# Single-node Nomad agent for «Контракт-чек» (services VPS).
#
# One process = scheduler (server) + docker workload host (client).
# Install & bootstrap runbook: deploy/nomad/README.md.
#
# Target location on the VPS: /etc/nomad.d/nomad.hcl

datacenter = "vps"
region     = "global"
data_dir   = "/var/lib/nomad"
log_level  = "INFO"

# The agent binds 4646 (http) / 4647 (rpc) / 4648 (gossip) on 0.0.0.0 by
# default. The host firewall MUST restrict them (see README §6):
#   - 4646 tcp: allow ONLY the Forgejo server IP (runner deploys)
#   - 4647/4648: single-node cluster, no external peers — keep blocked.

# Point-to-point TLS: the Forgejo runner reaches the API over the public
# internet. Self-signed CA (README §3); the runner only needs nomad-ca.crt.
tls {
  http = true
  rpc  = true

  ca_file   = "/etc/nomad.d/tls/nomad-ca.crt"
  cert_file = "/etc/nomad.d/tls/server.crt"
  key_file  = "/etc/nomad.d/tls/server.key"

  # Requires the server cert SAN to carry server.global.vps.nomad
  # (region.region/datacenter convention) — the README cert command adds it.
  verify_server_hostname = true
}

# Anonymous requests are rejected; every client needs a token.
acl {
  enabled = true
}

server {
  # Single-server cluster: acceptable for one VPS. If the agent is down,
  # running allocations keep running (docker does not kill them) — only
  # scheduling/deployments pause until it is back.
  enabled          = true
  bootstrap_expect = 1
}

client {
  enabled = true
  # Docker driver is auto-detected. Tasks pull images from the Forgejo
  # registry via per-task `auth {}` templated from Nomad Variables
  # (nomad/jobs/contract-check) — no host-level `docker login` needed.

  # The compose stack (postgres, rabbitmq, minio, redis, nginx, observability)
  # runs OUTSIDE Nomad but on the same 4 GB VPS. Reserve its share so the
  # scheduler only bin-packs what is actually left (~2.5 GB / ~1.6 GHz).
  reserved {
    cpu    = 400
    memory = 1536
  }
}

# Docker driver is intentionally left at defaults:
#   - host bind mounts are DISABLED (docker.volumes.enabled=false by default)
#     — tasks are 12-factor (env-only config), no volumes required;
#   - Nomad garbage-collects unused images periodically — good for the
#     50 GB NVMe.
# Enable only if a task ever needs a bind mount:
#
# plugin "docker" {
#   config {
#     volumes {
#       enabled = true
#     }
#   }
# }