91 lines
2.9 KiB
Text
91 lines
2.9 KiB
Text
|
let _presets = (import "schemas/lib/concerns_presets.ncl").presets in
|
||
|
|
|
||
|
|
{
|
||
|
|
lian_node | default = {
|
||
|
|
name | default = "lian_node",
|
||
|
|
version | default = "0.1.0",
|
||
|
|
mode | default = 'persistent_vm,
|
||
|
|
|
||
|
|
live_check | default = { strategy = 'on_demand },
|
||
|
|
|
||
|
|
# Per-instance — caller MUST override. Install script rejects "UNSET" sentinel.
|
||
|
|
logical_id | default = "UNSET",
|
||
|
|
target_server | default = "UNSET",
|
||
|
|
private_ip | default = "0.0.0.0",
|
||
|
|
|
||
|
|
buildkit_version | default = "v0.29.0",
|
||
|
|
sccache_version | default = "v0.9.1",
|
||
|
|
nushell_version | default = "0.112.2",
|
||
|
|
just_version | default = "1.51.0",
|
||
|
|
oras_version | default = "1.3.2",
|
||
|
|
|
||
|
|
tls | default = {
|
||
|
|
domain = "fleet.librecloud.online",
|
||
|
|
cert_path = "/etc/buildkit/tls/server.crt",
|
||
|
|
ca_path = "/etc/buildkit/tls/ca.crt",
|
||
|
|
key_path = "/etc/buildkit/tls/server.key",
|
||
|
|
tcp_listen_port = 1234,
|
||
|
|
reload_hook = "systemctl reload-or-restart buildkitd",
|
||
|
|
},
|
||
|
|
|
||
|
|
default_size | default = {
|
||
|
|
cpu = 2,
|
||
|
|
memory_gb = 4,
|
||
|
|
disk_gb = 40,
|
||
|
|
},
|
||
|
|
|
||
|
|
storage | default = {
|
||
|
|
persistent = true,
|
||
|
|
sccache_disk_path = "/var/cache/sccache",
|
||
|
|
buildkit_root = "/var/lib/buildkit",
|
||
|
|
},
|
||
|
|
|
||
|
|
hcloud | default = {
|
||
|
|
server_type = "cax11",
|
||
|
|
location = "fsn1",
|
||
|
|
},
|
||
|
|
|
||
|
|
ssh | default = {
|
||
|
|
authorized_keys_secret = "lian-node-authorized-keys",
|
||
|
|
},
|
||
|
|
|
||
|
|
registries | default = [],
|
||
|
|
|
||
|
|
# Standalone buildkit nodes default to swap=disabled (preserve current
|
||
|
|
# host state). Workspaces opt in to file-backed swap when the node is
|
||
|
|
# NOT also a cluster worker (see ADR-002 separation).
|
||
|
|
swap | default = {
|
||
|
|
mode = 'preserve,
|
||
|
|
size_gb = 8,
|
||
|
|
path = "/swapfile",
|
||
|
|
swappiness = 10,
|
||
|
|
vfs_cache_pressure = 50,
|
||
|
|
},
|
||
|
|
|
||
|
|
requires | default = {
|
||
|
|
credentials = [],
|
||
|
|
capabilities = ["vm-lifecycle", "ssh-access"],
|
||
|
|
},
|
||
|
|
|
||
|
|
provides | default = {
|
||
|
|
service = "lian_node",
|
||
|
|
interface = "buildkit-persistent",
|
||
|
|
},
|
||
|
|
|
||
|
|
operations | default = {
|
||
|
|
install = true,
|
||
|
|
update = true,
|
||
|
|
health = true,
|
||
|
|
},
|
||
|
|
|
||
|
|
# ServiceConcerns default — persistent node:
|
||
|
|
# - backup matters (disk + sccache cache may justify periodic snapshot)
|
||
|
|
# - tls disabled at buildkit layer (binds unix socket; clients tunnel via SSH or
|
||
|
|
# access via private network — same boundary argument as buildkit_runner)
|
||
|
|
concerns | default = _presets.infrastructure_glue & {
|
||
|
|
tls | force = { kind = 'enabled, reason = "buildkitd serves TCP with Let's Encrypt certs issued+renewed by acme_certd; reload_hook keeps key material fresh" },
|
||
|
|
backup | force = { kind = 'pending, reason = "persistent disk holds sccache + buildkit layers; snapshot policy to be decided per-fleet" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
}
|