chadtmiller.com/knotless

Switch repository

Loading…

What changes

A runner host can watch only the repositories it names. deploy/runner-host reads KNOTLESS_RUNNER_DISCOVER. Set empty, the runner starts without --discover, so it runs workflows only for KNOTLESS_RUNNER_REPOS. Left unset, it discovers as before.

Owner jobs are configurable. KNOTLESS_RUNNER_OWNER_JOBS sets --owner-jobs, which stays 2 by default.

A host can take its image from another. With KNOTLESS_RUNNER_IMAGE_FROM set to an ssh destination, deploy.sh copies knotless:current from that host (docker save | docker load) instead of building on the box.

Why

hetzner-infra's terraform runs on its own cx23, as infra.chadtmiller.com. It must run hetzner-infra and nothing else: its secrets include the Hetzner, Cloudflare and grain SSH keys, so it should never pick up another account's workflows. A cx23 is also too small to build knotless in reasonable time, so it takes the image a bigger host already built.

How it was checked

The box at 178.105.255.120 was deployed from this branch. It runs knotless-run at 2ff95985 without --discover, watching chadtmiller.com/hetzner-infra, and all seven of that repository's plan workflows pass on it. Defaults leave runner.knotless.dev's command line unchanged.

Shortcomings

KNOTLESS_RUNNER_IMAGE_FROM copies whatever knotless:current the source host has. main's deploy builds on the knotless.dev host but not on runner.knotless.dev's box, so the source has to be the host that holds the release you want.

🤖 Generated with Claude Code

This adds three options to the runner host deploy:

• KNOTLESS_RUNNER_DISCOVER set empty drops --discover. Left unset, --discover stays.
• KNOTLESS_RUNNER_OWNER_JOBS sets --owner-jobs, defaulting to 2.
• KNOTLESS_RUNNER_IMAGE_FROM copies knotless:current from another host instead of building.

I read the diff and found nothing that blocks merging. I did not run it.

• Discover default: the compose default ${KNOTLESS_RUN_DISCOVER---discover} only applies when the variable is unset. The +set test in deploy.sh writes the line only when KNOTLESS_RUNNER_DISCOVER is set, so an empty value reaches compose and the flag drops. Without it the flag stays, so runner.knotless.dev's command line is unchanged.
• Image copy: the docker save | gzip | ssh | gunzip | docker load pipeline runs under set -o pipefail, so a failed source host aborts the deploy.

One small follow-up: the header comment in deploy.sh lists the optional variables. It doesn't mention KNOTLESS_RUNNER_DISCOVER, _OWNER_JOBS or _IMAGE_FROM. The line saying the image is always built on the host is also no longer true. Adding them there, and to the runner-host README, would help the next person.