123 lines
4.5 KiB
Text
123 lines
4.5 KiB
Text
|
let build_spec = import "schemas/lib/build_spec.ncl" in
|
|||
|
|
let _concerns_lib = import "schemas/lib/concerns.ncl" in
|
|||
|
|
|
|||
|
|
{
|
|||
|
|
LianNode = {
|
|||
|
|
name | String,
|
|||
|
|
version | String,
|
|||
|
|
mode | [| 'persistent_vm |],
|
|||
|
|
|
|||
|
|
# Logical fleet identity — what id does this node carry inside its fleet declaration.
|
|||
|
|
logical_id | String,
|
|||
|
|
|
|||
|
|
# Physical Hetzner identity — what hostname did we provision in hcloud.
|
|||
|
|
target_server | String,
|
|||
|
|
|
|||
|
|
# Network position — pinned private IP in the workspace's private network.
|
|||
|
|
private_ip | String,
|
|||
|
|
|
|||
|
|
# Buildkit version pinned for reproducibility. Bumped per major release after smoke test.
|
|||
|
|
buildkit_version | String | default = "v0.29.0",
|
|||
|
|
sccache_version | String | default = "v0.9.1",
|
|||
|
|
nushell_version | String | default = "0.112.2",
|
|||
|
|
just_version | String | default = "1.51.0",
|
|||
|
|
oras_version | String | default = "1.3.2",
|
|||
|
|
|
|||
|
|
# TLS — REQUIRED. Buildkit must be served with TLS. Certs are delivered by
|
|||
|
|
# fleet-agent's install_tls command (cert-manager source, per adr-009).
|
|||
|
|
# Material lands at /etc/buildkit/tls/{ca.crt,server.crt,server.key}.
|
|||
|
|
tls | {
|
|||
|
|
domain | String,
|
|||
|
|
cert_path | String,
|
|||
|
|
ca_path | String,
|
|||
|
|
key_path | String,
|
|||
|
|
tcp_listen_port | Number | default = 1234,
|
|||
|
|
reload_hook | String | default = "systemctl reload-or-restart buildkitd",
|
|||
|
|
},
|
|||
|
|
|
|||
|
|
default_size | {
|
|||
|
|
cpu | build_spec.BoundedCpu,
|
|||
|
|
memory_gb | build_spec.PositiveNumber,
|
|||
|
|
disk_gb | build_spec.PositiveNumber,
|
|||
|
|
},
|
|||
|
|
|
|||
|
|
# Persistent storage IS allowed here — that is the whole point. Disk survives across
|
|||
|
|
# builds; sccache hot cache + buildkit OCI layers stay warm. Cleaning policy is per-fleet.
|
|||
|
|
storage | {
|
|||
|
|
persistent | Bool | default = true,
|
|||
|
|
sccache_disk_path | String | default = "/var/cache/sccache",
|
|||
|
|
buildkit_root | String | default = "/var/lib/buildkit",
|
|||
|
|
},
|
|||
|
|
|
|||
|
|
hcloud | {
|
|||
|
|
server_type | String,
|
|||
|
|
location | String | default = "fsn1",
|
|||
|
|
firewall | String | optional,
|
|||
|
|
},
|
|||
|
|
|
|||
|
|
ssh | {
|
|||
|
|
# Public key authorized for buildkit clients (operator workstation + remote services).
|
|||
|
|
# Refers to a sops path resolvable at deploy time.
|
|||
|
|
authorized_keys_secret | String,
|
|||
|
|
},
|
|||
|
|
|
|||
|
|
# Sccache backend — when configured the install script sets /etc/sccache.env globally.
|
|||
|
|
# Absent = sccache binary present but no global backend (per-build env still works).
|
|||
|
|
sccache_backend | {
|
|||
|
|
kind | [| 's3, 'redis, 'local |],
|
|||
|
|
endpoint | String | optional,
|
|||
|
|
bucket | String | optional,
|
|||
|
|
region | String | optional,
|
|||
|
|
creds_ref | String | optional,
|
|||
|
|
} | optional,
|
|||
|
|
|
|||
|
|
# Optional registry refs so cargo-chef/buildkit can authenticate at build time.
|
|||
|
|
registries | Array {
|
|||
|
|
name | String,
|
|||
|
|
endpoint | String,
|
|||
|
|
creds_ref | String | optional,
|
|||
|
|
} | default = [],
|
|||
|
|
|
|||
|
|
# Swap policy for build workload nodes. Standalone buildkit on a small
|
|||
|
|
# instance (cax11: 4GB RAM) benefits from swap as an overflow buffer
|
|||
|
|
# during linker peaks (mold/lld peaks easily hit 2–3 GB transient on
|
|||
|
|
# release builds). Cluster-worker mode disables swap (kubelet historically
|
|||
|
|
# requires it off; modern feature gate is opt-in).
|
|||
|
|
#
|
|||
|
|
# modes:
|
|||
|
|
# 'file — fallocate /swapfile, mkswap, swapon, persist via fstab
|
|||
|
|
# 'disabled — swapoff -a, remove fstab entries (cluster-worker prep)
|
|||
|
|
# 'preserve — no-op (leave whatever state the node has)
|
|||
|
|
swap | {
|
|||
|
|
mode | [| 'file, 'disabled, 'preserve |] | default = 'preserve,
|
|||
|
|
size_gb | Number | default = 8,
|
|||
|
|
path | String | default = "/swapfile",
|
|||
|
|
swappiness | Number | default = 10,
|
|||
|
|
vfs_cache_pressure | Number | default = 50,
|
|||
|
|
} | default = {},
|
|||
|
|
|
|||
|
|
requires | {
|
|||
|
|
credentials | Array String | default = [],
|
|||
|
|
capabilities | Array String | default = [],
|
|||
|
|
} | default = {},
|
|||
|
|
|
|||
|
|
provides | {
|
|||
|
|
service | String | optional,
|
|||
|
|
interface | String | optional,
|
|||
|
|
} | default = {},
|
|||
|
|
|
|||
|
|
operations | {
|
|||
|
|
install | Bool | default = true,
|
|||
|
|
update | Bool | default = true,
|
|||
|
|
delete | Bool | default = false,
|
|||
|
|
health | Bool | default = true,
|
|||
|
|
} | default = {},
|
|||
|
|
|
|||
|
|
# ServiceConcerns umbrella (ADR-008). Persistent node — disk + cache survive,
|
|||
|
|
# so backups become relevant (unlike buildkit_runner which is ephemeral).
|
|||
|
|
concerns | _concerns_lib.ServiceConcerns | optional,
|
|||
|
|
|
|||
|
|
..
|
|||
|
|
},
|
|||
|
|
}
|