74 lines
2.4 KiB
HCL
74 lines
2.4 KiB
HCL
# Single-node Nomad agent for «Контракт-чек» (services VPS).
|
|
#
|
|
# One process = scheduler (server) + docker workload host (client).
|
|
# Install & bootstrap runbook: deploy/nomad/README.md.
|
|
#
|
|
# Target location on the VPS: /etc/nomad.d/nomad.hcl
|
|
|
|
datacenter = "vps"
|
|
region = "global"
|
|
data_dir = "/var/lib/nomad"
|
|
log_level = "INFO"
|
|
|
|
# The agent binds 4646 (http) / 4647 (rpc) / 4648 (gossip) on 0.0.0.0 by
|
|
# default. The host firewall MUST restrict them (see README §6):
|
|
# - 4646 tcp: allow ONLY the Forgejo server IP (runner deploys)
|
|
# - 4647/4648: single-node cluster, no external peers — keep blocked.
|
|
|
|
# Point-to-point TLS: the Forgejo runner reaches the API over the public
|
|
# internet. Self-signed CA (README §3); the runner only needs nomad-ca.crt.
|
|
tls {
|
|
http = true
|
|
rpc = true
|
|
|
|
ca_file = "/etc/nomad.d/tls/nomad-ca.crt"
|
|
cert_file = "/etc/nomad.d/tls/server.crt"
|
|
key_file = "/etc/nomad.d/tls/server.key"
|
|
|
|
# Requires the server cert SAN to carry server.global.vps.nomad
|
|
# (region.region/datacenter convention) — the README cert command adds it.
|
|
verify_server_hostname = true
|
|
}
|
|
|
|
# Anonymous requests are rejected; every client needs a token.
|
|
acl {
|
|
enabled = true
|
|
}
|
|
|
|
server {
|
|
# Single-server cluster: acceptable for one VPS. If the agent is down,
|
|
# running allocations keep running (docker does not kill them) — only
|
|
# scheduling/deployments pause until it is back.
|
|
enabled = true
|
|
bootstrap_expect = 1
|
|
}
|
|
|
|
client {
|
|
enabled = true
|
|
# Docker driver is auto-detected. Tasks pull images from the Forgejo
|
|
# registry via per-task `auth {}` templated from Nomad Variables
|
|
# (nomad/jobs/contract-check) — no host-level `docker login` needed.
|
|
|
|
# The compose stack (postgres, rabbitmq, minio, redis, nginx, observability)
|
|
# runs OUTSIDE Nomad but on the same 4 GB VPS. Reserve its share so the
|
|
# scheduler only bin-packs what is actually left (~2.5 GB / ~1.6 GHz).
|
|
reserved {
|
|
cpu = 400
|
|
memory = 1536
|
|
}
|
|
}
|
|
|
|
# Docker driver is intentionally left at defaults:
|
|
# - host bind mounts are DISABLED (docker.volumes.enabled=false by default)
|
|
# — tasks are 12-factor (env-only config), no volumes required;
|
|
# - Nomad garbage-collects unused images periodically — good for the
|
|
# 50 GB NVMe.
|
|
# Enable only if a task ever needs a bind mount:
|
|
#
|
|
# plugin "docker" {
|
|
# config {
|
|
# volumes {
|
|
# enabled = true
|
|
# }
|
|
# }
|
|
# }
|