feat(runner): allgemeiner instanzweiter Actions-Runner-LXC (Label homelab, ohne Deploy-Rechte)
This commit is contained in:
+107
@@ -0,0 +1,107 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Allgemeiner Gitea-Actions-Runner — instanzweit, OHNE Deploy-Rechte
|
||||||
|
#
|
||||||
|
# Motivation (nexus K-114-Blocker): Der nexus-Runner läuft auf dem
|
||||||
|
# Produktions-LXC und besitzt sudoers-Deploy-Rechte — er darf deshalb NICHT
|
||||||
|
# instanzweit registriert werden (jedes Repo könnte sonst Workflows auf der
|
||||||
|
# Produktionsmaschine ausführen). Dieser LXC ist die saubere Trennung:
|
||||||
|
# - instanzweite Registrierung (Site Administration → Actions → Runners)
|
||||||
|
# - Label "homelab:host" (Deploy-Jobs bleiben auf "nexus")
|
||||||
|
# - KEINE sudoers-Regeln, kein Zugriff auf Produktions-Verzeichnisse
|
||||||
|
# - Docker via Nesting für Wegwerf-Test-Container (z. B. pgvector in CI)
|
||||||
|
#
|
||||||
|
# Run on a Proxmox VE host:
|
||||||
|
# bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/runner.sh)"
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
APP="runner"
|
||||||
|
APP_DESCRIPTION="Allgemeiner Gitea-Actions-Runner (instanzweit, Label homelab, Docker, ohne Deploy-Rechte)"
|
||||||
|
|
||||||
|
LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
|
||||||
|
INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/runner-install.sh}"
|
||||||
|
|
||||||
|
source <(curl -fsSL "$LIB_URL/build.func")
|
||||||
|
|
||||||
|
DEFAULT_HOSTNAME="runner"
|
||||||
|
DEFAULT_DISK="30"
|
||||||
|
DEFAULT_CORES="4"
|
||||||
|
DEFAULT_RAM="6144"
|
||||||
|
|
||||||
|
prompt_app_config() {
|
||||||
|
echo
|
||||||
|
echo "── Runner configuration ─────────────────────────────────────"
|
||||||
|
if [[ -z "${GITEA_INSTANCE_URL:-}" ]]; then
|
||||||
|
read -rp "Gitea instance URL [https://gitea.luki-net.org]: " GITEA_INSTANCE_URL
|
||||||
|
GITEA_INSTANCE_URL="${GITEA_INSTANCE_URL:-https://gitea.luki-net.org}"
|
||||||
|
fi
|
||||||
|
# WICHTIG: den INSTANZWEITEN Token verwenden
|
||||||
|
# (Site Administration → Actions → Runners → Create new runner),
|
||||||
|
# NICHT den Repo-Token — sonst wiederholt sich der K-114-Scope-Blocker.
|
||||||
|
if [[ -z "${RUNNER_TOKEN:-}" ]]; then
|
||||||
|
read -rsp "INSTANZWEITER Runner-Registration-Token: " RUNNER_TOKEN; echo
|
||||||
|
fi
|
||||||
|
[[ -n "${RUNNER_TOKEN:-}" ]] || { msg_err "RUNNER_TOKEN ist Pflicht (instanzweit, Site Administration)"; exit 1; }
|
||||||
|
RUNNER_NAME="${RUNNER_NAME:-$CT_HOSTNAME}"
|
||||||
|
RUNNER_LABELS="${RUNNER_LABELS:-homelab:host}"
|
||||||
|
RUNNER_VERSION="${RUNNER_VERSION:-0.2.13}"
|
||||||
|
NODE_MAJOR="${NODE_MAJOR:-22}"
|
||||||
|
echo " → instance: $GITEA_INSTANCE_URL"
|
||||||
|
echo " → runner: $RUNNER_NAME labels: $RUNNER_LABELS (act_runner $RUNNER_VERSION, host mode, scope: INSTANZ)"
|
||||||
|
}
|
||||||
|
|
||||||
|
push_app_config() {
|
||||||
|
msg_info "Pushing runner config into container..."
|
||||||
|
local tmpf; tmpf=$(mktemp)
|
||||||
|
cat >"$tmpf" <<EOF
|
||||||
|
GITEA_INSTANCE_URL='$GITEA_INSTANCE_URL'
|
||||||
|
RUNNER_TOKEN='$RUNNER_TOKEN'
|
||||||
|
RUNNER_NAME='$RUNNER_NAME'
|
||||||
|
RUNNER_LABELS='$RUNNER_LABELS'
|
||||||
|
RUNNER_VERSION='$RUNNER_VERSION'
|
||||||
|
NODE_MAJOR='$NODE_MAJOR'
|
||||||
|
EOF
|
||||||
|
pct push "$CTID" "$tmpf" /root/runner.deploy.env --perms 600
|
||||||
|
rm -f "$tmpf"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Docker im unprivilegierten LXC braucht nesting+keyctl (Test-Container in CI).
|
||||||
|
enable_nesting() {
|
||||||
|
msg_info "Enabling nesting+keyctl features (Docker für CI-Test-Container)..."
|
||||||
|
pct set "$CTID" --features nesting=1,keyctl=1
|
||||||
|
pct reboot "$CTID"
|
||||||
|
for _ in $(seq 1 30); do
|
||||||
|
pct exec "$CTID" -- true >/dev/null 2>&1 && break
|
||||||
|
sleep 2
|
||||||
|
done
|
||||||
|
msg_ok "Container restarted with nesting enabled"
|
||||||
|
}
|
||||||
|
|
||||||
|
print_app_summary() {
|
||||||
|
local runner_state
|
||||||
|
runner_state=$(pct exec "$CTID" -- systemctl is-active act-runner.service 2>/dev/null | tr -d '\r\n')
|
||||||
|
cat <<EOF
|
||||||
|
Gitea-Actions-Runner: $RUNNER_NAME [$RUNNER_LABELS] — $runner_state
|
||||||
|
Scope: INSTANZWEIT — bedient alle Repos der Instanz
|
||||||
|
Mode: host (Docker verfügbar für Test-Container)
|
||||||
|
Sicherheit: kein sudoers, keine Deploy-Rechte, keine Produktions-Mounts
|
||||||
|
Verify: $GITEA_INSTANCE_URL → Site Administration → Actions → Runners
|
||||||
|
|
||||||
|
Workflows anderer Repos nutzen: runs-on: ${RUNNER_LABELS%%:*}
|
||||||
|
(Deploy-Jobs von nexus bleiben auf dem nexus-LXC-Runner, Label "nexus".)
|
||||||
|
|
||||||
|
Logs: pct exec $CTID -- journalctl -u act-runner -f
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
trap _on_error ERR
|
||||||
|
preflight_pve
|
||||||
|
show_header "$APP" "$APP_DESCRIPTION"
|
||||||
|
prompt_lxc_config
|
||||||
|
prompt_app_config
|
||||||
|
resolve_debian_template
|
||||||
|
create_lxc
|
||||||
|
enable_nesting
|
||||||
|
push_app_config
|
||||||
|
bootstrap_install_script "$INSTALL_SCRIPT_URL"
|
||||||
|
print_summary
|
||||||
Reference in New Issue
Block a user