌─────────────────────────────────────────┐
|
||||
│ K8s Deployment │
|
||||
│ Pulls new image, restarts pods │
|
||||
└─────────────────────────────────────────┘
|
||||
Push to main
|
||||
↓
|
||||
Forgejo Actions triggered
|
||||
↓
|
||||
Test: cargo test --all
|
||||
↓ (only if tests pass)
|
||||
Build: docker build -t forgejo.riotpiao.com/rock/poimen-memory:latest .
|
||||
↓
|
||||
Push: docker push (using REGISTRY_PAT secret)
|
||||
↓
|
||||
ArgoCD detects new image
|
||||
↓
|
||||
Auto-deploy to poimen namespace
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Check Status
|
||||
|
||||
**Web UI** — See build progress:
|
||||
```
|
||||
https://git.riotpiao.com/rock/poimen-memory/actions
|
||||
```
|
||||
|
||||
**CLI** — Watch deployment:
|
||||
```bash
|
||||
kubectl get application -n argocd poimen-memory-app -w
|
||||
kubectl get pods -n poimen -l app.kubernetes.io/name=poimen-memory -w
|
||||
```
|
||||
|
||||
**Verify Image** — Check registry:
|
||||
```bash
|
||||
docker pull forgejo.riotpiao.com/rock/poimen-memory:latest
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Once Image is Ready
|
||||
|
||||
```bash
|
||||
# Port forward to local
|
||||
kubectl port-forward -n poimen svc/poimen-memory 8080:80 &
|
||||
|
||||
# Test
|
||||
curl http://localhost:8080/health
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Build Fails During Tests
|
||||
- Check workflow logs: https://git.riotpiao.com/rock/poimen-memory/actions
|
||||
- Run locally: `cargo test --all`
|
||||
### Secret Not Found Error
|
||||
- Go to: https://git.riotpiao.com/rock/poimen-memory/settings/secrets
|
||||
- Verify `REGISTRY_PAT` is set
|
||||
|
||||
### Image Not Pushing
|
||||
- Verify `REGISTRY_TOKEN` secret is set correctly
|
||||
- Check docker login error in workflow logs
|
||||
- Ensure token has `write:package` scope
|
||||
### Login Failed
|
||||
- Token might be expired or revoked
|
||||
- Create a new token and update the secret
|
||||
|
||||
### ArgoCD Not Syncing
|
||||
```bash
|
||||
kubectl get application -n argocd poimen-memory-app -o yaml | grep -A 5 status
|
||||
```
|
||||
### Build Failed
|
||||
- Check Actions logs for the error
|
||||
- Usually: tests failed
|
||||
- Fix locally: `cargo test --all`
|
||||
|
||||
### Image Exists But Pods Not Running
|
||||
- Check pod events: `kubectl describe pod -n poimen <pod-name>`
|
||||
- Usually: image pull policy issue or pod crashed
|
||||
- Check logs: `kubectl logs -n poimen deployment/poimen-memory`
|
||||
|
||||
---
|
||||
|
||||
## Manual Alternative
|
||||
## Apply to Other Repos
|
||||
|
||||
If CI is not working, you can push manually:
|
||||
The same setup works for all Poimen repos:
|
||||
|
||||
```bash
|
||||
# From homelab machine (has registry access)
|
||||
cd ~/workplace/Poimen/memory
|
||||
cargo build --release
|
||||
docker build -t forgejo.riotpiao.com/rock/poimen-memory:latest .
|
||||
docker push forgejo.riotpiao.com/rock/poimen-memory:latest
|
||||
# For poimen, poimen-workflows, etc:
|
||||
# 1. Create .forgejo/workflows/build.yaml (copy from template below)
|
||||
# 2. Add REGISTRY_PAT secret
|
||||
# 3. Push and watch it deploy
|
||||
```
|
||||
|
||||
But the goal is **zero-touch CI/CD**, so set up the secrets once and forget about it.
|
||||
**Template**: See `.forgejo/workflows/TEMPLATE.md` in this repo
|
||||
|
||||
---
|
||||
|
||||
## Status
|
||||
## Pattern Overview
|
||||
|
||||
- ✅ Workflow file: `.forgejo/workflows/build.yaml`
|
||||
- ✅ ArgoCD App: `k8s/argocd/memory-app.yaml`
|
||||
- ⏳ **Required**: Set `REGISTRY_USER` and `REGISTRY_TOKEN` secrets
|
||||
- ⏳ Then: Push to main, watch image build and deploy automatically
|
||||
**Based on**: homelab-frontend (proven production pattern)
|
||||
- Uses `REGISTRY_PAT` secret ✓
|
||||
- Docker login + push ✓
|
||||
- Tags: commit SHA + latest ✓
|
||||
- ArgoCD watches tags ✓
|
||||
|
||||
**Consistency**: All Poimen repos use same pattern
|
||||
- Same secret name: `REGISTRY_PAT`
|
||||
- Same workflow structure
|
||||
- Same deployment process
|
||||
|
||||
Reference in New Issue
Block a user