hinterland/hearth
2
2
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: finaly gitea runners can works

Browse Source
This commit is contained in:
yukkop
2026-09-02 13:51:11 +00:00
parent 07689e1a9e
commit fd6c9536e7
10 changed files with 36 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/module/hectic/service/gitea-runner-controller.nix
+4 -4
View File
@@ -120,13 +120,13 @@ in
}; };
actRunnerVersion = lib.mkOption { actRunnerVersion = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "v0.2.11"; default = "1.0.6";
description = "act_runner release tag downloaded at VM bootstrap."; description = "gitea-runner release version downloaded at VM bootstrap.";
}; };
actRunnerSha256 = lib.mkOption { actRunnerSha256 = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "7a5e833793286bbfd9b59ce682bd41fc3f1c096bae1bb2a09b66ab2f6dacf90c"; default = "d78ac11deed6580a2d88c1ef72c522aa7e2986d2d22b0d80edbee577b8f79b20";
description = "sha256 of the pinned act_runner linux-amd64 binary, verified at bootstrap."; description = "sha256 of the pinned gitea-runner linux-amd64 binary, verified at bootstrap.";
}; };
nixVersion = lib.mkOption { nixVersion = lib.mkOption {
type = lib.types.str; type = lib.types.str;
nixos/module/hectic/service/p4d.nix
+1
View File
@@ -340,6 +340,7 @@ in {
User = serviceUser; User = serviceUser;
Group = serviceGroup; Group = serviceGroup;
WorkingDirectory = cfg.dataDir; WorkingDirectory = cfg.dataDir;
Environment = lib.mkIf cfg.ssl.enable "P4SSLDIR=${cfg.ssl.dir}";
ExecStart = "${packageExe} ${lib.escapeShellArgs mainArgs}"; ExecStart = "${packageExe} ${lib.escapeShellArgs mainArgs}";
Restart = "on-failure"; Restart = "on-failure";
RestartSec = "5s"; RestartSec = "5s";
nixos/system/hectic-lab/hectic-lab.nix
+3 -3
View File
@@ -111,9 +111,9 @@ in {
enable = true; enable = true;
imageId = "424558114"; # MicroOS x86 + Hetzner datasource dhcpcd fix imageId = "424558114"; # MicroOS x86 + Hetzner datasource dhcpcd fix
allowedRepos = [ allowedRepos = [
"hectic-lab/util.nix" "hinterland/*"
"hectic-lab/runner-clean" "yukkop/*"
"hectic-lab/runner-clean2" "hectic-lab/*"
]; ];
# FIXME(yukkop): debug key for bootstrap debugging; remove once E2E stable. # FIXME(yukkop): debug key for bootstrap debugging; remove once E2E stable.
debugSshPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBLxMo5icX2Xyng7mcWGnIi+c4ZbVygjPhuU8noCkfZ yukkop@nixos"; debugSshPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBLxMo5icX2Xyng7mcWGnIi+c4ZbVygjPhuU8noCkfZ yukkop@nixos";
package/gitea-runner-controller/controller.sh
+3 -2
View File
@@ -88,7 +88,7 @@ gcr_alloc_deferred() {
[ "$repo_active" -ge "${GCR_PER_REPO_CAP:-1}" ] && return 0 [ "$repo_active" -ge "${GCR_PER_REPO_CAP:-1}" ] && return 0
gcr_budget_add "$rate" "$ttl_min" || return 0 gcr_budget_add "$rate" "$ttl_min" || return 0
reg_token="$(gcr_gitea_registration_token)" || return 0 reg_token="$(gcr_gitea_registration_token "$repo")" || return 0
key="$(gcr_alloc_key "$job_id" "$attempt")" key="$(gcr_alloc_key "$job_id" "$attempt")"
gcr_lock_acquire "$key" || return 0 gcr_lock_acquire "$key" || return 0
@@ -174,6 +174,7 @@ gcr_bootstrap_pending() {
job_id="$(gcr_record_field "$rec" job_id)" job_id="$(gcr_record_field "$rec" job_id)"
attempt="$(gcr_record_field "$rec" run_attempt)" attempt="$(gcr_record_field "$rec" run_attempt)"
repo="$(gcr_record_field "$rec" repo)"
label="$(gcr_record_field "$rec" label)" label="$(gcr_record_field "$rec" label)"
vm_id="$(gcr_record_field "$rec" vm_id)" vm_id="$(gcr_record_field "$rec" vm_id)"
runner_name="$(gcr_record_field "$rec" vm_name)" runner_name="$(gcr_record_field "$rec" vm_name)"
@@ -181,7 +182,7 @@ gcr_bootstrap_pending() {
ip="$(gcr_vm_public_ip "$vm_id")" ip="$(gcr_vm_public_ip "$vm_id")"
[ -n "$ip" ] || continue [ -n "$ip" ] || continue
reg_token="$(gcr_gitea_registration_token)" || continue reg_token="$(gcr_gitea_registration_token "$repo")" || continue
ttl_min="$(gcr_record_field "$rec" ttl_min)" ttl_min="$(gcr_record_field "$rec" ttl_min)"
gcr_log info --ns=alloc "bootstrapping vm=$vm_id ip=$ip job=$job_id" gcr_log info --ns=alloc "bootstrapping vm=$vm_id ip=$ip job=$job_id"
package/gitea-runner-controller/decide.sh
+7 -1
View File
@@ -18,7 +18,13 @@ gcr_repo_allowed() {
oldIFS="$IFS" oldIFS="$IFS"
IFS=, IFS=,
for allowed in ${GCR_ALLOWED_REPOS:-}; do for allowed in ${GCR_ALLOWED_REPOS:-}; do
if [ "$allowed" = "$repo" ]; then suffix="${allowed#*/}"
if [ "$suffix" = "*" ]; then
prefix="${allowed%/*}/"
case "$repo" in
"$prefix"*) IFS="$oldIFS"; return 0 ;;
esac
elif [ "$allowed" = "$repo" ]; then
IFS="$oldIFS" IFS="$oldIFS"
return 0 return 0
fi fi
package/gitea-runner-controller/default.nix
+2
View File
@@ -10,6 +10,7 @@
gnugrep, gnugrep,
gnused, gnused,
openssl, openssl,
openssh,
}: }:
let let
shell = "${dash}/bin/dash"; shell = "${dash}/bin/dash";
@@ -33,6 +34,7 @@ let
gnugrep gnugrep
gnused gnused
openssl openssl
openssh
]; ];
lib = '' lib = ''
package/gitea-runner-controller/gitea.sh
+4 -1
View File
@@ -3,9 +3,12 @@
# Requires: GCR_GITEA_URL, GITEA_REGISTRATION_TOKEN_FILE, GITEA_ADMIN_TOKEN_FILE # Requires: GCR_GITEA_URL, GITEA_REGISTRATION_TOKEN_FILE, GITEA_ADMIN_TOKEN_FILE
gcr_gitea_registration_token() { gcr_gitea_registration_token() {
repo="$1"
token="$(gcr_gitea_admin_token)" || return 1 token="$(gcr_gitea_admin_token)" || return 1
owner="${repo%%/*}"
name="${repo#*/}"
curl -fsS -X POST -H "Authorization: token $token" \ curl -fsS -X POST -H "Authorization: token $token" \
"$GCR_GITEA_URL/api/v1/orgs/hectic-lab/actions/runners/registration-token" \ "$GCR_GITEA_URL/api/v1/repos/$owner/$name/actions/runners/registration-token" \
| jq -r '.token' | jq -r '.token'
} }
package/gitea-runner-controller/hcloud.sh
+10 -10
View File
@@ -114,7 +114,7 @@ $(printf '%s\n' "$runner_config" | sed 's/^/ /')
- path: /etc/systemd/system/gcr-bootstrap.service - path: /etc/systemd/system/gcr-bootstrap.service
content: | content: |
[Unit] [Unit]
Description=Bootstrap Nix + act_runner for ephemeral CI job Description=Bootstrap gitea-runner for ephemeral CI job
After=network-online.target After=network-online.target
Wants=network-online.target Wants=network-online.target
Before=gitea-runner.service Before=gitea-runner.service
@@ -137,9 +137,9 @@ $(printf '%s\n' "$runner_config" | sed 's/^/ /')
tar -xJf /tmp/nix.tar.xz -C /tmp tar -xJf /tmp/nix.tar.xz -C /tmp
/tmp/nix-$GCR_NIX_VERSION-x86_64-linux/install --no-daemon /tmp/nix-$GCR_NIX_VERSION-x86_64-linux/install --no-daemon
rm -rf /tmp/nix* rm -rf /tmp/nix*
curl -fsSL \"https://gitea.com/gitea/act_runner/releases/download/$GCR_ACT_RUNNER_VERSION/act_runner-\$(printf '%s' \"$GCR_ACT_RUNNER_VERSION\" | sed 's/^v//')-linux-amd64\" -o /usr/local/bin/act_runner curl -fsSL \"https://dl.gitea.com/gitea-runner/$GCR_ACT_RUNNER_VERSION/gitea-runner-$GCR_ACT_RUNNER_VERSION-linux-amd64\" -o /usr/local/bin/gitea-runner
printf '%s /usr/local/bin/act_runner\n' \"$GCR_ACT_RUNNER_SHA256\" | sha256sum -c - printf '%s /usr/local/bin/gitea-runner\n' \"$GCR_ACT_RUNNER_SHA256\" | sha256sum -c -
chmod 0755 /usr/local/bin/act_runner chmod 0755 /usr/local/bin/gitea-runner
mkdir -p /var/lib/gitea-runner mkdir -p /var/lib/gitea-runner
runcmd: runcmd:
- [ sh, -c, 'systemctl enable --now sshd.service 2>/dev/null || systemctl enable --now ssh 2>/dev/null || true' ] - [ sh, -c, 'systemctl enable --now sshd.service 2>/dev/null || systemctl enable --now ssh 2>/dev/null || true' ]
@@ -246,9 +246,9 @@ cat > /usr/local/sbin/gcr-runner-start <<STARTEOF
#!/bin/sh #!/bin/sh
set -eu set -eu
if [ ! -f /var/lib/gitea-runner/.runner ]; then if [ ! -f /var/lib/gitea-runner/.runner ]; then
/usr/local/bin/act_runner register --no-interactive --instance $GCR_GITEA_URL --token $reg_token --name $runner_name --labels $label:host --config /etc/gitea-runner/config.yaml /usr/local/bin/gitea-runner register --no-interactive --instance $GCR_GITEA_URL --token $reg_token --name $runner_name --labels $label:host --config /etc/gitea-runner/config.yaml
fi fi
exec /usr/local/bin/act_runner daemon --config /etc/gitea-runner/config.yaml exec /usr/local/bin/gitea-runner daemon --config /etc/gitea-runner/config.yaml
STARTEOF STARTEOF
chmod 0700 /usr/local/sbin/gcr-runner-start chmod 0700 /usr/local/sbin/gcr-runner-start
cat > /etc/systemd/system/gitea-runner.service <<UNITEOF cat > /etc/systemd/system/gitea-runner.service <<UNITEOF
@@ -277,9 +277,9 @@ if [ "$label" = "nix" ]; then
/tmp/nix-$GCR_NIX_VERSION-x86_64-linux/install --no-daemon /tmp/nix-$GCR_NIX_VERSION-x86_64-linux/install --no-daemon
rm -rf /tmp/nix* rm -rf /tmp/nix*
fi fi
curl -fsSL "https://gitea.com/gitea/act_runner/releases/download/$GCR_ACT_RUNNER_VERSION/act_runner-\$(printf '%s' "$GCR_ACT_RUNNER_VERSION" | sed 's/^v//')-linux-amd64" -o /usr/local/bin/act_runner curl -fsSL "https://dl.gitea.com/gitea-runner/$GCR_ACT_RUNNER_VERSION/gitea-runner-$GCR_ACT_RUNNER_VERSION-linux-amd64" -o /usr/local/bin/gitea-runner
printf '%s /usr/local/bin/act_runner\n' "$GCR_ACT_RUNNER_SHA256" | sha256sum -c - printf '%s /usr/local/bin/gitea-runner\n' "$GCR_ACT_RUNNER_SHA256" | sha256sum -c -
chmod 0755 /usr/local/bin/act_runner chmod 0755 /usr/local/bin/gitea-runner
INSEOF INSEOF
chmod 0700 /usr/local/sbin/gcr-install chmod 0700 /usr/local/sbin/gcr-install
/usr/local/sbin/gcr-install /usr/local/sbin/gcr-install
@@ -304,7 +304,7 @@ gcr_vm_bootstrap_ssh() {
waited=0 waited=0
until ssh $SSH_OPTS "root@$ip" true 2>/dev/null; do until ssh $SSH_OPTS "root@$ip" true 2>/dev/null; do
waited=$((waited + 5)) waited=$((waited + 5))
[ "$waited" -ge 300 ] && { [ "$waited" -ge 900 ] && {
gcr_log warn --ns=hcloud "sshd never came up on $ip" gcr_log warn --ns=hcloud "sshd never came up on $ip"
rm -f "$key_tmp" rm -f "$key_tmp"
return 1 return 1
package/gitea-runner-controller/state.sh
+1 -1
View File
@@ -70,5 +70,5 @@ gcr_budget_add() {
} }
gcr_active_records() { gcr_active_records() {
grep -l '"status":"\(pending_vm\|vm_active\|deferred\)"' "$GCR_STATE_DIR"/jobs/*.json 2>/dev/null || true grep -El '"status"[[:space:]]*:[[:space:]]*"(pending_vm|vm_active|deferred)"' "$GCR_STATE_DIR"/jobs/*.json 2>/dev/null || true
} }
package/gitea-runner-controller/webhook.sh
+1 -1
View File
@@ -136,7 +136,7 @@ gcr_alloc() {
return 0 return 0
fi fi
reg_token="$(gcr_gitea_registration_token)" || { reg_token="$(gcr_gitea_registration_token "$repo")" || {
gcr_record_del "$job_id" "$attempt" gcr_record_del "$job_id" "$attempt"
gcr_lock_release "$key" gcr_lock_release "$key"
gcr_event "token-error" "$job_id" "{}" gcr_event "token-error" "$job_id" "{}"