123 lines
4.2 KiB
Nix
123 lines
4.2 KiB
Nix
{ pkgs, ... }: let
|
|
opentofuUnstable = "github:NixOS/nixpkgs/nixos-unstable#opentofu";
|
|
|
|
tofu = pkgs.writeShellScriptBin "tofu" ''
|
|
exec ${pkgs.nix}/bin/nix run ${opentofuUnstable} -- "$@"
|
|
'';
|
|
|
|
giteaRunnersSetup = pkgs.writeShellScriptBin "gitea-runners-setup" /* sh */ ''
|
|
cat <<'EOF'
|
|
Gitea runners setup checklist
|
|
|
|
Tools available in this shell:
|
|
tofu, kubectl, kustomize, kubeconform, sops, age, awscli2, hcloud, tea,
|
|
docker, skopeo, go-containerregistry, jq, yq-go, curl, git, openssh, nix
|
|
|
|
Environment expected before real deploy/apply:
|
|
TF_VAR_hcloud_token
|
|
TF_VAR_ssh_public_key
|
|
TF_VAR_ssh_private_key
|
|
S3 backend credentials and endpoint access
|
|
a matching SOPS age identity for sus/gitea-runners.yaml
|
|
kubectl access to the target cluster
|
|
a concrete registry digest for the pushed Nix-capable runner image if enabling
|
|
the nix label
|
|
|
|
OpenTofu validation gate:
|
|
tofu version
|
|
tofu -chdir=infra/gitea-runners/opentofu validate
|
|
|
|
Nix image build/publish/digest gate:
|
|
nix build .#gitea-runner-nix-image
|
|
publish the archive, then pin the registry-reported digest in the runner label
|
|
mapping
|
|
nix:docker://gitea.hectic-lab.com/hectic-lab/gitea-runner-nix-image@sha256:<registry-digest>
|
|
|
|
SOPS token Secret creation gate:
|
|
kubectl apply -f infra/gitea-runners/k8s/namespace.yaml
|
|
umask 077
|
|
token_file=$(mktemp /tmp/gitea-runner-token.XXXXXX)
|
|
trap 'rm -f "$token_file"' EXIT
|
|
sops -d --extract '["gitea"]["hectic-lab"]["org-runner-registration-token"]' sus/gitea-runners.yaml > "$token_file"
|
|
kubectl -n gitea-runners create secret generic gitea-runner-token \
|
|
--from-file=token="$token_file" \
|
|
--dry-run=client \
|
|
-o yaml | kubectl -n gitea-runners apply -f -
|
|
|
|
Cluster provision gate:
|
|
tofu -chdir=infra/gitea-runners/opentofu init
|
|
tofu -chdir=infra/gitea-runners/opentofu validate
|
|
tofu -chdir=infra/gitea-runners/opentofu plan -out=.sisyphus/evidence/task-12-deploy.plan
|
|
tofu -chdir=infra/gitea-runners/opentofu apply .sisyphus/evidence/task-12-deploy.plan
|
|
export KUBECONFIG="$(tofu -chdir=infra/gitea-runners/opentofu output -raw kubeconfig_path)"
|
|
|
|
Kubernetes apply gate:
|
|
kubectl config current-context
|
|
kubectl get nodes -o wide
|
|
kubectl get sc
|
|
kubectl apply -k infra/gitea-runners/k8s
|
|
|
|
Verification commands:
|
|
kubectl -n gitea-runners get statefulset gitea-runner
|
|
kubectl -n gitea-runners rollout status statefulset/gitea-runner --timeout=10m
|
|
kubectl -n gitea-runners get pods -l app.kubernetes.io/name=gitea-runner -o wide
|
|
kubectl -n gitea-runners get pvc -l app.kubernetes.io/name=gitea-runner -o wide
|
|
kubectl -n gitea-runners get events --sort-by=.lastTimestamp | tail -n 50
|
|
kubectl -n gitea-runners logs statefulset/gitea-runner -c runner --tail=200
|
|
|
|
Main blockers and gates:
|
|
do not run tofu apply without all external inputs
|
|
do not apply the k8s overlay until the gitea-runner-token Secret exists
|
|
do not enable the nix label until the image has been published with a concrete digest
|
|
do not print, load, or require secrets on shell entry
|
|
EOF
|
|
'';
|
|
in pkgs.mkShell {
|
|
name = "gitea-runners";
|
|
|
|
buildInputs = [
|
|
tofu
|
|
giteaRunnersSetup
|
|
pkgs.nix
|
|
pkgs.kubectl
|
|
pkgs.kustomize
|
|
pkgs.kubeconform
|
|
pkgs.sops
|
|
pkgs.age
|
|
pkgs.awscli2
|
|
pkgs.hcloud
|
|
pkgs.tea
|
|
pkgs.docker
|
|
pkgs.skopeo
|
|
pkgs.go-containerregistry
|
|
pkgs.jq
|
|
pkgs.yq-go
|
|
pkgs.curl
|
|
pkgs.git
|
|
pkgs.openssh
|
|
];
|
|
|
|
shellHook = ''
|
|
export GITEA_RUNNERS_ROOT="$PWD/infra/gitea-runners"
|
|
export GITEA_RUNNERS_TOFU_DIR="$GITEA_RUNNERS_ROOT/opentofu"
|
|
export GITEA_RUNNERS_K8S_DIR="$GITEA_RUNNERS_ROOT/k8s"
|
|
export GITEA_RUNNERS_IMAGE_DIR="$GITEA_RUNNERS_ROOT/image"
|
|
export GITEA_RUNNERS_NAMESPACE="gitea-runners"
|
|
|
|
alias cd-gitea-runners='cd "$GITEA_RUNNERS_ROOT"'
|
|
alias cd-gitea-runners-tofu='cd "$GITEA_RUNNERS_TOFU_DIR"'
|
|
alias cd-gitea-runners-k8s='cd "$GITEA_RUNNERS_K8S_DIR"'
|
|
|
|
echo ""
|
|
echo "=== Gitea runner setup DevShell ==="
|
|
echo ""
|
|
echo "Run gitea-runners-setup for the full setup checklist."
|
|
echo "Paths: "
|
|
echo " root=$GITEA_RUNNERS_ROOT"
|
|
echo " tofu=$GITEA_RUNNERS_TOFU_DIR"
|
|
echo " k8s=$GITEA_RUNNERS_K8S_DIR"
|
|
echo " image=$GITEA_RUNNERS_IMAGE_DIR"
|
|
echo ""
|
|
'';
|
|
}
|