From 8b1857e83f65a43493d8967f39f780573b522552 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 18 Apr 2026 08:20:10 +0000 Subject: [PATCH] fix: add site-content to HOST_VOLUME_DIRS + update AGENTS.md jobspec table (#989) Add /srv/disinto/docker to HOST_VOLUME_DIRS in cluster-up.sh so the staging host volume directory exists before Nomad starts (prevents client fingerprinting failure on fresh-box init). Also add staging.hcl and chat.hcl entries to the nomad/AGENTS.md jobspec documentation table. Co-Authored-By: Claude Opus 4.6 (1M context) --- lib/init/nomad/cluster-up.sh | 1 + nomad/AGENTS.md | 2 ++ 2 files changed, 3 insertions(+) diff --git a/lib/init/nomad/cluster-up.sh b/lib/init/nomad/cluster-up.sh index 4e39d88..488d2df 100755 --- a/lib/init/nomad/cluster-up.sh +++ b/lib/init/nomad/cluster-up.sh @@ -66,6 +66,7 @@ HOST_VOLUME_DIRS=( "/srv/disinto/agent-data" "/srv/disinto/project-repos" "/srv/disinto/caddy-data" + "/srv/disinto/docker" "/srv/disinto/chat-history" "/srv/disinto/ops-repo" ) diff --git a/nomad/AGENTS.md b/nomad/AGENTS.md index 31d21bb..18f7dcc 100644 --- a/nomad/AGENTS.md +++ b/nomad/AGENTS.md @@ -19,6 +19,8 @@ see issues #821–#962 for the step breakdown. | `jobs/woodpecker-server.hcl` | submitted via `lib/init/nomad/deploy.sh` | Woodpecker CI server; host networking, Vault KV for `WOODPECKER_AGENT_SECRET` + Forgejo OAuth creds (S3.1) | | `jobs/woodpecker-agent.hcl` | submitted via `lib/init/nomad/deploy.sh` | Woodpecker CI agent; host networking, `docker.sock` mount, Vault KV for `WOODPECKER_AGENT_SECRET`; `WOODPECKER_SERVER` uses `${attr.unique.network.ip-address}:9000` (Nomad interpolation) — port binds to LXC alloc IP, not localhost (S3.2, S3-fix-6, #964) | | `jobs/agents.hcl` | submitted via `lib/init/nomad/deploy.sh` | All 7 agent roles (dev, review, gardener, planner, predictor, supervisor, architect) + llama variant; Vault-templated bot tokens via `service-agents` policy; `force_pull = false` — image is built locally by `bin/disinto --with agents`, no registry (S4.1, S4-fix-2, S4-fix-5, #955, #972, #978) | +| `jobs/staging.hcl` | submitted via `lib/init/nomad/deploy.sh` | Caddy file-server mounting `docker/` as `/srv/site:ro`; no Vault integration; internal-only via edge proxy (S5.2, #989) | +| `jobs/chat.hcl` | submitted via `lib/init/nomad/deploy.sh` | Claude chat UI; custom `disinto/chat:local` image; sandbox hardening (cap_drop ALL, tmpfs, pids_limit 128); Vault-templated OAuth secrets via `service-chat` policy (S5.2, #989) | Nomad auto-merges every `*.hcl` under `-config=/etc/nomad.d/`, so the split between `server.hcl` and `client.hcl` is for readability, not