chadtmiller.com/knotless
git that lives in your Atmosphere account
1
10
The prod host swaps under pressure, and its runner's runs are capped
.knotless/workflows/deploy.yml+6−2
| @@ -48,8 +48,12 @@ env: | ||
# Their other workflows name runner.knotless.dev, so this one runs none. | ||
KNOTLESS_RUN_REPOS: chadtmiller.com/knotless chadtmiller.com/pds.js grain.social/grain grain.social/grain-ios | ||
# Lands the merge queue in batches. Open pulls run on the runner host | ||
# (--pulls-only there, deploy/runner-host), off this one's CPU. | ||
KNOTLESS_RUN_ARGS: --queue | ||
# (--pulls-only there, deploy/runner-host), off this one's CPU, but a | ||
# queued pull's pre-flights and each batch run here. Uncapped, one test | ||
# takes about 9 GiB and every core, and two stalled the host: two jobs | ||
# of 3 CPUs and 6 GiB leave serve 2 cores and some 4 GB, and a run past | ||
# its memory fails its step rather than the host. | ||
KNOTLESS_RUN_ARGS: --queue --jobs 2 --cpus 3 --memory 6 | ||
# The runner host's account (deploy/runner-host), which a new public | ||
# repository names unless its owner names others: it runs anyone's. | ||
KNOTLESS_DEFAULT_RUNNER_DID: did:plc:4bocpkn5zkwe4wuu4plrj5kt | ||
deploy/README.md+5−2
| @@ -11,7 +11,7 @@ One Docker host, a reverse proxy in front of it for TLS, and a domain. | ||
| `run-unchanged.sh` | run by `deploy.sh`: whether the runner built from this checkout is the one built from a given commit, so a deploy can leave `run` running | | ||
| `rollout-test.sh` | tries `rollout.sh` on a local docker behind a Caddy, counting failed requests | | ||
| `release.sh` | builds the client for macOS and Linux here and puts the builds on the host, for `/install.sh` | | ||
| `setup.sh` | makes a fresh Ubuntu 24.04 host ready for `deploy.sh`: docker, a Caddy of its own for the domain, a firewall, upgrades and pruning | | ||
| `setup.sh` | makes a fresh Ubuntu 24.04 host ready for `deploy.sh`: docker, a Caddy of its own for the domain, a firewall, swap, upgrades and pruning | | ||
| ||
```sh | ||
deploy/setup.sh root@host git.example.com # once, on a fresh host | ||
| @@ -417,7 +417,10 @@ checkout and the secrets granted to it, but a container is a thin wall: | ||
watch only repositories whose writers you trust. The step containers have | ||
no limits of their own beyond `--step-timeout` unless `KNOTLESS_RUN_ARGS` | ||
gives them (`--cpus`, `--memory`, `--pids`, `--network`, `--run-timeout`: | ||
see [the CLI reference](../docs/reference/cli.md)). | ||
see [the CLI reference](../docs/reference/cli.md)). knotless's own deploy | ||
gives them in `deploy.yml`: two jobs of 3 CPUs and 6 GiB, as one | ||
coverage `test` uncapped takes about 9 GiB and every core, and two at | ||
once stalled the host. | ||
| ||
A restart, a deploy's among them, waits only for the runs whose steps have | ||
started, a deploy's included, up to `--stop-wait` (15 minutes), when it | ||
deploy/setup.sh+12−0
| @@ -19,6 +19,9 @@ | ||
# - a firewall letting in SSH, HTTP and HTTPS alone; | ||
# - unattended security upgrades, and a daily prune of images unused for | ||
# a week and of build cache past 20 GB; | ||
# - a 4 GB swap file, used only under pressure (swappiness 10), so a spike | ||
# slows the host rather than stalling it as it drops and rereads its | ||
# programs from disk; | ||
# - KNOTLESS_DATA (/mnt/data/knotless) and the runner's state | ||
# (/var/lib/knotless-run). | ||
# | ||
| @@ -116,6 +119,15 @@ MaxRetentionSec=30day | ||
EOF | ||
systemctl restart systemd-journald | ||
| ||
echo "==> swap" | ||
if ! swapon --show=NAME --noheadings | grep -qx /swapfile; then | ||
[ -f /swapfile ] || { fallocate -l 4G /swapfile; chmod 600 /swapfile; mkswap -q /swapfile; } | ||
swapon /swapfile | ||
fi | ||
grep -q '^/swapfile ' /etc/fstab || echo '/swapfile none swap sw 0 0' >>/etc/fstab | ||
echo vm.swappiness=10 >/etc/sysctl.d/90-knotless-swap.conf | ||
sysctl -q -p /etc/sysctl.d/90-knotless-swap.conf | ||
| ||
echo "==> upgrades and pruning" | ||
dpkg-reconfigure -f noninteractive unattended-upgrades | ||
cat >/etc/systemd/system/knotless-prune.service <<'EOF' | ||