Forgejo workflows were added. Nomad config was created.
Some checks are pending
ci / test (push) Waiting to run
Some checks are pending
ci / test (push) Waiting to run
This commit is contained in:
febux
parent
0c354492ef
commit
c64f8ac3b7
7 changed files with 1019 additions and 0 deletions
43
.forgejo/workflows/ci.yml
Normal file
43
.forgejo/workflows/ci.yml
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
# CI: lint + typecheck + unit tests on every branch / PR.
|
||||
#
|
||||
# Self-contained on purpose: python:3.14-trixie has git built in, so no
|
||||
# node/actions-checkout dependency; uv comes from PyPI (both reachable from
|
||||
# the runner network). Mirrors the Makefile lint/test-unit targets.
|
||||
|
||||
name: ci
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: ["**"]
|
||||
pull_request:
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: docker
|
||||
container:
|
||||
image: python:3.14-trixie
|
||||
steps:
|
||||
- name: Checkout (sha-pinned, no node actions needed)
|
||||
run: |
|
||||
git init -q .
|
||||
git remote add origin ${{ gitea.server_url }}/${{ gitea.repository }}.git
|
||||
git fetch --depth 1 origin ${{ gitea.sha }}
|
||||
git checkout -q FETCH_HEAD
|
||||
|
||||
- name: Install uv
|
||||
run: pip install --quiet uv
|
||||
|
||||
- name: Sync dev dependencies
|
||||
run: uv sync --group dev --frozen
|
||||
|
||||
- name: Lint (ruff)
|
||||
run: |
|
||||
uv run ruff check src tests
|
||||
uv run ruff format --check src tests
|
||||
uv run isort --check-only src tests
|
||||
|
||||
- name: Typecheck (ty)
|
||||
run: uv run ty check src
|
||||
|
||||
- name: Unit tests
|
||||
run: uv run pytest -m "not integration" tests/unit
|
||||
76
.forgejo/workflows/deploy.yml
Normal file
76
.forgejo/workflows/deploy.yml
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
# Deploy: build → push → nomad job run, on every push to main.
|
||||
#
|
||||
# Runner requirements (verify on the Forgejo VPS):
|
||||
# - job container gets the docker socket (runner config must allow
|
||||
# valid_volumes for /var/run/docker.sock — see README §deploy notes), or
|
||||
# switch `runs-on` to the host label and drop the container/socket bits;
|
||||
# - Docker Hub reachable (nomad CLI is extracted from hashicorp/nomad:1.9 —
|
||||
# releases.hashicorp.com is blocked from this network).
|
||||
#
|
||||
# Repo secrets (Settings → Secrets):
|
||||
# REGISTRY_TOKEN forgejo token, write:package scope (docker login)
|
||||
# NOMAD_TOKEN CI ACL token from deploy/nomad/README.md §5
|
||||
# NOMAD_CACERT contents of nomad-ca.crt from README §3
|
||||
# Repo variables (Settings → Variables) or edit the env block below:
|
||||
# REGISTRY_HOST e.g. git.example.com
|
||||
# REGISTRY_OWNER forgejo user/org owning the images
|
||||
# NOMAD_ADDR_HOST services VPS public IP or DNS name (API :4646)
|
||||
|
||||
name: deploy
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
|
||||
env:
|
||||
REGISTRY_HOST: ${{ vars.REGISTRY_HOST }}
|
||||
REGISTRY_OWNER: ${{ vars.REGISTRY_OWNER }}
|
||||
|
||||
jobs:
|
||||
build-and-deploy:
|
||||
runs-on: docker
|
||||
container:
|
||||
image: docker:28-cli
|
||||
options: --volume /var/run/docker.sock:/var/run/docker.sock
|
||||
steps:
|
||||
- name: Checkout
|
||||
run: |
|
||||
apk add --no-cache git
|
||||
git init -q .
|
||||
git remote add origin ${{ gitea.server_url }}/${{ gitea.repository }}.git
|
||||
git fetch --depth 1 origin ${{ gitea.sha }}
|
||||
git checkout -q FETCH_HEAD
|
||||
|
||||
- name: Extract nomad CLI (official image; CDN is blocked here)
|
||||
run: |
|
||||
docker create --name nomad-extract hashicorp/nomad:1.9 >/dev/null
|
||||
docker cp nomad-extract:/bin/nomad /usr/local/bin/nomad
|
||||
docker rm nomad-extract >/dev/null
|
||||
nomad version
|
||||
|
||||
- name: Registry login
|
||||
run: |
|
||||
echo "${{ secrets.REGISTRY_TOKEN }}" | \
|
||||
docker login "$REGISTRY_HOST" -u "$REGISTRY_OWNER" --password-stdin
|
||||
|
||||
- name: Build & push images (SHA tag)
|
||||
run: |
|
||||
set -e
|
||||
TAG="${GITEA_SHA}"
|
||||
for name in api worker-extract worker-analyze worker-prescreen worker-billing worker-notify; do
|
||||
image="$REGISTRY_HOST/$REGISTRY_OWNER/contract-check-$name"
|
||||
docker build -f "srv/$name/Dockerfile" -t "$image:$TAG" .
|
||||
docker push "$image:$TAG"
|
||||
done
|
||||
|
||||
- name: Deploy to Nomad
|
||||
run: |
|
||||
mkdir -p /tmp/nomad-tls
|
||||
echo "${{ secrets.NOMAD_CACERT }}" > /tmp/nomad-tls/ca.crt
|
||||
export IMAGE_TAG="${GITEA_SHA}"
|
||||
export NOMAD_ADDR="https://${{ vars.NOMAD_ADDR_HOST }}:4646"
|
||||
export NOMAD_CACERT=/tmp/nomad-tls/ca.crt
|
||||
export NOMAD_TOKEN="${{ secrets.NOMAD_TOKEN }}"
|
||||
nomad job run deploy/nomad/contract-check.nomad.hcl
|
||||
# the CLI follows the deployment and exits non-zero if health
|
||||
# checks fail — auto_revert then rolls the job back server-side.
|
||||
256
deploy/nomad/README.md
Normal file
256
deploy/nomad/README.md
Normal file
|
|
@ -0,0 +1,256 @@
|
|||
# Nomad on the services VPS — install & operations runbook
|
||||
|
||||
Single-node Nomad agent (server+client) running the app services
|
||||
(`api` + 5 workers) while stateful infra (postgres, redis, rabbitmq, minio),
|
||||
the nginx edge cascade, and observability stay on docker compose.
|
||||
|
||||
Layout:
|
||||
|
||||
```
|
||||
deploy/nomad/
|
||||
├── nomad.hcl # agent config → /etc/nomad.d/nomad.hcl
|
||||
├── policies/ci.hcl # ACL policy for the Forgejo deploy token
|
||||
├── contract-check.nomad.hcl # job: api + worker groups
|
||||
└── README.md # this runbook
|
||||
```
|
||||
|
||||
Placeholders used below — substitute before running:
|
||||
|
||||
| Placeholder | Meaning |
|
||||
|---|---|
|
||||
| `<VPS_PUBLIC_IP>` | public IP of the services VPS |
|
||||
| `<FORGEJO_SERVER_IP>` | public IP of the Forgejo VPS (runner) |
|
||||
| `<FORGEJO_HOST>` | Forgejo hostname, e.g. `git.example.com` |
|
||||
| `<OWNER>` | Forgejo user/org owning the repo + images |
|
||||
|
||||
---
|
||||
|
||||
## 1. Install Nomad
|
||||
|
||||
### 1a. Manual install via the official Docker image
|
||||
|
||||
The services VPS network 404s `apt.releases.hashicorp.com`,
|
||||
`releases.hashicorp.com` and GitHub release assets, and Ubuntu `resolute`
|
||||
is newer than the apt repo's suites — so extract the binary from the
|
||||
official Docker image instead (Docker Hub is reachable there):
|
||||
|
||||
```bash
|
||||
docker pull hashicorp/nomad:1.9
|
||||
docker create --name nomad-extract hashicorp/nomad:1.9
|
||||
docker cp nomad-extract:/bin/nomad /tmp/nomad
|
||||
docker rm nomad-extract
|
||||
chmod +x /tmp/nomad && /tmp/nomad version
|
||||
sudo install -m 0755 /tmp/nomad /usr/local/bin/nomad
|
||||
# if the cp path is wrong:
|
||||
# docker run --rm --entrypoint sh hashicorp/nomad:1.9 -c 'command -v nomad'
|
||||
```
|
||||
|
||||
**Why 1.9.x and not 2.x:** Nomad 2.x extracts the docker driver into an
|
||||
external plugin distributed via the blocked hosts above. 1.9.x has it
|
||||
built in — everything this stack uses (nomadVar templates, native
|
||||
services, static ports, canary updates) is fully supported there.
|
||||
|
||||
No `.deb` ⇒ no systemd unit ships; install ours:
|
||||
|
||||
```bash
|
||||
sudo cp deploy/nomad/nomad.service /etc/systemd/system/nomad.service
|
||||
```
|
||||
|
||||
### 1b. apt install (only on networks that reach HashiCorp's repo)
|
||||
|
||||
```bash
|
||||
wget -O- https://apt.releases.hashicorp.com/gpg | \
|
||||
sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
|
||||
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
|
||||
https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
|
||||
sudo tee /etc/apt/sources.list.d/hashicorp.list
|
||||
sudo apt-get update && sudo apt-get install -y nomad
|
||||
nomad version # expect 1.7+
|
||||
```
|
||||
|
||||
Note: the `.deb`'s own unit lives in /lib/systemd/system — do NOT install
|
||||
`deploy/nomad/nomad.service` in that case.
|
||||
|
||||
## 2. Install config + data dir
|
||||
|
||||
```bash
|
||||
sudo mkdir -p /var/lib/nomad /etc/nomad.d/tls
|
||||
# from the repo root on the VPS:
|
||||
sudo cp deploy/nomad/nomad.hcl /etc/nomad.d/nomad.hcl
|
||||
```
|
||||
|
||||
## 3. Generate TLS material
|
||||
|
||||
The API is reachable from the internet (Forgejo runner → VPS), so TLS is
|
||||
mandatory. One mini-CA + one server cert; the runner gets **only** the CA
|
||||
cert.
|
||||
|
||||
```bash
|
||||
cd /tmp && mkdir nomad-tls && cd nomad-tls
|
||||
|
||||
# CA (keep nomad-ca.key offline afterwards; only the .crt is ever copied)
|
||||
openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
|
||||
-keyout nomad-ca.key -out nomad-ca.crt -subj "/CN=Contract-Check Nomad CA"
|
||||
|
||||
# server cert — SANs must cover the RPC hostname AND how clients reach it
|
||||
openssl req -newkey rsa:2048 -nodes \
|
||||
-keyout server.key -out server.csr \
|
||||
-subj "/CN=server.global.vps.nomad"
|
||||
|
||||
cat > server.ext <<'EOF'
|
||||
subjectAltName = DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:<VPS_PUBLIC_IP>
|
||||
extendedKeyUsage = serverAuth, clientAuth
|
||||
EOF
|
||||
|
||||
openssl x509 -req -in server.csr \
|
||||
-CA nomad-ca.crt -CAkey nomad-ca.key -CAcreateserial \
|
||||
-out server.crt -days 825 -extfile server.ext
|
||||
|
||||
sudo install -m 644 nomad-ca.crt server.crt /etc/nomad.d/tls/
|
||||
sudo install -m 600 server.key /etc/nomad.d/tls/
|
||||
```
|
||||
|
||||
Copy `nomad-ca.crt` to the Forgejo VPS (or a repo secret / secure storage)
|
||||
— the deploy workflow needs it as `NOMAD_CACERT`.
|
||||
|
||||
## 4. Start the agent + bootstrap ACLs
|
||||
|
||||
```bash
|
||||
sudo systemctl enable --now nomad
|
||||
systemctl status nomad --no-pager
|
||||
```
|
||||
|
||||
For every CLI call on the VPS, export:
|
||||
|
||||
```bash
|
||||
export NOMAD_ADDR=https://127.0.0.1:4646
|
||||
export NOMAD_CACERT=/etc/nomad.d/tls/nomad-ca.crt
|
||||
```
|
||||
|
||||
Bootstrap ACLs once:
|
||||
|
||||
```bash
|
||||
nomad acl bootstrap
|
||||
# → prints an AccessorID/SecretID management token. Store the SecretID in a
|
||||
# password manager; export it for the following commands:
|
||||
export NOMAD_TOKEN=<management-secret-id>
|
||||
```
|
||||
|
||||
Sanity checks:
|
||||
|
||||
```bash
|
||||
nomad server members # self as leader
|
||||
nomad node status # client ready, docker driver detected
|
||||
```
|
||||
|
||||
## 5. CI policy + token + registry variables
|
||||
|
||||
```bash
|
||||
# policy for the deploy token
|
||||
nomad acl policy apply -description "Forgejo CI deploy" ci \
|
||||
deploy/nomad/policies/ci.hcl
|
||||
|
||||
# long-lived token for the runner (no TTL)
|
||||
nomad acl token create -name forgejo-ci -policy ci
|
||||
# → AccessorID + SecretID. Forgejo repo secret: NOMAD_TOKEN = SecretID
|
||||
```
|
||||
|
||||
Registry credentials and app secrets — the job file templates ALL of these
|
||||
from `nomad/jobs/contract-check` (missing keys render empty; define every
|
||||
key once). Connection strings point at the docker0 host gateway
|
||||
`172.17.0.1` and the host-published infra ports (15432/17379/5672/9000) —
|
||||
substitute real credentials where the compose `.env` deviates from
|
||||
defaults:
|
||||
|
||||
```bash
|
||||
nomad var put -in=json nomad/jobs/contract-check - <<'EOF'
|
||||
{
|
||||
"registry_host": "<FORGEJO_HOST>",
|
||||
"registry_owner": "<OWNER>",
|
||||
"registry_user": "<OWNER>",
|
||||
"registry_token": "<forgejo token with write:package scope>",
|
||||
|
||||
"database_url": "postgresql+asyncpg://contract_check:<POSTGRES_PASSWORD>@172.17.0.1:15432/contract_check",
|
||||
"redis_url": "redis://172.17.0.1:17379/0",
|
||||
"rabbitmq_url": "amqp://contract_check:<RABBITMQ_PASS>@172.17.0.1:5672/",
|
||||
"s3_endpoint_url": "http://172.17.0.1:9000",
|
||||
"s3_access_key": "<S3_ACCESS_KEY>",
|
||||
"s3_secret_key": "<S3_SECRET_KEY>",
|
||||
"s3_bucket": "contract-check-docs",
|
||||
|
||||
"jwt_secret": "<openssl rand -hex 32 — reuse the value from compose .env>",
|
||||
"telegram_bot_token": "<TELEGRAM_BOT_TOKEN>",
|
||||
"ollama_api_key": "<OLLAMA_API_KEY>",
|
||||
"yandexgpt_api_key": "<YANDEXGPT_API_KEY or empty>",
|
||||
"smtp_host": "<SMTP_HOST or empty>",
|
||||
"smtp_username": "<SMTP_USERNAME or empty>",
|
||||
"smtp_password": "<SMTP_PASSWORD or empty>",
|
||||
"metrics_bearer_token": "<METRICS_BEARER_TOKEN or empty>"
|
||||
}
|
||||
EOF
|
||||
|
||||
nomad var get nomad/jobs/contract-check # sanity check
|
||||
```
|
||||
|
||||
## 6. Firewall
|
||||
|
||||
```bash
|
||||
# 4646: only the Forgejo runner may talk to the API
|
||||
sudo ufw allow from <FORGEJO_SERVER_IP> to any port 4646 proto tcp \
|
||||
comment 'nomad http (forgejo runner)'
|
||||
# single-node: no external rpc/gossip peers
|
||||
sudo ufw deny 4647/tcp comment 'nomad rpc (local only)'
|
||||
sudo ufw deny 4648/tcp comment 'nomad gossip (local only)'
|
||||
sudo ufw status verbose
|
||||
```
|
||||
|
||||
Not using ufw? Apply the equivalent (443/80 stay as-is; only 4646 needs a
|
||||
source restriction) in iptables/nft/cloud-secgroup.
|
||||
|
||||
## 7. Web UI
|
||||
|
||||
The UI has no login of its own — it rides on TLS+ACL, and neither should be
|
||||
public. Reach it through an SSH tunnel:
|
||||
|
||||
```bash
|
||||
ssh -L 4646:127.0.0.1:4646 <vps>
|
||||
# browser: https://localhost:4646/ui (self-signed warning is expected)
|
||||
```
|
||||
|
||||
## 8. Everyday operations
|
||||
|
||||
First submission (the job file requires IMAGE_TAG — it is rendered by the
|
||||
CLI at submit time; CI exports it automatically):
|
||||
|
||||
```bash
|
||||
IMAGE_TAG=<git-sha> nomad job validate deploy/nomad/contract-check.nomad.hcl
|
||||
IMAGE_TAG=<git-sha> nomad job plan deploy/nomad/contract-check.nomad.hcl
|
||||
IMAGE_TAG=<git-sha> nomad job run deploy/nomad/contract-check.nomad.hcl
|
||||
```
|
||||
|
||||
Replace `<FORGEJO_HOST>`/`<OWNER>` in the job file image paths first.
|
||||
|
||||
```bash
|
||||
nomad job status contract-check # groups, allocs, deployments
|
||||
nomad alloc logs -f <alloc-id> # or: nomad logs -f contract-check
|
||||
nomad job scale contract-check worker-extract 3
|
||||
nomad deployment list / promote / rollback <deployment-id>
|
||||
nomad job revert contract-check <prior-job-version>
|
||||
```
|
||||
|
||||
Health gates: the api group checks `/healthz`; every group sets
|
||||
`update { auto_revert = true }` — a deployment that turns unhealthy rolls
|
||||
back on its own.
|
||||
|
||||
## 9. Failure behavior (single server)
|
||||
|
||||
- Agent process dies → containers keep running untouched; deploys/scaling
|
||||
impossible until `systemctl restart nomad`. Data in `/var/lib/nomad`
|
||||
survives restarts.
|
||||
- `systemctl status nomad`, `journalctl -u nomad -f` for diagnostics.
|
||||
|
||||
## 10. Image retention
|
||||
|
||||
Every merge pushes 6 SHA-tagged images to the Forgejo registry. Periodically
|
||||
prune old tags (Forgejo UI → Packages, or the API), or keep `latest` + the
|
||||
last few SHAs. Nomad also GCs unused images on the VPS automatically.
|
||||
527
deploy/nomad/contract-check.nomad.hcl
Normal file
527
deploy/nomad/contract-check.nomad.hcl
Normal file
|
|
@ -0,0 +1,527 @@
|
|||
# «Контракт-чек» app services on Nomad (single VPS, docker driver).
|
||||
#
|
||||
# Groups: api (with prestart migrations) + 5 workers. Stateful infra
|
||||
# (postgres/redis/rabbitmq/minio) stays on compose; tasks reach it via the
|
||||
# docker0 host gateway 172.17.0.1 and the host-published ports
|
||||
# (15432/17379/5672/9000). The nginx edge cascade is unchanged.
|
||||
#
|
||||
# Secrets flow (nothing sensitive lives in this file):
|
||||
# - registry creds + all app secrets → Nomad Variables at
|
||||
# nomad/jobs/contract-check (see deploy/nomad/README.md §5), rendered
|
||||
# agent-side into env / auth files by `template` blocks;
|
||||
# - image tag is injected CLI-side at submit time:
|
||||
# IMAGE_TAG=<git-sha> nomad job run deploy/nomad/contract-check.nomad.hcl
|
||||
#
|
||||
# First deploy: verify with `nomad job validate` + `nomad job plan`, then
|
||||
# cutover workers one by one (README / docs/DEPLOY.md §15).
|
||||
|
||||
job "contract-check" {
|
||||
datacenters = ["vps"]
|
||||
type = "service"
|
||||
|
||||
# ── Rolling defaults for every group ────────────────────────────────────────
|
||||
update {
|
||||
max_parallel = 1
|
||||
min_healthy_time = "15s"
|
||||
healthy_deadline = "5m"
|
||||
progress_deadline = "10m"
|
||||
auto_revert = true
|
||||
}
|
||||
|
||||
# ══ API ════════════════════════════════════════════════════════════════════
|
||||
group "api" {
|
||||
count = 1
|
||||
|
||||
# No canary here: the static host port (18000) cannot be bound twice on a
|
||||
# single node. Rolling = brief seconds-level gap per deploy; switch to
|
||||
# dynamic ports + Traefik if zero-downtime becomes a requirement.
|
||||
update {
|
||||
max_parallel = 1
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 3
|
||||
interval = "10m"
|
||||
delay = "15s"
|
||||
mode = "delay"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 18000
|
||||
to = 8000
|
||||
}
|
||||
}
|
||||
|
||||
service {
|
||||
name = "contract-check-api"
|
||||
port = "http"
|
||||
provider = "nomad"
|
||||
|
||||
check {
|
||||
name = "healthz"
|
||||
type = "http"
|
||||
path = "/healthz"
|
||||
interval = "10s"
|
||||
timeout = "3s"
|
||||
}
|
||||
|
||||
check_restart {
|
||||
limit = 3
|
||||
grace = "30s"
|
||||
}
|
||||
}
|
||||
|
||||
# One-shot migrations before the API starts (replaces `make migrate`).
|
||||
task "migrate" {
|
||||
lifecycle {
|
||||
hook = "prestart"
|
||||
}
|
||||
|
||||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "<FORGEJO_HOST>/<OWNER>/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
|
||||
args = ["alembic", "upgrade", "head"]
|
||||
|
||||
auth {
|
||||
usernameFile = "secrets/registry-user"
|
||||
passwordFile = "secrets/registry-pass"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "secrets/registry-user"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/registry-pass"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "secrets/env"
|
||||
env = true
|
||||
change_mode = "restart"
|
||||
data = <<-EOT
|
||||
{{ with nomadVar "nomad/jobs/contract-check" }}
|
||||
DATABASE_URL="{{ .database_url }}"
|
||||
{{ end }}
|
||||
EOT
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 150
|
||||
memory = 256
|
||||
}
|
||||
}
|
||||
|
||||
task "api" {
|
||||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "<FORGEJO_HOST>/<OWNER>/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
|
||||
ports = ["http"]
|
||||
|
||||
auth {
|
||||
usernameFile = "secrets/registry-user"
|
||||
passwordFile = "secrets/registry-pass"
|
||||
}
|
||||
}
|
||||
|
||||
env {
|
||||
ENV = "prod"
|
||||
LOG_LEVEL = "INFO"
|
||||
LOG_FORMAT = "json"
|
||||
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "secrets/registry-user"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/registry-pass"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
|
||||
}
|
||||
|
||||
# All connection strings + app secrets, agent-rendered from Nomad
|
||||
# Variables. Missing keys render empty — define them all once (README §5).
|
||||
template {
|
||||
destination = "secrets/env"
|
||||
env = true
|
||||
change_mode = "restart"
|
||||
data = <<-EOT
|
||||
{{ with nomadVar "nomad/jobs/contract-check" }}
|
||||
DATABASE_URL="{{ .database_url }}"
|
||||
REDIS_URL="{{ .redis_url }}"
|
||||
RABBITMQ_URL="{{ .rabbitmq_url }}"
|
||||
S3_ENDPOINT_URL="{{ .s3_endpoint_url }}"
|
||||
S3_ACCESS_KEY="{{ .s3_access_key }}"
|
||||
S3_SECRET_KEY="{{ .s3_secret_key }}"
|
||||
S3_BUCKET="{{ .s3_bucket }}"
|
||||
JWT_SECRET="{{ .jwt_secret }}"
|
||||
TELEGRAM_BOT_TOKEN="{{ .telegram_bot_token }}"
|
||||
OLLAMA_API_KEY="{{ .ollama_api_key }}"
|
||||
YANDEXGPT_API_KEY="{{ .yandexgpt_api_key }}"
|
||||
SMTP_HOST="{{ .smtp_host }}"
|
||||
SMTP_USERNAME="{{ .smtp_username }}"
|
||||
SMTP_PASSWORD="{{ .smtp_password }}"
|
||||
METRICS_BEARER_TOKEN="{{ .metrics_bearer_token }}"
|
||||
{{ end }}
|
||||
EOT
|
||||
}
|
||||
|
||||
kill_timeout = "30s"
|
||||
|
||||
resources {
|
||||
cpu = 300
|
||||
memory = 512
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# ══ WORKERS ═══════════════════════════════════════════════════════════════
|
||||
# Workers bind no ports, so each group gets canary + auto_promote:
|
||||
# new version starts alongside the old one, must pass min_healthy_time,
|
||||
# then old allocations stop. auto_revert rolls back on failure.
|
||||
# Scale with: nomad job scale contract-check worker-<name> <count>
|
||||
|
||||
group "worker-extract" {
|
||||
count = 1
|
||||
|
||||
update {
|
||||
canary = 1
|
||||
auto_promote = true
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 3
|
||||
interval = "10m"
|
||||
delay = "15s"
|
||||
mode = "delay"
|
||||
}
|
||||
|
||||
task "worker-extract" {
|
||||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-extract:{{ mustEnv \"IMAGE_TAG\" }}"
|
||||
|
||||
auth {
|
||||
usernameFile = "secrets/registry-user"
|
||||
passwordFile = "secrets/registry-pass"
|
||||
}
|
||||
}
|
||||
|
||||
env {
|
||||
ENV = "prod"
|
||||
LOG_LEVEL = "INFO"
|
||||
LOG_FORMAT = "json"
|
||||
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "secrets/registry-user"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/registry-pass"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/env"
|
||||
env = true
|
||||
change_mode = "restart"
|
||||
data = <<-EOT
|
||||
{{ with nomadVar "nomad/jobs/contract-check" }}
|
||||
DATABASE_URL="{{ .database_url }}"
|
||||
RABBITMQ_URL="{{ .rabbitmq_url }}"
|
||||
S3_ENDPOINT_URL="{{ .s3_endpoint_url }}"
|
||||
S3_ACCESS_KEY="{{ .s3_access_key }}"
|
||||
S3_SECRET_KEY="{{ .s3_secret_key }}"
|
||||
S3_BUCKET="{{ .s3_bucket }}"
|
||||
OLLAMA_API_KEY="{{ .ollama_api_key }}"
|
||||
YANDEXGPT_API_KEY="{{ .yandexgpt_api_key }}"
|
||||
{{ end }}
|
||||
EOT
|
||||
}
|
||||
|
||||
kill_timeout = "60s"
|
||||
|
||||
resources {
|
||||
# CPU-bound OCR (tesseract); the heaviest task of the pipeline.
|
||||
cpu = 500
|
||||
memory = 640
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
group "worker-analyze" {
|
||||
count = 1
|
||||
|
||||
update {
|
||||
canary = 1
|
||||
auto_promote = true
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 3
|
||||
interval = "10m"
|
||||
delay = "15s"
|
||||
mode = "delay"
|
||||
}
|
||||
|
||||
task "worker-analyze" {
|
||||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-analyze:{{ mustEnv \"IMAGE_TAG\" }}"
|
||||
|
||||
auth {
|
||||
usernameFile = "secrets/registry-user"
|
||||
passwordFile = "secrets/registry-pass"
|
||||
}
|
||||
}
|
||||
|
||||
env {
|
||||
ENV = "prod"
|
||||
LOG_LEVEL = "INFO"
|
||||
LOG_FORMAT = "json"
|
||||
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "secrets/registry-user"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/registry-pass"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/env"
|
||||
env = true
|
||||
change_mode = "restart"
|
||||
data = <<-EOT
|
||||
{{ with nomadVar "nomad/jobs/contract-check" }}
|
||||
DATABASE_URL="{{ .database_url }}"
|
||||
RABBITMQ_URL="{{ .rabbitmq_url }}"
|
||||
S3_ENDPOINT_URL="{{ .s3_endpoint_url }}"
|
||||
S3_ACCESS_KEY="{{ .s3_access_key }}"
|
||||
S3_SECRET_KEY="{{ .s3_secret_key }}"
|
||||
S3_BUCKET="{{ .s3_bucket }}"
|
||||
OLLAMA_API_KEY="{{ .ollama_api_key }}"
|
||||
YANDEXGPT_API_KEY="{{ .yandexgpt_api_key }}"
|
||||
{{ end }}
|
||||
EOT
|
||||
}
|
||||
|
||||
kill_timeout = "120s"
|
||||
|
||||
resources {
|
||||
# LLM calls (I/O bound, long in-flight requests on shutdown).
|
||||
cpu = 250
|
||||
memory = 384
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
group "worker-prescreen" {
|
||||
count = 1
|
||||
|
||||
update {
|
||||
canary = 1
|
||||
auto_promote = true
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 3
|
||||
interval = "10m"
|
||||
delay = "15s"
|
||||
mode = "delay"
|
||||
}
|
||||
|
||||
task "worker-prescreen" {
|
||||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-prescreen:{{ mustEnv \"IMAGE_TAG\" }}"
|
||||
|
||||
auth {
|
||||
usernameFile = "secrets/registry-user"
|
||||
passwordFile = "secrets/registry-pass"
|
||||
}
|
||||
}
|
||||
|
||||
env {
|
||||
ENV = "prod"
|
||||
LOG_LEVEL = "INFO"
|
||||
LOG_FORMAT = "json"
|
||||
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "secrets/registry-user"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/registry-pass"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/env"
|
||||
env = true
|
||||
change_mode = "restart"
|
||||
data = <<-EOT
|
||||
{{ with nomadVar "nomad/jobs/contract-check" }}
|
||||
DATABASE_URL="{{ .database_url }}"
|
||||
RABBITMQ_URL="{{ .rabbitmq_url }}"
|
||||
S3_ENDPOINT_URL="{{ .s3_endpoint_url }}"
|
||||
S3_ACCESS_KEY="{{ .s3_access_key }}"
|
||||
S3_SECRET_KEY="{{ .s3_secret_key }}"
|
||||
S3_BUCKET="{{ .s3_bucket }}"
|
||||
OLLAMA_API_KEY="{{ .ollama_api_key }}"
|
||||
YANDEXGPT_API_KEY="{{ .yandexgpt_api_key }}"
|
||||
{{ end }}
|
||||
EOT
|
||||
}
|
||||
|
||||
kill_timeout = "60s"
|
||||
|
||||
resources {
|
||||
cpu = 150
|
||||
memory = 256
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
group "worker-billing" {
|
||||
count = 1
|
||||
|
||||
update {
|
||||
canary = 1
|
||||
auto_promote = true
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 3
|
||||
interval = "10m"
|
||||
delay = "15s"
|
||||
mode = "delay"
|
||||
}
|
||||
|
||||
task "worker-billing" {
|
||||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-billing:{{ mustEnv \"IMAGE_TAG\" }}"
|
||||
|
||||
auth {
|
||||
usernameFile = "secrets/registry-user"
|
||||
passwordFile = "secrets/registry-pass"
|
||||
}
|
||||
}
|
||||
|
||||
env {
|
||||
ENV = "prod"
|
||||
LOG_LEVEL = "INFO"
|
||||
LOG_FORMAT = "json"
|
||||
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "secrets/registry-user"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/registry-pass"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/env"
|
||||
env = true
|
||||
change_mode = "restart"
|
||||
data = <<-EOT
|
||||
{{ with nomadVar "nomad/jobs/contract-check" }}
|
||||
DATABASE_URL="{{ .database_url }}"
|
||||
{{ end }}
|
||||
EOT
|
||||
}
|
||||
|
||||
kill_timeout = "60s"
|
||||
|
||||
resources {
|
||||
# Background DB-only worker (dunning, renewals); lightest of the set.
|
||||
cpu = 150
|
||||
memory = 256
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
group "worker-notify" {
|
||||
count = 1
|
||||
|
||||
update {
|
||||
canary = 1
|
||||
auto_promote = true
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 3
|
||||
interval = "10m"
|
||||
delay = "15s"
|
||||
mode = "delay"
|
||||
}
|
||||
|
||||
task "worker-notify" {
|
||||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "<FORGEJO_HOST>/<OWNER>/contract-check-worker-notify:{{ mustEnv \"IMAGE_TAG\" }}"
|
||||
|
||||
auth {
|
||||
usernameFile = "secrets/registry-user"
|
||||
passwordFile = "secrets/registry-pass"
|
||||
}
|
||||
}
|
||||
|
||||
env {
|
||||
ENV = "prod"
|
||||
LOG_LEVEL = "INFO"
|
||||
LOG_FORMAT = "json"
|
||||
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
|
||||
}
|
||||
|
||||
template {
|
||||
destination = "secrets/registry-user"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_user }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/registry-pass"
|
||||
data = "{{ with nomadVar \"nomad/jobs/contract-check\" }}{{ .registry_token }}{{ end }}"
|
||||
}
|
||||
template {
|
||||
destination = "secrets/env"
|
||||
env = true
|
||||
change_mode = "restart"
|
||||
data = <<-EOT
|
||||
{{ with nomadVar "nomad/jobs/contract-check" }}
|
||||
DATABASE_URL="{{ .database_url }}"
|
||||
RABBITMQ_URL="{{ .rabbitmq_url }}"
|
||||
SMTP_HOST="{{ .smtp_host }}"
|
||||
SMTP_USERNAME="{{ .smtp_username }}"
|
||||
SMTP_PASSWORD="{{ .smtp_password }}"
|
||||
{{ end }}
|
||||
EOT
|
||||
}
|
||||
|
||||
kill_timeout = "60s"
|
||||
|
||||
resources {
|
||||
cpu = 150
|
||||
memory = 256
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
74
deploy/nomad/nomad.hcl
Normal file
74
deploy/nomad/nomad.hcl
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
# Single-node Nomad agent for «Контракт-чек» (services VPS).
|
||||
#
|
||||
# One process = scheduler (server) + docker workload host (client).
|
||||
# Install & bootstrap runbook: deploy/nomad/README.md.
|
||||
#
|
||||
# Target location on the VPS: /etc/nomad.d/nomad.hcl
|
||||
|
||||
datacenter = "vps"
|
||||
region = "global"
|
||||
data_dir = "/var/lib/nomad"
|
||||
log_level = "INFO"
|
||||
|
||||
# The agent binds 4646 (http) / 4647 (rpc) / 4648 (gossip) on 0.0.0.0 by
|
||||
# default. The host firewall MUST restrict them (see README §6):
|
||||
# - 4646 tcp: allow ONLY the Forgejo server IP (runner deploys)
|
||||
# - 4647/4648: single-node cluster, no external peers — keep blocked.
|
||||
|
||||
# Point-to-point TLS: the Forgejo runner reaches the API over the public
|
||||
# internet. Self-signed CA (README §3); the runner only needs nomad-ca.crt.
|
||||
tls {
|
||||
http = true
|
||||
rpc = true
|
||||
|
||||
ca_file = "/etc/nomad.d/tls/nomad-ca.crt"
|
||||
cert_file = "/etc/nomad.d/tls/server.crt"
|
||||
key_file = "/etc/nomad.d/tls/server.key"
|
||||
|
||||
# Requires the server cert SAN to carry server.global.vps.nomad
|
||||
# (region.region/datacenter convention) — the README cert command adds it.
|
||||
verify_server_hostname = true
|
||||
}
|
||||
|
||||
# Anonymous requests are rejected; every client needs a token.
|
||||
acl {
|
||||
enabled = true
|
||||
}
|
||||
|
||||
server {
|
||||
# Single-server cluster: acceptable for one VPS. If the agent is down,
|
||||
# running allocations keep running (docker does not kill them) — only
|
||||
# scheduling/deployments pause until it is back.
|
||||
enabled = true
|
||||
bootstrap_expect = 1
|
||||
}
|
||||
|
||||
client {
|
||||
enabled = true
|
||||
# Docker driver is auto-detected. Tasks pull images from the Forgejo
|
||||
# registry via per-task `auth {}` templated from Nomad Variables
|
||||
# (nomad/jobs/contract-check) — no host-level `docker login` needed.
|
||||
|
||||
# The compose stack (postgres, rabbitmq, minio, redis, nginx, observability)
|
||||
# runs OUTSIDE Nomad but on the same 4 GB VPS. Reserve its share so the
|
||||
# scheduler only bin-packs what is actually left (~2.5 GB / ~1.6 GHz).
|
||||
reserved {
|
||||
cpu = 400
|
||||
memory = 1536
|
||||
}
|
||||
}
|
||||
|
||||
# Docker driver is intentionally left at defaults:
|
||||
# - host bind mounts are DISABLED (docker.volumes.enabled=false by default)
|
||||
# — tasks are 12-factor (env-only config), no volumes required;
|
||||
# - Nomad garbage-collects unused images periodically — good for the
|
||||
# 50 GB NVMe.
|
||||
# Enable only if a task ever needs a bind mount:
|
||||
#
|
||||
# plugin "docker" {
|
||||
# config {
|
||||
# volumes {
|
||||
# enabled = true
|
||||
# }
|
||||
# }
|
||||
# }
|
||||
22
deploy/nomad/nomad.service
Normal file
22
deploy/nomad/nomad.service
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# systemd unit for a MANUAL Nomad install (GitHub releases route, README §1b).
|
||||
# The HashiCorp .deb ships an equivalent unit at /lib/systemd/system/nomad.service —
|
||||
# do NOT install this file if nomad was installed via apt.
|
||||
#
|
||||
# Target location: /etc/systemd/system/nomad.service
|
||||
|
||||
[Unit]
|
||||
Description=Nomad
|
||||
Documentation=https://developer.hashicorp.com/nomad/docs
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
# agent reads /etc/nomad.d/*.hcl (deploy/nomad/nomad.hcl copied there)
|
||||
ExecStart=/usr/local/bin/nomad agent -config /etc/nomad.d/
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
Restart=on-failure
|
||||
LimitNOFILE=65536
|
||||
# Runs as root on purpose: the docker driver needs the docker socket.
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
21
deploy/nomad/policies/ci.hcl
Normal file
21
deploy/nomad/policies/ci.hcl
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
# ACL policy for the Forgejo Actions deploy token.
|
||||
#
|
||||
# Scopes: read the default namespace (job list / deployment status polling),
|
||||
# full control over the contract-check job only. The token cannot touch
|
||||
# agents, other jobs, or Nomad Variables (set via the management token).
|
||||
#
|
||||
# Apply with the management token (README §4):
|
||||
# nomad acl policy apply -description "Forgejo CI deploy" ci \
|
||||
# deploy/nomad/policies/ci.hcl
|
||||
#
|
||||
# If `nomad job run` from CI ever fails with permission errors during
|
||||
# deployment evaluation, fall back to namespace-wide write:
|
||||
# namespace "default" { policy = "write" }
|
||||
|
||||
namespace "default" {
|
||||
policy = "read"
|
||||
|
||||
job "contract-check" {
|
||||
policy = "write"
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue