Update Terraform system to v0.5.0

- Add image-pull job to .gitea/workflows/ci.yml that detects image
  changes in *.nomad.hcl files on PRs and pulls each changed image
- Remove act-runner labels config — default runner already uses
  docker.gitea.com/runner-images:ubuntu-latest which has docker CLI
- Remove CONFIG_FILE env var from act-runner (no longer needed)
- Mark Phase 2 complete in cicd-plan.md

.gitea/workflows/ci.yml

@@ -0,0 +1,90 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  terraform-validate:
+    name: Terraform fmt + validate
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+
+      - name: fmt check — 1-nixos-node
+        run: terraform fmt -check -recursive
+        working-directory: 1-nixos-node
+
+      - name: fmt check — 2-nomad-config
+        run: terraform fmt -check -recursive
+        working-directory: 2-nomad-config
+
+      - name: validate — 2-nomad-config (no backend)
+        run: |
+          terraform init -backend=false
+          terraform validate
+        working-directory: 2-nomad-config
+
+  nomad-validate:
+    name: Nomad job spec validate
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Nomad CLI
+        run: |
+          curl -fsSL https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
+          . /etc/os-release
+          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com ${VERSION_CODENAME} main" | tee /etc/apt/sources.list.d/hashicorp.list
+          apt-get update && apt-get install -y nomad
+
+      - name: Validate all job specs
+        env:
+          NOMAD_ADDR: http://jaglan-beta-m20.lan:4646
+        run: |
+          find 2-nomad-config -name '*.nomad.hcl' | while read f; do
+            echo "==> $f"
+            nomad job validate "$f"
+          done
+
+  image-pull:
+    name: Docker image pull validation
+    runs-on: ubuntu-latest
+    # Only run on PRs that touch nomad job specs
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Pull changed images
+        run: |
+          git fetch origin ${{ github.base_ref }}
+          IMAGES=$(git diff origin/${{ github.base_ref }}...HEAD -- '*.nomad.hcl' \
+            | grep '^+\s*image\s*=' \
+            | grep -oP '"[^"]+:[^"]+"' \
+            | tr -d '"' \
+            | sort -u || true)
+
+          if [ -z "$IMAGES" ]; then
+            echo "No image changes detected, skipping pull."
+            exit 0
+          fi
+
+          FAILED=0
+          while IFS= read -r image; do
+            echo "==> Pulling $image"
+            if ! docker pull "$image"; then
+              echo "ERROR: Failed to pull $image"
+              FAILED=1
+            fi
+          done <<< "$IMAGES"
+
+          exit $FAILED

1-nixos-node/configuration.nix

@@ -64,6 +64,7 @@
           cni_path = "$${pkgs.cni-plugins}/bin";
         };
         plugin.docker.config.allow_privileged = true;
+        plugin.docker.config.volumes.enabled = true;
       };
       extraPackages = with pkgs; [
         cni-plugins

2-nomad-config/act-runner.nomad.hcl

@@ -0,0 +1,52 @@
+job "act-runner" {
+  group "act-runner" {
+    network {
+      mode = "bridge"
+    }
+
+    # Consul Connect upstream to Gitea so the runner can register and receive jobs
+    service {
+      name = "act-runner"
+      connect {
+        sidecar_service {
+          proxy {
+            upstreams {
+              destination_name = "code-connect"
+              local_bind_port  = 3000
+            }
+          }
+        }
+      }
+    }
+
+    task "act-runner" {
+      driver = "docker"
+
+      config {
+        image   = "gitea/act_runner:latest"
+        volumes = ["/var/run/docker.sock:/var/run/docker.sock"]
+      }
+
+      env = {
+        GITEA_INSTANCE_URL = "https://gitea-1ef0bea6b75a4fd3e9393a9f7f7e4b02.othrayte.one"
+      }
+
+      # Required SOPS key:
+      #   act-runner.registration_token — runner registration token from Gitea
+      #   Admin → Settings → Actions → Runners → Create new runner
+      template {
+        data        = <<EOF
+GITEA_RUNNER_REGISTRATION_TOKEN={{ with nomadVar "nomad/jobs/act-runner" }}{{ .registration_token }}{{ end }}
+EOF
+        destination = "secrets/runner.env"
+        env         = true
+      }
+
+      resources {
+        cpu        = 200
+        memory     = 256
+        memory_max = 1024
+      }
+    }
+  }
+}

2-nomad-config/act-runner.tf

@@ -0,0 +1,10 @@
+resource "nomad_job" "act_runner" {
+  jobspec = file("act-runner.nomad.hcl")
+}
+
+resource "nomad_variable" "act_runner" {
+  path = "nomad/jobs/act-runner"
+  items = {
+    registration_token = data.sops_file.secrets.data["act-runner.registration_token"]
+  }
+}

2-nomad-config/gitea.nomad.hcl

@@ -27,6 +27,8 @@ job "gitea" {
       tags = [
         "traefik.enable=true",
         "traefik.http.routers.gitea.middlewares=auth@file",
+        # Token subdomain — no auth middleware — used by act_runner step containers for git checkout
+        "traefik.http.routers.gitea-token.rule=Host(`gitea-1ef0bea6b75a4fd3e9393a9f7f7e4b02.othrayte.one`)",
       ]
 
       check {

2-nomad-config/secrets/secrets.enc.json

@@ -56,6 +56,9 @@
 		"gitea_token": "ENC[AES256_GCM,data:/J3CDMgWZLe20oQ+ENKBMi8fs/+jgsARV7xihMq0OLmRk8C8ae/IXg==,iv:e7WYOanSOCZ/LhN6SKrH0VrR3xLPTTppOKpGpSl+oAc=,tag:XBAilRdK3jL7WtM+92Fsmg==,type:str]",
 		"github_token": "ENC[AES256_GCM,data:omZpdsTV1aFgQ9PjIApITEyIRKk6Z8QyvD2Kp5tJnBWzFCm4v2lRAg==,iv:cKL7z+CSChzF9eZEcske2lbmx9KV6CrWw0tn7rmP/10=,tag:gon3Sc1d3ntNSbWwenHuOw==,type:str]"
 	},
+	"act-runner": {
+		"registration_token": "ENC[AES256_GCM,data:RnDvcNh69lLlL/ms+sMPKhhc+ECtc5hUHSkAQZv8e77iTD/QPd356Q==,iv:sl2Aua8rTe6cKYQAUC7O4UyHajGy1LgG/ZNLTVP4SyE=,tag:JjdaQqZ4PaWjfoiVmBl6lQ==,type:str]"
+	},
 	"sops": {
 		"age": [
 			{
@@ -63,8 +66,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUWM4ZDVVbGFrUGdMRHBX\nUFBmU3Nlc0RBSzhFK0tHNHpkQXUvUVdiZUZJCmpRN1lFdENpWW0rcThjVlVQNUl6\nWnlLU0RnQ3FZby81Ly8xTFBrek9nMncKLS0tIFQ4UTRNOC9CRmx4OFJWem1wckZz\nUDFTSzdWZldFK3FqcTNWTWRyNDhHQ2MKS811mR5xn7qiC/aVgPFYJ5c6Q3zxRfcr\nHcvxUvB01vNJKZpRg92vvKPkV6lQO3DXCT98OdfwiymlEOvYxg71Pg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2026-04-18T06:30:49Z",
+		"lastmodified": "2026-04-18T07:41:42Z",
-		"mac": "ENC[AES256_GCM,data:ZqT+lJxFOxbRaDkex8URHRRoNSoHVkB9tbMCDVWoln0otMUBFDnxa1Fqwzl77G+JxD/I7W5QX5qUx+oSoDxhyCvC97tjBfTZ+nlqTos25wLddSKwOfbvRNS7oZrzMt5AepgauApucNDjjUWtZB55mTV497PzESLBrZeI/4zpCU0=,iv:AVvlyJLyLJup2PtLt8NzZO+uCbuQKmUV0S2swwl6nME=,tag:HxywCeG6NQotrsN7ovDfrw==,type:str]",
+		"mac": "ENC[AES256_GCM,data:+HhhsiZXok4BZI05tG3p9veZaj51kELSQlWFYMSInv7bGfEadmOrJqCxaGrFcNkMmgVPx80jWQFrILfVLW5MUvEsHAhD4Vza2TSWeUq1HuL9DbMxsK2G9Y1fbthd12r/++dDcXxVnTUf/rCD70in/+g/zRObocAnUcFEcIqx1JE=,iv:pS+aj+47J4bYZYGlMVniQVTlLt4jtCLUT7oROJLUkZo=,tag:+lznxDhs2C3bcz5quxfHjA==,type:str]",
 		"encrypted_regex": "^(.*)$",
 		"version": "3.10.2"
 	}

archive/1-coreos/3-configure-hashistack/.terraform.lock.hcl

@@ -2,24 +2,37 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/neuspaces/system" {
-  version     = "0.4.0"
+  version     = "0.5.0"
-  constraints = "0.4.0"
+  constraints = "0.5.0"
   hashes = [
-    "h1:Vsp3ZoNGUnijGxcyKPJAnjzaifk2rcOaA6DtS4Wsdyk=",
+    "h1:+ATCBDOJs/ZlCiAZPo8sa2Uei8nTf1QQJT2670aIsTs=",
-    "zh:04862132feb60ff990e15f4b878e96fbcc296720bd31a39e7b0a8fe5788b5b33",
+    "h1:/z7Qu/4siDYM3e+q9Vl466Htl6tEgFZJI3Pc69EOWEg=",
-    "zh:1d8b6050274b5b915fbf241a66c63fe1b2088bc4720e0ef36a3d75a197a97d78",
+    "h1:0TxsJOXyC4J73IitbyKIR60bCA75M2lPD5Bd9wIcxyg=",
-    "zh:5263effc40349d48ed458ea5d418e7321db441d7987b35fabbdd3faa53ed114d",
+    "h1:4/GEbH8VSjgUrY6uMGUDDmSHOtQdo00cmluffNtAEFc=",
-    "zh:5b13d535084dacba3d511d5c815db4b5ae83e9c6226938bbf20a30c4e05116cb",
+    "h1:Cf4hCIbocqgmkXR/3Ia5J0/g7Q8cMhPngiqMG5lWDwI=",
-    "zh:69da944ea0c86ec4e64ae844f580d13910fd66f1d8a9ecc7890ff0ace29aef36",
+    "h1:D++0aOhVEdVxs5lNE9xsBoDYo2fgSzF4N+pgLihzDMM=",
+    "h1:H4dAi3KIdS1mQved99YQPvwEeSuL/UpUZfc4sGPckvc=",
+    "h1:O6M7A59jpW2S9z/vew+VIlMkRekLd9u0E1u85qJfgp0=",
+    "h1:X5YuaWMt+e0XS6uHE+nOCfhxJ3pDE1j+/9lcCAM+NeI=",
+    "h1:dcSBPD23eJv0GWfTL/OHnncA5TG2n3WihRdEDFvGGO4=",
+    "h1:iGC3jfF4K7nag5gUsxqlW8sJUvMZawe9ZnWhZFA8qco=",
+    "h1:oQbsFw8oGS64I7HYwJtE06YLeOckrIlebsBYyWCCNaY=",
+    "h1:rm8Z3YHvxeNxo/jwgEyiFEolmi748Nm7WjOUaWqGEzU=",
+    "h1:xYNyeBWkDZaOoBfJ9czGX8VC1xdil5EP1aw0xN2ZUi8=",
+    "zh:1c2800a4606b9b73405da6eb6be729b1c36bb1047f3ba99e2a263568aa724a76",
+    "zh:1e49e76a4805faac59bb656fc6d9be0befe6cb5307965db790493b81a023c9a6",
+    "zh:29741b13600995b58a9949ce3fcb24ec088e59b1911526b53a7b2c0224e34ea9",
+    "zh:30b0e123506c796b325da67fa3249f151e928043b969e65a9f9aa88ea02c2078",
+    "zh:311198cee4a83fde0b7e5a23e1ba4a797cc7583b90865339d5fa5e53b17520f0",
+    "zh:3b6897b9b85bba36f0cf7afcb06c9e680db1b151537f2e0cb0ddec480ad939c4",
+    "zh:4c35205a53093747707e9970a323f17b4f2eec26947cf2cc62fc50ce1ee4040c",
+    "zh:51fc16a1ae8ae9ee821f4e57243a23fb3a0cf54116efafd0dacff7a6f7f270b5",
+    "zh:5ba4908783fc3b04c574301ad6ba1d4c8f67fb24b7f61fc88c66a970ef7b805e",
+    "zh:5e0e4da6386e63a2a2876007a7cdb10bad8ce9e55533104739322a5425fd0aa8",
     "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:7fce212ccf0fd267a7f318c793e174605cbaa7814f9b30be16ed1d0526ab398f",
+    "zh:86c846c6e5bac31d19696f4a0a7b0470c98bae88a756e7c204912ed3c019f162",
-    "zh:97523ef340365bfaf759cc1eb4a202af7b27ac87e1cb5f0309a585d63e205bbd",
+    "zh:9e536df33fbee3672af9338992431bbad83efc53d4d38e8563eaaf1969d9fc4c",
-    "zh:9f3fefa30abc39a1073e66b88701b5437f4b04b0082091408c97f6a8e5b64bd3",
+    "zh:a0f11c8a9bcc524b1d7e8d727c598e5d1e065b580d5a50e2b6fd3264877e7b7b",
-    "zh:e16d43079cc894bfb0980ff211ea1787cdb913f24826461a8967ac91fd146ea8",
+    "zh:a15c2a47eaf9eb7dfb251a6096cf383f872787cd5fa583763fdb5aac5c862f77",
-    "zh:e4630f531b59e813fa405942c7648252c741313ccd49bc1be85f2ea964016ed3",
-    "zh:ebd2549e8b5b2894efb0ba70f2f6034ae5fb5821d1e2831ba5af8fa5e5870829",
-    "zh:ed601fdbf4813d041b3773781e2331c7ea074f8a5b505d2b105059a89b44301c",
-    "zh:f08f8e3d05759b72421de4c54f6938396d3e13fdfdbe7505877b1c64342dfa3a",
-    "zh:fea9e0172235a52343826d77e8331bcfeb785d514b4f5ee39f524d541b1a8749",
   ]
 }

archive/1-coreos/3-configure-hashistack/jaglan-beta.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     system = {
       source = "neuspaces/system"
-      version = "0.4.0"
+      version = "0.5.0"
     }
   }
 }

cicd-plan.md

@@ -293,10 +293,10 @@ exit 1
 
 ## Implementation Order
 
-- [ ] **Phase 1a**: Create `act-runner.nomad.hcl` + Terraform wrapper, register runner token in Gitea, get a hello-world workflow green
+- [x] **Phase 1a**: Create `act-runner.nomad.hcl` + Terraform wrapper, register runner token in Gitea, get a hello-world workflow green
-- [ ] **Phase 1b**: Add `terraform fmt` + `terraform validate -backend=false` workflow — no secrets needed
+- [x] **Phase 1b**: Add `terraform fmt` + `terraform validate -backend=false` workflow — no secrets needed
-- [ ] **Phase 1c**: Add Nomad validate step — add `NOMAD_ADDR` + read-only `NOMAD_TOKEN` to Gitea secrets
+- [x] **Phase 1c**: Add Nomad validate step — add `NOMAD_ADDR` + read-only `NOMAD_TOKEN` to Gitea secrets
-- [ ] **Phase 2**: Add image pull validation step to the workflow
+- [x] **Phase 2**: Add image pull validation step to the workflow
 - [ ] **Phase 3a**: Add `update` stanzas to ntfy and glance (simplest, no volume conflict)
 - [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, etc.)
 - [ ] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas