67 lines
2.4 KiB
Text
67 lines
2.4 KiB
Text
let _presets = (import "schemas/lib/concerns_presets.ncl").presets in
|
|
|
|
{
|
|
buildkit_runner | default = {
|
|
name | default = "buildkit_runner",
|
|
version | default = "1.0.0",
|
|
mode | default = 'ephemeral_vm,
|
|
|
|
live_check | default = { strategy = 'on_demand },
|
|
|
|
golden_image_name | default = "buildkit-runner-golden",
|
|
golden_image_rebuild_cron | default = "0 3 * * 0",
|
|
|
|
default_size | default = {
|
|
cpu = 4,
|
|
memory_gb = 8,
|
|
disk_gb = 40,
|
|
},
|
|
|
|
storage | default = {
|
|
persistent = false,
|
|
},
|
|
|
|
hcloud | default = {
|
|
server_type_pool = ["cax21", "cax31", "cax41", "ccx13"],
|
|
location = "fsn1",
|
|
},
|
|
|
|
ssh | default = {
|
|
orchestrator_pubkey_secret = "orchestrator-ssh-pubkey",
|
|
},
|
|
|
|
lease | default = {
|
|
max_duration_min = 60,
|
|
},
|
|
|
|
requires | default = {
|
|
credentials = ["HCLOUD_TOKEN", "ORCHESTRATOR_SSH_PUBKEY"],
|
|
capabilities = ["vm-lifecycle", "image-storage-s3", "ssh-access"],
|
|
},
|
|
|
|
provides | default = {
|
|
service = "buildkit_runner",
|
|
interface = "buildkit-runner",
|
|
},
|
|
|
|
operations | default = {
|
|
install = true,
|
|
health = true,
|
|
},
|
|
|
|
# ServiceConcerns default — buildkit-runner; ephemeral by design (ADR-039).
|
|
# infrastructure_glue preset with custom tls/backup reasons.
|
|
# ── Access-model asymmetry with buildkit_lite (intentional, do not converge) ──
|
|
# buildkit_lite: persistent K8s Deployment exposed via VPN+NodePort → requires mTLS
|
|
# (anyone on the wuwei network could otherwise dial the daemon).
|
|
# buildkit_runner: per-build ephemeral Hetzner VM; buildkitd listens on unix socket
|
|
# only; orchestrator opens an SSH tunnel using ssh.orchestrator_pubkey_secret;
|
|
# the SSH session itself IS the authentication boundary, so a second
|
|
# TLS layer would add no benefit. cloud-init/runner.yaml line 33:
|
|
# ExecStart=/usr/local/bin/buildkitd --addr unix:///run/buildkit/buildkitd.sock
|
|
concerns | default = _presets.infrastructure_glue & {
|
|
tls | force = { kind = 'disabled, reason = "buildkitd binds unix socket only; orchestrator SSH tunnel provides the auth boundary — no TCP surface, no mTLS surface" },
|
|
backup | force = { kind = 'disabled, reason = "ephemeral by design (ADR-039); persistent state captured by SystemBackupDef.builder_env" },
|
|
},
|
|
},
|
|
}
|