78 lines
2.5 KiB
YAML
78 lines
2.5 KiB
YAML
#cloud-config
|
|
# BuildKit runner golden image — Debian 13 (Trixie) arm64. Bakes binaries only; runtime config injected at spawn time.
|
|
# Versions: update here for weekly golden image rebuild cadence (ADR-039 constraint golden-image-rebuild-cadence)
|
|
# SSH key: injected at server creation by hcloud --ssh-key; cloud-init only hardens sshd policy.
|
|
# buildkitd runs as root system service — avoids D-Bus/linger issues during cloud-init setup.
|
|
|
|
packages:
|
|
- uidmap
|
|
- fuse-overlayfs
|
|
- slirp4netns
|
|
- wget
|
|
- ca-certificates
|
|
- just
|
|
|
|
write_files:
|
|
- path: /etc/ssh/sshd_config.d/10-hardening.conf
|
|
permissions: "0644"
|
|
content: |
|
|
PasswordAuthentication no
|
|
PubkeyAuthentication yes
|
|
PermitRootLogin prohibit-password
|
|
ChallengeResponseAuthentication no
|
|
KbdInteractiveAuthentication no
|
|
|
|
- path: /etc/systemd/system/buildkitd.service
|
|
permissions: "0644"
|
|
content: |
|
|
[Unit]
|
|
Description=BuildKit daemon
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=notify
|
|
ExecStart=/usr/local/bin/buildkitd --addr unix:///run/buildkit/buildkitd.sock
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
RuntimeDirectory=buildkit
|
|
RuntimeDirectoryMode=0711
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
runcmd:
|
|
- |
|
|
set -eu
|
|
BUILDKIT_VERSION="v0.29.0"
|
|
wget -q "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-arm64.tar.gz" \
|
|
-O /tmp/buildkit.tar.gz
|
|
tar -xzf /tmp/buildkit.tar.gz -C /usr/local/
|
|
rm /tmp/buildkit.tar.gz
|
|
buildctl --version
|
|
|
|
- |
|
|
set -eu
|
|
SCCACHE_VERSION="v0.9.1"
|
|
SCCACHE_ARCHIVE="sccache-${SCCACHE_VERSION}-aarch64-unknown-linux-musl"
|
|
wget -q "https://github.com/mozilla/sccache/releases/download/${SCCACHE_VERSION}/${SCCACHE_ARCHIVE}.tar.gz" \
|
|
-O /tmp/sccache.tar.gz
|
|
tar -xzf /tmp/sccache.tar.gz --strip-components=1 -C /usr/local/bin/ "${SCCACHE_ARCHIVE}/sccache"
|
|
chmod +x /usr/local/bin/sccache
|
|
rm /tmp/sccache.tar.gz
|
|
sccache --version
|
|
|
|
- |
|
|
set -eu
|
|
NU_VERSION="0.112.2"
|
|
NU_ARCHIVE="nu-${NU_VERSION}-aarch64-unknown-linux-gnu"
|
|
wget -q "https://github.com/nushell/nushell/releases/download/${NU_VERSION}/${NU_ARCHIVE}.tar.gz" \
|
|
-O /tmp/nu.tar.gz
|
|
tar -xzf /tmp/nu.tar.gz --strip-components=1 -C /usr/local/bin/ "${NU_ARCHIVE}/nu"
|
|
chmod +x /usr/local/bin/nu
|
|
rm /tmp/nu.tar.gz
|
|
nu --version
|
|
|
|
- systemctl daemon-reload
|
|
- systemctl enable buildkitd
|
|
- systemctl start buildkitd
|
|
- systemctl status buildkitd
|