From 3d62b52e36e081e5beabb9b0dc4be9aa17877f96 Mon Sep 17 00:00:00 2001
From: Agent <agent@example.com>
Date: Fri, 17 Apr 2026 14:43:49 +0000
Subject: [PATCH 1/2] =?UTF-8?q?fix:=20[nomad-step-3]=20S3-fix-6=20?=
 =?UTF-8?q?=E2=80=94=20woodpecker-agent=20can't=20reach=20server=20gRPC=20?=
 =?UTF-8?q?at=20localhost:9000=20(port=20bound=20to=20LXC=20IP)=20(#964)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 nomad/jobs/woodpecker-agent.hcl | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/nomad/jobs/woodpecker-agent.hcl b/nomad/jobs/woodpecker-agent.hcl
index de81459..f753818 100644
--- a/nomad/jobs/woodpecker-agent.hcl
+++ b/nomad/jobs/woodpecker-agent.hcl
@@ -8,8 +8,9 @@
 #
 # Host networking:
 #   Uses network_mode = "host" to match the compose setup. The Woodpecker
-#   server gRPC endpoint is addressed as "localhost:9000" since both
-#   server and agent run on the same host.
+#   server gRPC endpoint is addressed via Nomad service discovery using
+#   the host's IP address (10.10.10.x:9000), since the server's port
+#   binding in Nomad binds to the allocation's IP, not localhost.
 #
 # Vault integration:
 #   - vault { role = "service-woodpecker-agent" } at the group scope — the
@@ -82,8 +83,13 @@ job "woodpecker-agent" {
 
       # Non-secret env — server address, gRPC security, concurrency limit,
       # and health check endpoint. Nothing sensitive here.
+      #
+      # WOODPECKER_SERVER uses Nomad's attribute template to get the host's
+      # IP address (10.10.10.x). The server's gRPC port 9000 is bound via
+      # Nomad's port stanza to the allocation's IP (not localhost), so the
+      # agent must use the LXC's eth0 IP, not 127.0.0.1.
       env {
-        WOODPECKER_SERVER         = "localhost:9000"
+        WOODPECKER_SERVER         = "{{ env \"attr.unique.network.ip-address\" }}:9000"
         WOODPECKER_GRPC_SECURE    = "false"
         WOODPECKER_MAX_WORKFLOWS  = "1"
         WOODPECKER_HEALTHCHECK_ADDR = ":3333"

From ab0a6be41fb86eb9b20064fea19716575df53f53 Mon Sep 17 00:00:00 2001
From: Agent <agent@example.com>
Date: Fri, 17 Apr 2026 14:58:10 +0000
Subject: [PATCH 2/2] fix: use Nomad interpolation syntax for WOODPECKER_SERVER

---
 nomad/jobs/woodpecker-agent.hcl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nomad/jobs/woodpecker-agent.hcl b/nomad/jobs/woodpecker-agent.hcl
index f753818..c7779a2 100644
--- a/nomad/jobs/woodpecker-agent.hcl
+++ b/nomad/jobs/woodpecker-agent.hcl
@@ -89,7 +89,7 @@ job "woodpecker-agent" {
       # Nomad's port stanza to the allocation's IP (not localhost), so the
       # agent must use the LXC's eth0 IP, not 127.0.0.1.
       env {
-        WOODPECKER_SERVER         = "{{ env \"attr.unique.network.ip-address\" }}:9000"
+        WOODPECKER_SERVER         = "${attr.unique.network.ip-address}:9000"
         WOODPECKER_GRPC_SECURE    = "false"
         WOODPECKER_MAX_WORKFLOWS  = "1"
         WOODPECKER_HEALTHCHECK_ADDR = ":3333"