vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

deploy: rename the old forgejo.ci options to ci-runner instead of removing them

Browse source 
deploy.forgejo.ci.{enable,name,concurrency,labels,package,jobTimeout} each
have a same-typed, same-meaning counterpart under deploy.ci-runner on the
same host, so they are mkRenamedOptionModule entries again and a config that
still sets them evaluates with the standard rename warning. The swarm.forge.ci
spellings stay removals.

docs/scheduler/ci.md states the rename, that the old hive-ci runner's entry
is deleted by hand in the forge admin panel, and that actionsFromSelf
defaults on where the controller runs.
This commit is contained in:
atlas 2026-10-05 21:31:38 +02:00
commit b114c6b165
3 changed files with 77 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/scheduler/ci.md
View file

@ -125,6 +125,13 @@ name), `jobTimeout` (per-job wall-clock cap, default `"1h"`, Go duration string
for example `"3h"` — a job that exceeds it's killed so a hung or runaway build
can't hold the runner's single slot indefinitely).
The old `services.hyperhive.deploy.forgejo.ci.{enable,name,concurrency,labels,package,jobTimeout}`
are still accepted: each is a rename of the same-named option under
`deploy.ci-runner`, same type and meaning, and evaluation warns naming both
paths. Set the new name to silence the warning. The two `name` defaults
differ (`hive-ci` before, `swarm-ci-runner` now), so a host that never set the
old `name` shows up under the new default.
## Container design
- **Private netns, bridge-attached**: the container runs in its own network namespace (`privateNetwork = true`, `hostBridge`), takes its address from the gateway's DHCP, and resolves through the gateway's dnsmasq on the bridge IP. It can't reach host-loopback services — the core dashboard at `127.0.0.1:7000` and the raw forge port are unreachable from CI.
@ -180,7 +187,10 @@ can't hold the runner's single slot indefinitely).
and act as this runner; see the security section below.
A new registration is a new runner on the forge: the previous entry stays in
the forge admin panel as offline until an admin deletes it.
the forge admin panel as offline until an admin deletes it. The runner the old
`hive-ci` module registered is one such entry, since this runner registers
under its own name and token. Delete it under Site administration, Actions,
Runners.
## Actions checkout mirror
@ -192,6 +202,11 @@ controller seeds an `actions/checkout` pull-mirror on the forge and Forgejo's
`uses: actions/checkout@vN` steps then resolve on the forge, with no external
DNS on the CI critical path.
A forge host that runs the swarm controller therefore resolves
`uses: actions/checkout` from itself, with or without a runner on that host.
Set `actionsFromSelf = false` there to resolve actions from `data.forgejo.org`
and seed no mirror.
The option defaults to whether the forge's host also runs the swarm controller
(`services.hyperhive.deploy.swarm-controller.enable`): on when it does, off
otherwise. Setting it `true` on a forge host without the controller leaves