From 605c0d68bdb0b101d005e04a7b7524d5dea077a8 Mon Sep 17 00:00:00 2001 From: febux Date: Mon, 14 Sep 2026 02:21:21 +0300 Subject: [PATCH] Update deploy job. --- deploy/nomad/README.md | 11 +++- deploy/nomad/contract-check.nomad.hcl | 93 ++------------------------- 2 files changed, 17 insertions(+), 87 deletions(-) diff --git a/deploy/nomad/README.md b/deploy/nomad/README.md index 6e70048..0550f0f 100644 --- a/deploy/nomad/README.md +++ b/deploy/nomad/README.md @@ -184,7 +184,7 @@ nomad server members # self as leader nomad node status # client ready, docker driver detected ``` -## 5. CI policy + token + registry variables +## 5. CI policy + token + registry login + variables ```bash # policy for the deploy token @@ -196,6 +196,15 @@ nomad acl token create -name forgejo-ci -policy ci # → AccessorID + SecretID. Forgejo repo secret: NOMAD_TOKEN = SecretID ``` +Registry login on the VPS — Nomad 1.9's docker driver predates the +`usernameFile`/`passwordFile` auth fields, so the job file has NO `auth` +block. Instead, log in once on the host (the agent runs as root and uses +the host docker daemon → all task pulls read root's docker config): + +```bash +docker login p2gnl.mu-dungeon.xyz -u admin-git -p +``` + Registry credentials and app secrets — the job file templates ALL of these from `nomad/jobs/contract-check` (missing keys render empty; define every key once). Connection strings point at the docker0 host gateway diff --git a/deploy/nomad/contract-check.nomad.hcl b/deploy/nomad/contract-check.nomad.hcl index 93fa00a..8a48c2d 100644 --- a/deploy/nomad/contract-check.nomad.hcl +++ b/deploy/nomad/contract-check.nomad.hcl @@ -84,19 +84,7 @@ job "contract-check" { image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}" args = ["alembic", "upgrade", "head"] - auth { - usernameFile = "secrets/registry-user" - passwordFile = "secrets/registry-pass" - } - } - - template { - destination = "secrets/registry-user" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}" - } - template { - destination = "secrets/registry-pass" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}" + # registry auth: host-level `docker login` on the VPS (README §5) } template { @@ -123,10 +111,7 @@ job "contract-check" { image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}" ports = ["http"] - auth { - usernameFile = "secrets/registry-user" - passwordFile = "secrets/registry-pass" - } + # registry auth: host-level `docker login` on the VPS (README §5) } env { @@ -136,15 +121,6 @@ job "contract-check" { APP_VERSION = "{{ env \"IMAGE_TAG\" }}" } - template { - destination = "secrets/registry-user" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}" - } - template { - destination = "secrets/registry-pass" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}" - } - # All connection strings + app secrets, agent-rendered from Nomad # Variables. Missing keys render empty — define them all once (README §5). template { @@ -208,10 +184,7 @@ job "contract-check" { config { image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-extract:{{ mustEnv \"IMAGE_TAG\" }}" - auth { - usernameFile = "secrets/registry-user" - passwordFile = "secrets/registry-pass" - } + # registry auth: host-level `docker login` on the VPS (README §5) } env { @@ -221,14 +194,6 @@ job "contract-check" { APP_VERSION = "{{ env \"IMAGE_TAG\" }}" } - template { - destination = "secrets/registry-user" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}" - } - template { - destination = "secrets/registry-pass" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}" - } template { destination = "secrets/env" env = true @@ -278,10 +243,7 @@ job "contract-check" { config { image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-analyze:{{ mustEnv \"IMAGE_TAG\" }}" - auth { - usernameFile = "secrets/registry-user" - passwordFile = "secrets/registry-pass" - } + # registry auth: host-level `docker login` on the VPS (README §5) } env { @@ -291,14 +253,6 @@ job "contract-check" { APP_VERSION = "{{ env \"IMAGE_TAG\" }}" } - template { - destination = "secrets/registry-user" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}" - } - template { - destination = "secrets/registry-pass" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}" - } template { destination = "secrets/env" env = true @@ -348,10 +302,7 @@ job "contract-check" { config { image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-prescreen:{{ mustEnv \"IMAGE_TAG\" }}" - auth { - usernameFile = "secrets/registry-user" - passwordFile = "secrets/registry-pass" - } + # registry auth: host-level `docker login` on the VPS (README §5) } env { @@ -361,14 +312,6 @@ job "contract-check" { APP_VERSION = "{{ env \"IMAGE_TAG\" }}" } - template { - destination = "secrets/registry-user" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}" - } - template { - destination = "secrets/registry-pass" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}" - } template { destination = "secrets/env" env = true @@ -417,10 +360,7 @@ job "contract-check" { config { image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-billing:{{ mustEnv \"IMAGE_TAG\" }}" - auth { - usernameFile = "secrets/registry-user" - passwordFile = "secrets/registry-pass" - } + # registry auth: host-level `docker login` on the VPS (README §5) } env { @@ -430,14 +370,6 @@ job "contract-check" { APP_VERSION = "{{ env \"IMAGE_TAG\" }}" } - template { - destination = "secrets/registry-user" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}" - } - template { - destination = "secrets/registry-pass" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}" - } template { destination = "secrets/env" env = true @@ -480,10 +412,7 @@ job "contract-check" { config { image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-notify:{{ mustEnv \"IMAGE_TAG\" }}" - auth { - usernameFile = "secrets/registry-user" - passwordFile = "secrets/registry-pass" - } + # registry auth: host-level `docker login` on the VPS (README §5) } env { @@ -493,14 +422,6 @@ job "contract-check" { APP_VERSION = "{{ env \"IMAGE_TAG\" }}" } - template { - destination = "secrets/registry-user" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}" - } - template { - destination = "secrets/registry-pass" - data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}" - } template { destination = "secrets/env" env = true