feat: gitea runners infra, but it is so expancive

infra/gitea-runners/k8s/statefulset.yaml

@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/part-of: gitea-actions
 spec:
   serviceName: gitea-runner
-  replicas: 5
+  replicas: 1
   podManagementPolicy: Parallel
   selector:
     matchLabels:

infra/gitea-runners/opentofu/README.md

@@ -63,19 +63,25 @@ The default cluster is deliberately fixed-size:
 - cluster name: `gitea-runners`
 - Hetzner location: `fsn1`
 - private network region: `eu-central`
-- control plane: one `cpx21` node in pool `control-plane`
-- workers: three `cpx31` nodes in pool `runner-workers`
+- control plane: one `cpx22` node in pool `control-plane`
+- workers: one `cpx22` node in pool `runner-workers`
 - storage: Hetzner CSI enabled with expected StorageClass `hcloud-volumes`
 - Longhorn: disabled
 - autoscaling/KEDA: not enabled in this stack
 
-The three default workers are sized for the initial five trusted privileged DinD
-jobs. To scale toward ten jobs later, keep autoscaling disabled and either raise
-`worker_count` to `5` or increase `worker_server_type`, then run a fresh
-`tofu plan` and the Task 11 Kubernetes pressure checks before applying.
+The default baseline uses one `cpx22` worker to keep the idle bill low while
+still supporting trusted internal jobs. To scale toward higher concurrency
+later, keep autoscaling disabled and either raise `worker_count` or increase
+`worker_server_type`, then run a fresh `tofu plan` and the Task 11 Kubernetes
+pressure checks before applying.
 
 Required inputs must come from environment or secret injection, for example
 `TF_VAR_hcloud_token`, `TF_VAR_ssh_public_key`, and `TF_VAR_ssh_private_key`.
+Set `TF_VAR_firewall_ssh_source` and `TF_VAR_firewall_kube_api_source` explicitly
+to trusted CIDR ranges before planning; the cluster must not expose SSH or port
+6443 to `0.0.0.0/0`.
+If the public key is already registered in Hetzner, set
+`TF_VAR_hcloud_ssh_key_id` to reuse it instead of creating a duplicate key.
 Do not commit `.tfvars` files. kube-hetzner v2.19.3 writes the generated
 kubeconfig to `./<cluster_name>_kubeconfig.yaml` when `create_kubeconfig` is
 enabled; this path is ignored as operational secret material.

infra/gitea-runners/opentofu/backend.tf

@@ -1,10 +1,21 @@
 terraform {
   backend "s3" {
-    bucket       = "gitea-runner-hectic-lab"
-    key          = "gitea-runners/kube-hetzner/terraform.tfstate"
-    region       = "fsn1"
-    encrypt      = true
-    use_lockfile = true
+    bucket = "gitea-runner-hectic-lab"
+    key    = "gitea-runners/kube-hetzner/terraform.tfstate"
+    region = "hel1"
+
+    endpoints = {
+      s3 = "https://hel1.your-objectstorage.com"
+    }
+
+    skip_credentials_validation = true
+    skip_metadata_api_check     = true
+    skip_region_validation      = true
+    skip_requesting_account_id  = true
+    use_path_style              = true
+    encrypt                     = false
+    skip_s3_checksum            = true
+    use_lockfile                = true
   }
 }
 

infra/gitea-runners/opentofu/gitea-runners_kustomization_backup.yaml

@@ -0,0 +1,39 @@
+"apiVersion": "kustomize.config.k8s.io/v1beta1"
+"kind": "Kustomization"
+"patches":
+- "patch": |
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: system-upgrade-controller
+      namespace: system-upgrade
+    spec:
+      template:
+        spec:
+          containers:
+            - name: system-upgrade-controller
+              volumeMounts:
+                - name: ca-certificates
+                  mountPath: /var/lib/ca-certificates
+          volumes:
+            - name: ca-certificates
+              hostPath:
+                path: /var/lib/ca-certificates
+                type: Directory
+  "target":
+    "group": "apps"
+    "kind": "Deployment"
+    "name": "system-upgrade-controller"
+    "namespace": "system-upgrade"
+    "version": "v1"
+- "path": "kured.yaml"
+- "path": "ccm.yaml"
+"resources":
+- "https://github.com/kubereboot/kured/releases/download/1.23.0/kured-1.23.0-combined.yaml"
+- "https://github.com/rancher/system-upgrade-controller/releases/download/v0.18.0/system-upgrade-controller.yaml"
+- "https://github.com/rancher/system-upgrade-controller/releases/download/v0.18.0/crd.yaml"
+- "https://github.com/hetznercloud/hcloud-cloud-controller-manager/releases/download/v1.35.0/ccm-networks.yaml"
+- "hcloud-csi.yaml"
+- "traefik_ingress.yaml"
+- "flannel-rbac.yaml"
+- "cert_manager.yaml"

infra/gitea-runners/opentofu/main.tf

@@ -47,6 +47,9 @@ module "kube_hetzner" {
   load_balancer_location  = var.hetzner_location
   control_plane_nodepools = local.control_plane_nodepools
   agent_nodepools         = local.agent_nodepools
+  firewall_ssh_source     = var.firewall_ssh_source
+  firewall_kube_api_source = var.firewall_kube_api_source
+  hcloud_ssh_key_id       = var.hcloud_ssh_key_id
 
   # Hetzner CSI is the required StorageClass provider for runner PVCs.
   disable_hetzner_csi = false

infra/gitea-runners/opentofu/variables.tf

@@ -39,21 +39,21 @@ variable "network_region" {
 }
 
 variable "control_plane_server_type" {
-  description = "Default control-plane server type. cpx21 is small but leaves headroom for kube-system workloads."
+  description = "Default control-plane server type. cpx22 is small but leaves headroom for kube-system workloads."
   type        = string
-  default     = "cpx21"
+  default     = "cpx22"
 }
 
 variable "worker_server_type" {
-  description = "Default worker server type for the initial trusted DinD runner pool. Three cpx31 workers provide enough headroom for five privileged jobs before Task 11 scaling validation."
+  description = "Default worker server type for the budget trusted DinD runner pool. One cpx22 worker keeps the idle baseline cheap; scale out later if job pressure requires it."
   type        = string
-  default     = "cpx31"
+  default     = "cpx22"
 }
 
 variable "worker_count" {
-  description = "Fixed worker count. Increase to 5 or choose a larger worker_server_type later to target 10 concurrent DinD jobs; do not enable autoscaling in this stack."
+  description = "Fixed worker count. Default is a single cheap worker for low-cost baseline operation; increase later if concurrency requires it."
   type        = number
-  default     = 3
+  default     = 1
 
   validation {
     condition     = var.worker_count >= 1
@@ -72,3 +72,19 @@ variable "base_domain" {
   type        = string
   default     = ""
 }
+
+variable "firewall_ssh_source" {
+  description = "CIDR ranges allowed to SSH to cluster nodes. Set explicitly; never expose SSH to the public internet."
+  type        = list(string)
+}
+
+variable "firewall_kube_api_source" {
+  description = "CIDR ranges allowed to reach the Kubernetes API. Set explicitly; never expose port 6443 to the public internet."
+  type        = list(string)
+}
+
+variable "hcloud_ssh_key_id" {
+  description = "Existing Hetzner SSH key ID. Set this when the public key is already registered in the project."
+  type        = string
+  default     = null
+}

infra/gitea-runners/runbook.md

@@ -326,7 +326,7 @@ kubectl -n gitea-runners get pvc -l app.kubernetes.io/name=gitea-runner -o wide
 
 # Run the concurrent smoke workflows now.
 
-kubectl -n gitea-runners scale statefulset/gitea-runner --replicas=5
+kubectl -n gitea-runners scale statefulset/gitea-runner --replicas=1
 kubectl -n gitea-runners rollout status statefulset/gitea-runner --timeout=10m
 kubectl -n gitea-runners get pods -l app.kubernetes.io/name=gitea-runner -o wide
 kubectl -n gitea-runners get pvc -l app.kubernetes.io/name=gitea-runner -o wide