admin-git/DealDocumentScreening
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for Nomad deploy.
Some checks are pending
ci / test (push) Waiting to run
Details

Browse source
This commit is contained in:
febux 2026-09-13 22:50:12 +03:00
parent 08cba6716d
commit 3e67a966b7
3 changed files with 41 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
.forgejo/workflows/deploy.yml
View file

@ -11,10 +11,9 @@
# REGISTRY_TOKEN forgejo token, write:package scope (docker login)
# NOMAD_TOKEN CI ACL token from deploy/nomad/README.md §5
# NOMAD_CACERT contents of nomad-ca.crt from README §3
# Repo variables (Settings → Variables) or edit the env block below:
# REGISTRY_HOST e.g. git.example.com
# REGISTRY_OWNER forgejo user/org owning the images
# Repo variables (Settings → Variables):
# NOMAD_ADDR_HOST services VPS public IP or DNS name (API :4646)
# Registry location is baked below (resolved): p2gnl.mu-dungeon.xyz/admin-git
name: deploy
@ -23,8 +22,8 @@ on:
branches: [main]
env:
REGISTRY_HOST: ${{ vars.REGISTRY_HOST }}
REGISTRY_OWNER: ${{ vars.REGISTRY_OWNER }}
REGISTRY_HOST: p2gnl.mu-dungeon.xyz
REGISTRY_OWNER: admin-git
jobs:
build-and-deploy:

39
deploy/nomad/README.md
View file

@ -4,24 +4,27 @@ Single-node Nomad agent (server+client) running the app services
(`api` + 5 workers) while stateful infra (postgres, redis, rabbitmq, minio),
the nginx edge cascade, and observability stay on docker compose.
Layout:
Layout (also `nomad.service` for manual installs, `gen-tls.sh` for TLS):
```
deploy/nomad/
├── nomad.hcl # agent config → /etc/nomad.d/nomad.hcl
├── nomad.service # systemd unit (manual install route)
├── gen-tls.sh # CA + server cert regeneration
├── policies/ci.hcl # ACL policy for the Forgejo deploy token
├── contract-check.nomad.hcl # job: api + worker groups
└── README.md # this runbook
```
Placeholders used below — substitute before running:
Registry (resolved): Forgejo at `p2gnl.mu-dungeon.xyz`, owner `admin-git` —
images are `p2gnl.mu-dungeon.xyz/admin-git/contract-check-<name>:<git-sha>`.
Placeholders still used below — substitute before running:
| Placeholder | Meaning |
|---|---|
| `<VPS_PUBLIC_IP>` | public IP of the services VPS |
| `<FORGEJO_SERVER_IP>` | public IP of the Forgejo VPS (runner) |
| `<FORGEJO_HOST>` | Forgejo hostname, e.g. `git.example.com` |
| `<OWNER>` | Forgejo user/org owning the repo + images |
---
@ -145,6 +148,26 @@ nomad acl bootstrap
export NOMAD_TOKEN=<management-secret-id>
```
Lost the management token? The 400 error from bootstrap tells you the reset
index; use it to mint a fresh management token (invalidates the old one):
```bash
nomad acl bootstrap -reset-index <index-from-error>
```
Handy: keep the CLI env in a root-only file and source it on demand
(never into .bashrc — tokens shouldn't leak to every shell):
```bash
umask 077
cat > /root/.nomadrc <<'EOF'
export NOMAD_ADDR=https://127.0.0.1:4646
export NOMAD_CACERT=/etc/nomad.d/tls/nomad-ca.crt
export NOMAD_TOKEN=<management-secret-id>
EOF
# per session: . /root/.nomadrc
```
Sanity checks:
```bash
@ -174,9 +197,9 @@ defaults:
```bash
nomad var put -in=json nomad/jobs/contract-check - <<'EOF'
{
"registry_host": "<FORGEJO_HOST>",
"registry_owner": "<OWNER>",
"registry_user": "<OWNER>",
"registry_host": "p2gnl.mu-dungeon.xyz",
"registry_owner": "admin-git",
"registry_user": "admin-git",
"registry_token": "<forgejo token with write:package scope>",
"database_url": "postgresql+asyncpg://contract_check:<POSTGRES_PASSWORD>@172.17.0.1:15432/contract_check",
@ -237,8 +260,6 @@ IMAGE_TAG=<git-sha> nomad job plan deploy/nomad/contract-check.nomad.hcl
IMAGE_TAG=<git-sha> nomad job run deploy/nomad/contract-check.nomad.hcl
```
Replace `<FORGEJO_HOST>`/`<OWNER>` in the job file image paths first.
```bash
nomad job status contract-check # groups, allocs, deployments
nomad alloc logs -f <alloc-id> # or: nomad logs -f contract-check

14
deploy/nomad/contract-check.nomad.hcl
View file

@ -81,7 +81,7 @@ job "contract-check" {
driver = "docker"
config {
image = "<FORGEJO_HOST>/<OWNER>/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
args = ["alembic", "upgrade", "head"]
auth {
@ -120,7 +120,7 @@ job "contract-check" {
driver = "docker"
config {
image = "<FORGEJO_HOST>/<OWNER>/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
ports = ["http"]
auth {
@ -206,7 +206,7 @@ job "contract-check" {
driver = "docker"
config {
image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-extract:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-extract:{{ mustEnv \"IMAGE_TAG\" }}"
auth {
usernameFile = "secrets/registry-user"
@ -276,7 +276,7 @@ job "contract-check" {
driver = "docker"
config {
image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-analyze:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-analyze:{{ mustEnv \"IMAGE_TAG\" }}"
auth {
usernameFile = "secrets/registry-user"
@ -346,7 +346,7 @@ job "contract-check" {
driver = "docker"
config {
image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-prescreen:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-prescreen:{{ mustEnv \"IMAGE_TAG\" }}"
auth {
usernameFile = "secrets/registry-user"
@ -415,7 +415,7 @@ job "contract-check" {
driver = "docker"
config {
image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-billing:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-billing:{{ mustEnv \"IMAGE_TAG\" }}"
auth {
usernameFile = "secrets/registry-user"
@ -478,7 +478,7 @@ job "contract-check" {
driver = "docker"
config {
image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-notify:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-notify:{{ mustEnv \"IMAGE_TAG\" }}"
auth {
usernameFile = "secrets/registry-user"