provisioning-catalog/components/buildkit_runner/nickel/defaults.ncl

67 lines
2.4 KiB
Text

let _presets = (import "schemas/lib/concerns_presets.ncl").presets in
{
buildkit_runner | default = {
name | default = "buildkit_runner",
version | default = "1.0.0",
mode | default = 'ephemeral_vm,
live_check | default = { strategy = 'on_demand },
golden_image_name | default = "buildkit-runner-golden",
golden_image_rebuild_cron | default = "0 3 * * 0",
default_size | default = {
cpu = 4,
memory_gb = 8,
disk_gb = 40,
},
storage | default = {
persistent = false,
},
hcloud | default = {
server_type_pool = ["cax21", "cax31", "cax41", "ccx13"],
location = "fsn1",
},
ssh | default = {
orchestrator_pubkey_secret = "orchestrator-ssh-pubkey",
},
lease | default = {
max_duration_min = 60,
},
requires | default = {
credentials = ["HCLOUD_TOKEN", "ORCHESTRATOR_SSH_PUBKEY"],
capabilities = ["vm-lifecycle", "image-storage-s3", "ssh-access"],
},
provides | default = {
service = "buildkit_runner",
interface = "buildkit-runner",
},
operations | default = {
install = true,
health = true,
},
# ServiceConcerns default — buildkit-runner; ephemeral by design (ADR-039).
# infrastructure_glue preset with custom tls/backup reasons.
# ── Access-model asymmetry with buildkit_lite (intentional, do not converge) ──
# buildkit_lite: persistent K8s Deployment exposed via VPN+NodePort → requires mTLS
# (anyone on the wuwei network could otherwise dial the daemon).
# buildkit_runner: per-build ephemeral Hetzner VM; buildkitd listens on unix socket
# only; orchestrator opens an SSH tunnel using ssh.orchestrator_pubkey_secret;
# the SSH session itself IS the authentication boundary, so a second
# TLS layer would add no benefit. cloud-init/runner.yaml line 33:
# ExecStart=/usr/local/bin/buildkitd --addr unix:///run/buildkit/buildkitd.sock
concerns | default = _presets.infrastructure_glue & {
tls | force = { kind = 'disabled, reason = "buildkitd binds unix socket only; orchestrator SSH tunnel provides the auth boundary — no TCP surface, no mTLS surface" },
backup | force = { kind = 'disabled, reason = "ephemeral by design (ADR-039); persistent state captured by SystemBackupDef.builder_env" },
},
},
}