feat(dev-new): two Forgejo runner microVMs behind the dev-new label #466

Merged

dominik.polakovics merged 1 commit from lab/20261013-0114 into main

2026-10-13 01:38:06 +02:00

dominik.polakovics commented

2026-10-13 01:32:55 +02:00

Owner

Closes #465

Adds fj-runner-3 and fj-runner-4 as microvm.nix guests on dev-new (4 vCPU, 8 GiB each), the same guest config as fw's runners. fw's fj-runner-1/2 stay unchanged. Decision record: ADR-0033.

What changes

hosts/dev-new/modules/microvm.nix: microvm.nix host module at the rev fw pins, a host-only runners bridge (10.97.0.1/24) that the vm-fj-* taps join, and networking.nat on it. dev-new is wifi-only, so the taps cannot be bridged onto the uplink like fw's server bridge; no externalInterface so it works on wifi and on the USB ethernet card alike.
hosts/dev-new/vms/forgejo-runner/default.nix: the two guests at 10.97.0.53/.54, DNS via fw, same podman 5.8.6 pin (#404), CPUWeight=20 / Nice=10 like fw's user tier. Labels: only dev-new:docker://git.cloonar.com/infrastructure/gitea-runner:1.0.0, so runs-on: ubuntu-latest keeps going to fw and a workflow targets these with runs-on: dev-new.
Secrets: fw shares its whole /run/secrets into the runner VMs. On dev-new that directory also holds the coding-lab master key, the onecli gateway key, the warpgate admin token and the diag key, so an activation step copies only the runner token into /run/forgejo-runner, and that is what virtiofs mounts at the guests' /run/secrets. Guest config stays identical to fw's.
docs/adr/0033-forgejo-runners-on-dev-new.md.

Before merging

Add forgejo-runner-token to hosts/dev-new/secrets.sops.yaml with the same value as fw's forgejo-runner-token (env-file form, TOKEN=…):

nix-shell -p sops --run 'sops hosts/dev-new/secrets.sops.yaml'

Until it exists, dev-new's bento switch fails at sops install.

After merge

The guests register themselves on first boot; check Site administration → Actions → Runners on git.cloonar.com for fj-runner-3/4 with label dev-new.
Not covered: dev-new is not scraped by Grafana, so there is no services-down alert for these two (fw's runners have one).
Verified: pre-commit dry-build of dev-new passed. Not verified: live NAT behaviour alongside Docker's FORWARD policy on dev-new; nixos-nat's accept rules are appended to FORWARD after Docker's chains, which only act on Docker bridges, so it should pass, but the first job is the real test.

🤖 Generated with Claude Code

Closes #465 Adds `fj-runner-3` and `fj-runner-4` as microvm.nix guests on dev-new (4 vCPU, 8 GiB each), the same guest config as fw's runners. fw's `fj-runner-1/2` stay unchanged. Decision record: ADR-0033. ## What changes - `hosts/dev-new/modules/microvm.nix`: microvm.nix host module at the rev fw pins, a host-only `runners` bridge (`10.97.0.1/24`) that the `vm-fj-*` taps join, and `networking.nat` on it. dev-new is wifi-only, so the taps cannot be bridged onto the uplink like fw's `server` bridge; no `externalInterface` so it works on wifi and on the USB ethernet card alike. - `hosts/dev-new/vms/forgejo-runner/default.nix`: the two guests at `10.97.0.53`/`.54`, DNS via fw, same podman 5.8.6 pin (#404), `CPUWeight=20` / `Nice=10` like fw's `user` tier. Labels: **only** `dev-new:docker://git.cloonar.com/infrastructure/gitea-runner:1.0.0`, so `runs-on: ubuntu-latest` keeps going to fw and a workflow targets these with `runs-on: dev-new`. - Secrets: fw shares its whole `/run/secrets` into the runner VMs. On dev-new that directory also holds the coding-lab master key, the onecli gateway key, the warpgate admin token and the diag key, so an activation step copies only the runner token into `/run/forgejo-runner`, and that is what virtiofs mounts at the guests' `/run/secrets`. Guest config stays identical to fw's. - `docs/adr/0033-forgejo-runners-on-dev-new.md`. ## Before merging Add `forgejo-runner-token` to `hosts/dev-new/secrets.sops.yaml` with the same value as fw's `forgejo-runner-token` (env-file form, `TOKEN=…`): ``` nix-shell -p sops --run 'sops hosts/dev-new/secrets.sops.yaml' ``` Until it exists, dev-new's bento switch fails at sops install. ## After merge - The guests register themselves on first boot; check Site administration → Actions → Runners on git.cloonar.com for `fj-runner-3/4` with label `dev-new`. - Not covered: dev-new is not scraped by Grafana, so there is no services-down alert for these two (fw's runners have one). - Verified: pre-commit dry-build of dev-new passed. Not verified: live NAT behaviour alongside Docker's `FORWARD` policy on dev-new; nixos-nat's accept rules are appended to `FORWARD` after Docker's chains, which only act on Docker bridges, so it should pass, but the first job is the real test. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit

2026-10-13 01:32:55 +02:00

feat(dev-new): two Forgejo runner microVMs behind the dev-new label 241e4c4a8f

Add fj-runner-3/4 as microvm.nix guests on dev-new (4 vCPU, 8 GiB each),
registered only with the `dev-new` label so jobs opt in via runs-on. The
guests sit on a NAT'd host-only bridge because the box is wifi-only, and
only the runner token is staged into them instead of the whole /run/secrets.
fw's runners stay as they are. ADR-0033.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

dominik.polakovics merged commit 0915ced8be into main

2026-10-13 01:38:06 +02:00

dominik.polakovics deleted branch lab/20261013-0114

2026-10-13 01:38:06 +02:00

dominik.polakovics referenced this pull request from a commit

2026-10-13 01:38:07 +02:00

Merge pull request 'feat(dev-new): two Forgejo runner microVMs behind the dev-new label' (#466) from lab/20261013-0114 into main

dominik.polakovics referenced this pull request

2026-10-13 01:44:51 +02:00

dev-new: runner token commit never reached main #467

dominik.polakovics referenced this pull request

2026-10-13 01:44:58 +02:00