# Single-node Nomad agent for «Контракт-чек» (services VPS).
#
# One process = scheduler (server) + docker workload host (client).
# Install & bootstrap runbook: deploy/nomad/README.md.
#
# Target location on the VPS: /etc/nomad.d/nomad.hcl

datacenter = "vps"
region     = "global"
data_dir   = "/var/lib/nomad"
log_level  = "INFO"

# The agent binds 4646 (http) / 4647 (rpc) / 4648 (gossip) on 0.0.0.0 by
# default. The host firewall MUST restrict them (see README §6):
#   - 4646 tcp: allow ONLY the Forgejo server IP (runner deploys)
#   - 4647/4648: single-node cluster, no external peers — keep blocked.

# Point-to-point TLS: the Forgejo runner reaches the API over the public
# internet. Self-signed CA (README §3); the runner only needs nomad-ca.crt.
tls {
  http = true
  rpc  = true

  ca_file   = "/etc/nomad.d/tls/nomad-ca.crt"
  cert_file = "/etc/nomad.d/tls/server.crt"
  key_file  = "/etc/nomad.d/tls/server.key"

  # RPC cert-name convention is server.<region>.nomad (see gen-tls.sh);
  # the generated SAN list covers both region and region.dc forms.
  verify_server_hostname = true
}

# Anonymous requests are rejected; every client needs a token.
acl {
  enabled = true
}

server {
  # Single-server cluster: acceptable for one VPS. If the agent is down,
  # running allocations keep running (docker does not kill them) — only
  # scheduling/deployments pause until it is back.
  enabled          = true
  bootstrap_expect = 1
}

client {
  enabled = true
  # Docker driver is auto-detected. Tasks pull images from the Forgejo
  # registry via per-task `auth {}` templated from Nomad Variables
  # (nomad/jobs/contract-check) — no host-level `docker login` needed.

  # The compose stack (postgres, rabbitmq, minio, redis, nginx, observability)
  # runs OUTSIDE Nomad but on the same 4 GB VPS. Reserve its share so the
  # scheduler only bin-packs what is actually left (~2.5 GB / ~1.6 GHz).
  reserved {
    cpu    = 400
    memory = 1536
  }
}

# Docker driver: host bind mounts enabled so tasks can source /root's .env.
plugin "docker" {
  config {
    volumes {
      enabled = true
    }
  }
}