From 3e67a966b748e2d33996ec849dfd3ce221af4254 Mon Sep 17 00:00:00 2001 From: febux Date: Sun, 13 Sep 2026 22:50:12 +0300 Subject: [PATCH] Fix for Nomad deploy. --- .forgejo/workflows/deploy.yml | 9 +++---- deploy/nomad/README.md | 39 ++++++++++++++++++++------- deploy/nomad/contract-check.nomad.hcl | 14 +++++----- 3 files changed, 41 insertions(+), 21 deletions(-) diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml index 6cbacc3..ea4bfcb 100644 --- a/.forgejo/workflows/deploy.yml +++ b/.forgejo/workflows/deploy.yml @@ -11,10 +11,9 @@ # REGISTRY_TOKEN forgejo token, write:package scope (docker login) # NOMAD_TOKEN CI ACL token from deploy/nomad/README.md §5 # NOMAD_CACERT contents of nomad-ca.crt from README §3 -# Repo variables (Settings → Variables) or edit the env block below: -# REGISTRY_HOST e.g. git.example.com -# REGISTRY_OWNER forgejo user/org owning the images +# Repo variables (Settings → Variables): # NOMAD_ADDR_HOST services VPS public IP or DNS name (API :4646) +# Registry location is baked below (resolved): p2gnl.mu-dungeon.xyz/admin-git name: deploy @@ -23,8 +22,8 @@ on: branches: [main] env: - REGISTRY_HOST: ${{ vars.REGISTRY_HOST }} - REGISTRY_OWNER: ${{ vars.REGISTRY_OWNER }} + REGISTRY_HOST: p2gnl.mu-dungeon.xyz + REGISTRY_OWNER: admin-git jobs: build-and-deploy: diff --git a/deploy/nomad/README.md b/deploy/nomad/README.md index 2c8d86c..0f38d18 100644 --- a/deploy/nomad/README.md +++ b/deploy/nomad/README.md @@ -4,24 +4,27 @@ Single-node Nomad agent (server+client) running the app services (`api` + 5 workers) while stateful infra (postgres, redis, rabbitmq, minio), the nginx edge cascade, and observability stay on docker compose. -Layout: +Layout (also `nomad.service` for manual installs, `gen-tls.sh` for TLS): ``` deploy/nomad/ ├── nomad.hcl # agent config → /etc/nomad.d/nomad.hcl +├── nomad.service # systemd unit (manual install route) +├── gen-tls.sh # CA + server cert regeneration ├── policies/ci.hcl # ACL policy for the Forgejo deploy token ├── contract-check.nomad.hcl # job: api + worker groups └── README.md # this runbook ``` -Placeholders used below — substitute before running: +Registry (resolved): Forgejo at `p2gnl.mu-dungeon.xyz`, owner `admin-git` — +images are `p2gnl.mu-dungeon.xyz/admin-git/contract-check-:`. + +Placeholders still used below — substitute before running: | Placeholder | Meaning | |---|---| | `` | public IP of the services VPS | | `` | public IP of the Forgejo VPS (runner) | -| `` | Forgejo hostname, e.g. `git.example.com` | -| `` | Forgejo user/org owning the repo + images | --- @@ -145,6 +148,26 @@ nomad acl bootstrap export NOMAD_TOKEN= ``` +Lost the management token? The 400 error from bootstrap tells you the reset +index; use it to mint a fresh management token (invalidates the old one): + +```bash +nomad acl bootstrap -reset-index +``` + +Handy: keep the CLI env in a root-only file and source it on demand +(never into .bashrc — tokens shouldn't leak to every shell): + +```bash +umask 077 +cat > /root/.nomadrc <<'EOF' +export NOMAD_ADDR=https://127.0.0.1:4646 +export NOMAD_CACERT=/etc/nomad.d/tls/nomad-ca.crt +export NOMAD_TOKEN= +EOF +# per session: . /root/.nomadrc +``` + Sanity checks: ```bash @@ -174,9 +197,9 @@ defaults: ```bash nomad var put -in=json nomad/jobs/contract-check - <<'EOF' { - "registry_host": "", - "registry_owner": "", - "registry_user": "", + "registry_host": "p2gnl.mu-dungeon.xyz", + "registry_owner": "admin-git", + "registry_user": "admin-git", "registry_token": "", "database_url": "postgresql+asyncpg://contract_check:@172.17.0.1:15432/contract_check", @@ -237,8 +260,6 @@ IMAGE_TAG= nomad job plan deploy/nomad/contract-check.nomad.hcl IMAGE_TAG= nomad job run deploy/nomad/contract-check.nomad.hcl ``` -Replace ``/`` in the job file image paths first. - ```bash nomad job status contract-check # groups, allocs, deployments nomad alloc logs -f # or: nomad logs -f contract-check diff --git a/deploy/nomad/contract-check.nomad.hcl b/deploy/nomad/contract-check.nomad.hcl index 953b6fd..93fa00a 100644 --- a/deploy/nomad/contract-check.nomad.hcl +++ b/deploy/nomad/contract-check.nomad.hcl @@ -81,7 +81,7 @@ job "contract-check" { driver = "docker" config { - image = "//contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}" args = ["alembic", "upgrade", "head"] auth { @@ -120,7 +120,7 @@ job "contract-check" { driver = "docker" config { - image = "//contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}" ports = ["http"] auth { @@ -206,7 +206,7 @@ job "contract-check" { driver = "docker" config { - image = "//contract-check-worker-extract:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-extract:{{ mustEnv \"IMAGE_TAG\" }}" auth { usernameFile = "secrets/registry-user" @@ -276,7 +276,7 @@ job "contract-check" { driver = "docker" config { - image = "//contract-check-worker-analyze:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-analyze:{{ mustEnv \"IMAGE_TAG\" }}" auth { usernameFile = "secrets/registry-user" @@ -346,7 +346,7 @@ job "contract-check" { driver = "docker" config { - image = "//contract-check-worker-prescreen:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-prescreen:{{ mustEnv \"IMAGE_TAG\" }}" auth { usernameFile = "secrets/registry-user" @@ -415,7 +415,7 @@ job "contract-check" { driver = "docker" config { - image = "//contract-check-worker-billing:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-billing:{{ mustEnv \"IMAGE_TAG\" }}" auth { usernameFile = "secrets/registry-user" @@ -478,7 +478,7 @@ job "contract-check" { driver = "docker" config { - image = "//contract-check-worker-notify:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-notify:{{ mustEnv \"IMAGE_TAG\" }}" auth { usernameFile = "secrets/registry-user"