122 lines
4.5 KiB
Text
122 lines
4.5 KiB
Text
let build_spec = import "schemas/lib/build_spec.ncl" in
|
||
let _concerns_lib = import "schemas/lib/concerns.ncl" in
|
||
|
||
{
|
||
LianNode = {
|
||
name | String,
|
||
version | String,
|
||
mode | [| 'persistent_vm |],
|
||
|
||
# Logical fleet identity — what id does this node carry inside its fleet declaration.
|
||
logical_id | String,
|
||
|
||
# Physical Hetzner identity — what hostname did we provision in hcloud.
|
||
target_server | String,
|
||
|
||
# Network position — pinned private IP in the workspace's private network.
|
||
private_ip | String,
|
||
|
||
# Buildkit version pinned for reproducibility. Bumped per major release after smoke test.
|
||
buildkit_version | String | default = "v0.29.0",
|
||
sccache_version | String | default = "v0.9.1",
|
||
nushell_version | String | default = "0.112.2",
|
||
just_version | String | default = "1.51.0",
|
||
oras_version | String | default = "1.3.2",
|
||
|
||
# TLS — REQUIRED. Buildkit must be served with TLS. Certs are delivered by
|
||
# fleet-agent's install_tls command (cert-manager source, per adr-009).
|
||
# Material lands at /etc/buildkit/tls/{ca.crt,server.crt,server.key}.
|
||
tls | {
|
||
domain | String,
|
||
cert_path | String,
|
||
ca_path | String,
|
||
key_path | String,
|
||
tcp_listen_port | Number | default = 1234,
|
||
reload_hook | String | default = "systemctl reload-or-restart buildkitd",
|
||
},
|
||
|
||
default_size | {
|
||
cpu | build_spec.BoundedCpu,
|
||
memory_gb | build_spec.PositiveNumber,
|
||
disk_gb | build_spec.PositiveNumber,
|
||
},
|
||
|
||
# Persistent storage IS allowed here — that is the whole point. Disk survives across
|
||
# builds; sccache hot cache + buildkit OCI layers stay warm. Cleaning policy is per-fleet.
|
||
storage | {
|
||
persistent | Bool | default = true,
|
||
sccache_disk_path | String | default = "/var/cache/sccache",
|
||
buildkit_root | String | default = "/var/lib/buildkit",
|
||
},
|
||
|
||
hcloud | {
|
||
server_type | String,
|
||
location | String | default = "fsn1",
|
||
firewall | String | optional,
|
||
},
|
||
|
||
ssh | {
|
||
# Public key authorized for buildkit clients (operator workstation + remote services).
|
||
# Refers to a sops path resolvable at deploy time.
|
||
authorized_keys_secret | String,
|
||
},
|
||
|
||
# Sccache backend — when configured the install script sets /etc/sccache.env globally.
|
||
# Absent = sccache binary present but no global backend (per-build env still works).
|
||
sccache_backend | {
|
||
kind | [| 's3, 'redis, 'local |],
|
||
endpoint | String | optional,
|
||
bucket | String | optional,
|
||
region | String | optional,
|
||
creds_ref | String | optional,
|
||
} | optional,
|
||
|
||
# Optional registry refs so cargo-chef/buildkit can authenticate at build time.
|
||
registries | Array {
|
||
name | String,
|
||
endpoint | String,
|
||
creds_ref | String | optional,
|
||
} | default = [],
|
||
|
||
# Swap policy for build workload nodes. Standalone buildkit on a small
|
||
# instance (cax11: 4GB RAM) benefits from swap as an overflow buffer
|
||
# during linker peaks (mold/lld peaks easily hit 2–3 GB transient on
|
||
# release builds). Cluster-worker mode disables swap (kubelet historically
|
||
# requires it off; modern feature gate is opt-in).
|
||
#
|
||
# modes:
|
||
# 'file — fallocate /swapfile, mkswap, swapon, persist via fstab
|
||
# 'disabled — swapoff -a, remove fstab entries (cluster-worker prep)
|
||
# 'preserve — no-op (leave whatever state the node has)
|
||
swap | {
|
||
mode | [| 'file, 'disabled, 'preserve |] | default = 'preserve,
|
||
size_gb | Number | default = 8,
|
||
path | String | default = "/swapfile",
|
||
swappiness | Number | default = 10,
|
||
vfs_cache_pressure | Number | default = 50,
|
||
} | default = {},
|
||
|
||
requires | {
|
||
credentials | Array String | default = [],
|
||
capabilities | Array String | default = [],
|
||
} | default = {},
|
||
|
||
provides | {
|
||
service | String | optional,
|
||
interface | String | optional,
|
||
} | default = {},
|
||
|
||
operations | {
|
||
install | Bool | default = true,
|
||
update | Bool | default = true,
|
||
delete | Bool | default = false,
|
||
health | Bool | default = true,
|
||
} | default = {},
|
||
|
||
# ServiceConcerns umbrella (ADR-008). Persistent node — disk + cache survive,
|
||
# so backups become relevant (unlike buildkit_runner which is ephemeral).
|
||
concerns | _concerns_lib.ServiceConcerns | optional,
|
||
|
||
..
|
||
},
|
||
}
|