173 lines
6.9 KiB
HCL
173 lines
6.9 KiB
HCL
# =============================================================================
|
|
# nomad/jobs/woodpecker-server.hcl — Woodpecker CI server (Nomad service job)
|
|
#
|
|
# Part of the Nomad+Vault migration (S3.1, issue #934).
|
|
# Runs the Woodpecker CI web UI + gRPC endpoint as a Nomad service job,
|
|
# reading its Forgejo OAuth + agent secret from Vault via workload identity.
|
|
#
|
|
# Host_volume contract:
|
|
# This job mounts the `woodpecker-data` host_volume declared in
|
|
# nomad/client.hcl. That volume is backed by /srv/disinto/woodpecker-data
|
|
# on the factory box, created by lib/init/nomad/cluster-up.sh before any
|
|
# job references it. Keep the `source = "woodpecker-data"` below in sync
|
|
# with the host_volume stanza in client.hcl — drift = scheduling failures.
|
|
#
|
|
# Vault integration (S2.4 pattern):
|
|
# - vault { role = "service-woodpecker" } at the group scope — the task's
|
|
# workload-identity JWT is exchanged for a Vault token carrying the
|
|
# policy named on that role. Role + policy are defined in
|
|
# vault/roles.yaml + vault/policies/service-woodpecker.hcl.
|
|
# - template { destination = "secrets/wp.env" env = true } pulls
|
|
# WOODPECKER_AGENT_SECRET, WOODPECKER_FORGEJO_CLIENT, and
|
|
# WOODPECKER_FORGEJO_SECRET out of Vault KV v2 at
|
|
# kv/disinto/shared/woodpecker and merges them into the task env.
|
|
# Agent secret seeded by tools/vault-seed-woodpecker.sh; OAuth
|
|
# client/secret seeded by S3.3 (wp-oauth-register.sh).
|
|
# - Non-secret env (DB driver, Forgejo URL, host URL, open registration)
|
|
# stays inline below — not sensitive, not worth round-tripping through
|
|
# Vault.
|
|
#
|
|
# Not the runtime yet: docker-compose.yml is still the factory's live stack
|
|
# until cutover. This file exists so CI can validate it and S3.4 can wire
|
|
# `disinto init --backend=nomad --with woodpecker` to `nomad job run` it.
|
|
# =============================================================================
|
|
|
|
job "woodpecker-server" {
|
|
type = "service"
|
|
datacenters = ["dc1"]
|
|
|
|
group "woodpecker-server" {
|
|
count = 1
|
|
|
|
# ── Vault workload identity (S2.4 pattern) ──────────────────────────────
|
|
# `role = "service-woodpecker"` is defined in vault/roles.yaml and
|
|
# applied by tools/vault-apply-roles.sh (S2.3). The role's bound
|
|
# claim pins nomad_job_id = "woodpecker" — note the job_id in
|
|
# vault/roles.yaml is "woodpecker" (matching the roles.yaml entry),
|
|
# but the actual Nomad job name here is "woodpecker-server". Update
|
|
# vault/roles.yaml job_id to "woodpecker-server" if the bound claim
|
|
# enforces an exact match at placement.
|
|
vault {
|
|
role = "service-woodpecker"
|
|
}
|
|
|
|
# HTTP UI (:8000) + gRPC agent endpoint (:9000). Static ports match
|
|
# docker-compose's published ports so the rest of the factory keeps
|
|
# reaching woodpecker at the same host:port during and after cutover.
|
|
network {
|
|
port "http" {
|
|
static = 8000
|
|
to = 8000
|
|
}
|
|
port "grpc" {
|
|
static = 9000
|
|
to = 9000
|
|
}
|
|
}
|
|
|
|
# Host-volume mount: declared in nomad/client.hcl, path
|
|
# /srv/disinto/woodpecker-data on the factory box.
|
|
volume "woodpecker-data" {
|
|
type = "host"
|
|
source = "woodpecker-data"
|
|
read_only = false
|
|
}
|
|
|
|
# Conservative restart policy — fail fast to the scheduler instead of
|
|
# spinning on a broken image/config. 3 attempts over 5m, then back off.
|
|
restart {
|
|
attempts = 3
|
|
interval = "5m"
|
|
delay = "15s"
|
|
mode = "delay"
|
|
}
|
|
|
|
# Native Nomad service discovery (no Consul in this factory cluster).
|
|
# Health check gates the service as healthy only after the HTTP API is
|
|
# up; initial_status is deliberately unset so Nomad waits for the first
|
|
# probe to pass before marking the allocation healthy on boot.
|
|
service {
|
|
name = "woodpecker"
|
|
port = "http"
|
|
provider = "nomad"
|
|
|
|
check {
|
|
type = "http"
|
|
path = "/healthz"
|
|
interval = "10s"
|
|
timeout = "3s"
|
|
}
|
|
}
|
|
|
|
task "woodpecker-server" {
|
|
driver = "docker"
|
|
|
|
config {
|
|
image = "woodpeckerci/woodpecker-server:v3"
|
|
ports = ["http", "grpc"]
|
|
}
|
|
|
|
volume_mount {
|
|
volume = "woodpecker-data"
|
|
destination = "/var/lib/woodpecker"
|
|
read_only = false
|
|
}
|
|
|
|
# Non-secret env — Forgejo integration flags, public URL, DB driver.
|
|
# Nothing sensitive here, so this stays inline. Secret-bearing env
|
|
# (agent secret, OAuth client/secret) lives in the template stanza
|
|
# below and is merged into task env.
|
|
env {
|
|
WOODPECKER_FORGEJO = "true"
|
|
WOODPECKER_FORGEJO_URL = "http://forgejo:3000"
|
|
WOODPECKER_HOST = "http://woodpecker:8000"
|
|
WOODPECKER_OPEN = "true"
|
|
WOODPECKER_DATABASE_DRIVER = "sqlite3"
|
|
WOODPECKER_DATABASE_DATASOURCE = "/var/lib/woodpecker/woodpecker.sqlite"
|
|
}
|
|
|
|
# ── Vault-templated secrets env (S2.4 pattern) ─────────────────────────
|
|
# Renders `<task-dir>/secrets/wp.env` (per-alloc secrets dir, never on
|
|
# disk on the host root filesystem). `env = true` merges every KEY=VAL
|
|
# line into the task environment. `change_mode = "restart"` re-runs the
|
|
# task whenever a watched secret's value in Vault changes.
|
|
#
|
|
# Vault path: `kv/data/disinto/shared/woodpecker`. The literal `/data/`
|
|
# segment is required by consul-template for KV v2 mounts.
|
|
#
|
|
# Empty-Vault fallback (`with ... else ...`): on a fresh LXC where
|
|
# the KV path is absent, consul-template's `with` short-circuits to
|
|
# the `else` branch. Emitting visible placeholders means the container
|
|
# still boots, but with obviously-bad secrets. Seed the path with
|
|
# tools/vault-seed-woodpecker.sh (agent_secret) and S3.3's
|
|
# wp-oauth-register.sh (forgejo_client, forgejo_secret).
|
|
#
|
|
# Placeholder values are kept short on purpose: the repo-wide
|
|
# secret-scan flags `TOKEN=<16+ non-space chars>` as a plaintext
|
|
# secret; "seed-me" is < 16 chars and still distinctive.
|
|
template {
|
|
destination = "secrets/wp.env"
|
|
env = true
|
|
change_mode = "restart"
|
|
error_on_missing_key = false
|
|
data = <<EOT
|
|
{{- with secret "kv/data/disinto/shared/woodpecker" -}}
|
|
WOODPECKER_AGENT_SECRET={{ .Data.data.agent_secret }}
|
|
WOODPECKER_FORGEJO_CLIENT={{ .Data.data.forgejo_client }}
|
|
WOODPECKER_FORGEJO_SECRET={{ .Data.data.forgejo_secret }}
|
|
{{- else -}}
|
|
# WARNING: kv/disinto/shared/woodpecker is empty — run tools/vault-seed-woodpecker.sh + S3.3
|
|
WOODPECKER_AGENT_SECRET=seed-me
|
|
WOODPECKER_FORGEJO_CLIENT=seed-me
|
|
WOODPECKER_FORGEJO_SECRET=seed-me
|
|
{{- end -}}
|
|
EOT
|
|
}
|
|
|
|
resources {
|
|
cpu = 300
|
|
memory = 512
|
|
}
|
|
}
|
|
}
|
|
}
|