Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 othrayte
|
a13f2cef25 |
@@ -29,62 +29,3 @@ jobs:
|
||||
terraform init -backend=false
|
||||
terraform validate
|
||||
working-directory: 2-nomad-config
|
||||
|
||||
nomad-validate:
|
||||
name: Nomad job spec validate
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install Nomad CLI
|
||||
run: |
|
||||
curl -fsSL https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
|
||||
. /etc/os-release
|
||||
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com ${VERSION_CODENAME} main" | tee /etc/apt/sources.list.d/hashicorp.list
|
||||
apt-get update && apt-get install -y nomad
|
||||
|
||||
- name: Validate all job specs
|
||||
env:
|
||||
NOMAD_ADDR: http://jaglan-beta-m20.lan:4646
|
||||
run: |
|
||||
find 2-nomad-config -name '*.nomad.hcl' | while read f; do
|
||||
echo "==> $f"
|
||||
nomad job validate "$f"
|
||||
done
|
||||
|
||||
image-pull:
|
||||
name: Docker image pull validation
|
||||
runs-on: ubuntu-latest
|
||||
# Only run on PRs that touch nomad job specs
|
||||
if: github.event_name == 'pull_request'
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Pull changed images
|
||||
run: |
|
||||
git fetch origin ${{ github.base_ref }}
|
||||
IMAGES=$(git diff origin/${{ github.base_ref }}...HEAD -- '*.nomad.hcl' \
|
||||
| grep '^+\s*image\s*=' \
|
||||
| grep -oP '"[^"]+:[^"]+"' \
|
||||
| tr -d '"' \
|
||||
| sort -u || true)
|
||||
|
||||
if [ -z "$IMAGES" ]; then
|
||||
echo "No image changes detected, skipping pull."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
FAILED=0
|
||||
while IFS= read -r image; do
|
||||
echo "==> Pulling $image"
|
||||
if ! docker pull "$image"; then
|
||||
echo "ERROR: Failed to pull $image"
|
||||
FAILED=1
|
||||
fi
|
||||
done <<< "$IMAGES"
|
||||
|
||||
exit $FAILED
|
||||
|
||||
@@ -58,10 +58,8 @@ job "pgadmin" {
|
||||
]
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/"
|
||||
port = "http"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
@@ -7,10 +7,6 @@ job "postgres" {
|
||||
connect {
|
||||
sidecar_service {}
|
||||
}
|
||||
|
||||
# Note: TCP checks are not valid for Connect-enabled services (runs through
|
||||
# Envoy sidecar). Postgres is a single-writer DB that we never canary, so
|
||||
# observable health via Consul is lower priority than other services.
|
||||
}
|
||||
|
||||
task "postgres" {
|
||||
|
||||
@@ -33,10 +33,8 @@ job "authelia" {
|
||||
}
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/health"
|
||||
port = "http"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
@@ -35,8 +35,7 @@ job "traefik" {
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/ping"
|
||||
type = "tcp"
|
||||
port = "api"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
@@ -86,9 +85,6 @@ api:
|
||||
dashboard: true
|
||||
insecure: true
|
||||
|
||||
ping:
|
||||
entryPoint: traefik
|
||||
|
||||
providers:
|
||||
file:
|
||||
directory: "/etc/traefik/configs/"
|
||||
|
||||
@@ -28,7 +28,8 @@ job "act-runner" {
|
||||
}
|
||||
|
||||
env = {
|
||||
GITEA_INSTANCE_URL = "https://gitea-1ef0bea6b75a4fd3e9393a9f7f7e4b02.othrayte.one"
|
||||
GITEA_INSTANCE_URL = "http://localhost:3000"
|
||||
CONFIG_FILE = "/secrets/runner-config.yml"
|
||||
}
|
||||
|
||||
# Required SOPS key:
|
||||
@@ -42,6 +43,19 @@ EOF
|
||||
env = true
|
||||
}
|
||||
|
||||
# Limit which images/labels the runner will accept so it doesn't pick up
|
||||
# unrelated workloads if more runners are added later.
|
||||
template {
|
||||
data = <<EOF
|
||||
runner:
|
||||
labels:
|
||||
- "ubuntu-latest:docker://node:20-bookworm"
|
||||
- "ubuntu-22.04:docker://node:20-bookworm"
|
||||
- "ubuntu-24.04:docker://node:20-bookworm"
|
||||
EOF
|
||||
destination = "secrets/runner-config.yml"
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 200
|
||||
memory = 256
|
||||
|
||||
@@ -54,10 +54,8 @@ EOH
|
||||
]
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/"
|
||||
port = "http"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
@@ -80,10 +78,8 @@ EOH
|
||||
}
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/"
|
||||
port = "http"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
@@ -27,15 +27,11 @@ job "gitea" {
|
||||
tags = [
|
||||
"traefik.enable=true",
|
||||
"traefik.http.routers.gitea.middlewares=auth@file",
|
||||
# Token subdomain — no auth middleware — used by act_runner step containers for git checkout
|
||||
"traefik.http.routers.gitea-token.rule=Host(`gitea-1ef0bea6b75a4fd3e9393a9f7f7e4b02.othrayte.one`)",
|
||||
]
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/api/healthz"
|
||||
port = "http"
|
||||
path = "/"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
@@ -12,7 +12,7 @@ job "glance" {
|
||||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "glanceapp/glance:v0.7.8"
|
||||
image = "glanceapp/glance:latest"
|
||||
ports = ["http"]
|
||||
volumes = [
|
||||
"local/glance.yml:/app/config/glance.yml",
|
||||
@@ -30,8 +30,7 @@ job "glance" {
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/"
|
||||
type = "tcp"
|
||||
port = "http"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
|
||||
@@ -28,11 +28,10 @@ job "jellyfin" {
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/health"
|
||||
type = "tcp"
|
||||
port = "http"
|
||||
interval = "10s"
|
||||
timeout = "5s"
|
||||
timeout = "2s"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -33,10 +33,8 @@ job "ntfy" {
|
||||
]
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/healthz"
|
||||
port = "http"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
@@ -31,10 +31,8 @@ job "openreader" {
|
||||
]
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/"
|
||||
port = "http"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
@@ -50,10 +48,8 @@ job "openreader" {
|
||||
}
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/"
|
||||
port = "http"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
@@ -34,9 +34,8 @@ job "prowlarr" {
|
||||
]
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/ping"
|
||||
path = "/"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
@@ -52,9 +51,8 @@ job "prowlarr" {
|
||||
}
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/ping"
|
||||
path = "/"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
@@ -37,9 +37,8 @@ job "sonarr" {
|
||||
]
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/ping"
|
||||
path = "/"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
@@ -55,9 +54,8 @@ job "sonarr" {
|
||||
}
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/ping"
|
||||
path = "/"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
@@ -16,10 +16,8 @@ job "transfer" {
|
||||
]
|
||||
|
||||
check {
|
||||
name = "alive"
|
||||
type = "http"
|
||||
path = "/"
|
||||
port = "http"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
@@ -21,26 +21,6 @@ job "unifi-network" {
|
||||
UNIFI_STDOUT = "true"
|
||||
}
|
||||
|
||||
# Register in Consul so Traefik and health checks can find it.
|
||||
# address_mode=driver uses the macvlan IP (192.168.1.50) rather than the host IP.
|
||||
service {
|
||||
name = "unifi-network"
|
||||
port = 8443
|
||||
address_mode = "driver"
|
||||
|
||||
# TCP/HTTP checks from the Consul agent can't reach the macvlan IP (host↔macvlan
|
||||
# isolation). Use a script check instead — it runs inside the container via
|
||||
# docker exec and connects to localhost:8443 directly.
|
||||
check {
|
||||
name = "alive"
|
||||
type = "script"
|
||||
command = "/usr/bin/curl"
|
||||
args = ["-sk", "--max-time", "5", "-o", "/dev/null", "https://localhost:8443"]
|
||||
interval = "30s"
|
||||
timeout = "10s"
|
||||
}
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
volume = "unraid_appdata_unifi_network"
|
||||
destination = "/unifi" # Expected root directory (contains data, log, cert subdirs)
|
||||
|
||||
+17
-28
@@ -2,34 +2,23 @@
|
||||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.terraform.io/dmacvicar/libvirt" {
|
||||
version = "0.9.8"
|
||||
constraints = "0.9.8"
|
||||
version = "0.7.6"
|
||||
constraints = "0.7.6"
|
||||
hashes = [
|
||||
"h1:/9TSq9ibeojseTyT6Jx3z/dbvT5uw8ka3/18NKonrQc=",
|
||||
"h1:BN5hy1RaHlpcV0BDJYrSOEklK4YNdZCpiXOOGn0ce9k=",
|
||||
"h1:MNJ6dcFru4DwQM7maIUAADJIHn3aF+L8XsnRJlleNaM=",
|
||||
"h1:P1Cx0VZGTe6cpWpQ4JFOPJJb+Z+N50t4e1VA76T1tAA=",
|
||||
"h1:Pm9du7Rzsg1bhLq+XnW9VaLSjTu0Yytr9AOdP9FLQvM=",
|
||||
"h1:Q/JvNhRskJqDKPJoO9DW3+Ons3mk8kc++zlT4TucyFw=",
|
||||
"h1:Tzk+wRzhboY3F3wB1u0y3ySMMd4ZPtJbOYlTbbkxZc0=",
|
||||
"h1:Uuk8gkDEzmXfOTW/nm8GMG2aen7n/+X5GsTAf7eVRJc=",
|
||||
"h1:cRBlnB/TG4+l0y0i42QLU0JoLDBxxJEwCguLXS9Rv8A=",
|
||||
"h1:jn+hA9lIJzH5T0550IaKNsHxEAbyTGtvYWm02JCxexM=",
|
||||
"h1:pKAwAcCGEwsKvVy5eIxdmb1gLhTTxB0xGVi8/jqj0uI=",
|
||||
"h1:wS5VlGinhpnMCva0tKwLRPRQxmMUl80L05AueWshzNg=",
|
||||
"h1:yqZeKoJ+EZc3687/+ZBqBmtwzvBPLNwaEHW74+bSc6Y=",
|
||||
"zh:061e5187853729e1d8ba20938402ad6e778b4097436925d0bef7741c8aa26ee1",
|
||||
"zh:69a2ac8ee0cb0c1581bdc9a1296d89abcd1808229ff0a2fa20678ba4f7472944",
|
||||
"zh:8b02bf349191b4e7d9529d620da9e9265de5bd01d6983bb079589acdf80dda7a",
|
||||
"zh:9620872ed1da1ff421e85dd4ba2a110c284f3f0d06369c36a9aa75d501155fad",
|
||||
"zh:9ae7c932b7fb6f62ff20b863a15a7cd713415faa4c789472dc403062808366cb",
|
||||
"zh:a369c3e271b49e085940e6181fe6c1086c2126eebf5c7ad2b1db8fc8792dd30c",
|
||||
"zh:a45ad97d7192bea104b32521839dd705a330f13364cf1007dc912b6a0b6be3c8",
|
||||
"zh:b69f2a13ff688ad4b79e14deb6ef6341187864f50960bc0fd9c682f6077b4318",
|
||||
"zh:c20b467ff0ac76431a7bdb99662b9414b922ea603327509518c0179416cdfea3",
|
||||
"zh:c22d45913bd1f00a33d1a4b80547e4a2854409a298a0868c1730124f03a210ad",
|
||||
"zh:cf82bb14884fcbdcd57620cee248994b1633ea246fa49fd668d2f1739abb982d",
|
||||
"zh:ddc1cb4417206dd46eb22c3b81204b3a5edda03c4436e6a5914d541fcfd4c27f",
|
||||
"zh:e6b1983b8f1b9658448d0d09635619cc75dde314e6b4d7fd16d827f9e4bdb767",
|
||||
"h1:mmbm4vTyC/DCGO4Ed/vbp5AKvy1gmVn/94fzB9VmR08=",
|
||||
"zh:0bde54f6f658b20b620b875daf106b5b25b1bae4d15408d6c5f06d58360e254d",
|
||||
"zh:0c97c6930015918b8a34b6d7a2b0c3d17a649c226fcd1874fcba5bbbc0f35972",
|
||||
"zh:1bdd7aa0011c5f024a09a124836ee9bc8e71b05a6ece810c61824275fd3f695f",
|
||||
"zh:2b0cc7c794e4caf395d84ffff0b380d17e4b3219a4696264271bfe5059450efe",
|
||||
"zh:2f8633f7fe07f76c188836ed6f93321ec5fbf5c004bc7699e1741d9b21ed5f37",
|
||||
"zh:5bf47eed286ce55ed10a5cf657de49a34ab21cc8677c56fef3aab69cdde41a27",
|
||||
"zh:7dca790fc5fd1d42bc4bc7170be003a7093602026d0f95c8aab84ad551fdf2a4",
|
||||
"zh:80476b68bc84e3d661d1390025f83879b88f9cdc836de9751af09bd5716089cb",
|
||||
"zh:82f3e2f3f50176cd6041c8ba36e295cbda1b289ef52ab75b5eceb0f921f64f7b",
|
||||
"zh:a179b165f3b9bb9a67ebbbf9d73157ded33f02d476b2f58906389dca03b653c9",
|
||||
"zh:acae54a5d0616f22b3180ddd8e8aad39af664e604394fdacf1f7b337bca2d5b4",
|
||||
"zh:da4406a2428a9a7e98272c032cb93431c3919253af2fe9934b532d26c0deab09",
|
||||
"zh:f63dbd8e579ab5268d01ffab4503b8a8e736b70d1a04e4f271559ba8dd133dcd",
|
||||
"zh:f85c1d9e51a94ecde137435c9d6b0fb7be590437ea8a725334d1577eebbc550c",
|
||||
]
|
||||
}
|
||||
|
||||
@@ -2,7 +2,7 @@ terraform {
|
||||
required_providers {
|
||||
libvirt = {
|
||||
source = "dmacvicar/libvirt"
|
||||
version = "0.9.8"
|
||||
version = "0.7.6"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+8
-8
@@ -188,8 +188,8 @@ Most jobs already have Consul health checks — these can use `health_check = "c
|
||||
| frigate | ✅ | ✅ `single-node-writer` | ⚠️ same — rolling |
|
||||
| glance | ✅ | no | ✅ yes |
|
||||
| transfer | ✅ | ✅ `single-node-writer` | ⚠️ rolling |
|
||||
| openreader | ✅ `/` | ✅ `single-node-writer` | ⚠️ rolling |
|
||||
| unifi | ✅ script | ✅ `single-node-writer` | ⚠️ rolling |
|
||||
| openreader | ❌ | ✅ `single-node-writer` | ⚠️ add check first, then rolling |
|
||||
| unifi | ❌ | ✅ `single-node-writer` | ⚠️ add check first, then rolling |
|
||||
| traefik | (ingress) | ✅ | ⚠️ rolling — downtime risk, promote quickly |
|
||||
| authelia | (ingress) | ✅ | ✅ stateless config, canary fine |
|
||||
| renovate | batch job | n/a | n/a — no deployment model |
|
||||
@@ -293,13 +293,13 @@ exit 1
|
||||
|
||||
## Implementation Order
|
||||
|
||||
- [x] **Phase 1a**: Create `act-runner.nomad.hcl` + Terraform wrapper, register runner token in Gitea, get a hello-world workflow green
|
||||
- [x] **Phase 1b**: Add `terraform fmt` + `terraform validate -backend=false` workflow — no secrets needed
|
||||
- [x] **Phase 1c**: Add Nomad validate step — add `NOMAD_ADDR` + read-only `NOMAD_TOKEN` to Gitea secrets
|
||||
- [x] **Phase 2**: Add image pull validation step to the workflow
|
||||
- [ ] **Phase 1a**: Create `act-runner.nomad.hcl` + Terraform wrapper, register runner token in Gitea, get a hello-world workflow green
|
||||
- [ ] **Phase 1b**: Add `terraform fmt` + `terraform validate -backend=false` workflow — no secrets needed
|
||||
- [ ] **Phase 1c**: Add Nomad validate step — add `NOMAD_ADDR` + read-only `NOMAD_TOKEN` to Gitea secrets
|
||||
- [ ] **Phase 2**: Add image pull validation step to the workflow
|
||||
- [ ] **Phase 3a**: Add `update` stanzas to ntfy and glance (simplest, no volume conflict)
|
||||
- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, prowlarr, deluge, gitea, immich, transfer, frigate, openreader, unifi, authelia, traefik)
|
||||
- [x] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
|
||||
- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, etc.)
|
||||
- [ ] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
|
||||
- [ ] **Phase 4a**: Add on-push workflow that runs `terraform apply -auto-approve` using full credential set
|
||||
- [ ] **Phase 4b**: Add deployment promotion/revert polling script
|
||||
- [ ] **Phase 4c**: Wire ntfy notifications for promote/revert outcomes
|
||||
|
||||
Reference in New Issue
Block a user