johnandersen777.bsky.social/knotless

Switch repository

Loading…

# knotless-run on a runner host, as /etc/knotless/docker-compose.yml.
# deploy/runner-host/deploy.sh copies it there, beside the .env it reads;
# edit it here. The appview it finds pulls through is knotless.dev's, over
# HTTPS. With the `bots` profile, which deploy.sh turns on given a domain,
# a knotless-serve behind Caddy keeps the runner's OAuth session, for
# private repositories: Caddy answers only its bot login.
#
# A second runner on the same host, of another account, is another project
# of this file: KNOTLESS_RUNNER_NAME, _ETC and _DATA name its project, its
# directory for run.env, the secrets and the pause list, and its work
# (README.md, The trusted runner). It shares the host's runs' network and
# resolv.conf, and takes no bot login.

name: ${KNOTLESS_RUNNER_NAME:-knotless-runner}

services:
  run:
    image: knotless:current
    restart: always
    logging:
      driver: journald
      options:
        tag: "{{.Name}}"
    # Root: it holds the docker socket. What it runs
    # is held apart by gVisor, not by this.
    user: root
    # A stop waits for runs whose steps started, up to --stop-wait (15
    # minutes, its default). A deploy here recreates the runner rather than
    # handing over, so it, and every check, wait for the stop to end.
    stop_grace_period: 20m
    command:
      - sh
      - -c
      - >-
        exec knotless-run
        --jetstream ${KNOTLESS_JETSTREAM:-wss://jetstream.us-east.bsky.network}
        --executor docker
        --runtime runsc
        --trusted-runtime runc
        --network knotless-runs
        --resolv /etc/knotless/resolv.conf
        --cpus ${KNOTLESS_RUN_CPUS:-2}
        --memory ${KNOTLESS_RUN_MEMORY:-3}
        --pids 4096
        --run-timeout ${KNOTLESS_RUN_TIMEOUT:-3600}
        --jobs ${KNOTLESS_RUN_JOBS:-4}
        --owner-jobs ${KNOTLESS_RUN_OWNER_JOBS:-2}
        --allowance ${KNOTLESS_RUN_ALLOWANCE:-2000}
        --private-allowance ${KNOTLESS_RUN_PRIVATE_ALLOWANCE:-500}
        --keep-checks 30
        --paused /etc/knotless-run/paused.json
        --secrets /etc/knotless-run/run-secrets.json
        --state ${KNOTLESS_RUNNER_DATA:-/var/lib/knotless-run}/state.json
        --work ${KNOTLESS_RUNNER_DATA:-/var/lib/knotless-run}/work
        --caches ${KNOTLESS_RUNNER_DATA:-/var/lib/knotless-run}/caches
        --pulls
        ${KNOTLESS_RUN_DISCOVER---discover}
        ${KNOTLESS_RUN_ARGS:-}
        ${KNOTLESS_RUN_REPOS:-}
    environment:
      KNOTLESS_APPVIEW: ${KNOTLESS_APPVIEW:-https://knotless.dev}
      # The bots' sessions, which `bots` keeps; the app password's
      # session, until the runner logs in there.
      KNOTLESS_CONFIG_DIR: ${KNOTLESS_RUNNER_DATA:-/var/lib/knotless-run}/bots
      KNOTLESS_CACHE_DIR: ${KNOTLESS_RUNNER_DATA:-/var/lib/knotless-run}/cache
      RUST_LOG: ${KNOTLESS_LOG:-info}
    env_file:
      # KNOTLESS_IDENTIFIER and KNOTLESS_PASSWORD: the runner's own
      # account and an app password for it, used only until it logs in at
      # /oauth/bot: an app password reads no private repositories.
      - ${KNOTLESS_RUNNER_ETC:-/etc/knotless}/run.env
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      # At the same path as on the host, for the step containers' mounts.
      - ${KNOTLESS_RUNNER_DATA:-/var/lib/knotless-run}:${KNOTLESS_RUNNER_DATA:-/var/lib/knotless-run}
      # The pause list and the secrets, read again as runs are filed: the
      # directory, so an editor's new file is seen, not the old inode.
      - ${KNOTLESS_RUNNER_ETC:-/etc/knotless}:/etc/knotless-run:ro
    deploy:
      resources:
        limits:
          cpus: "1"
          memory: 512m

  # Keeps the runner's OAuth session, as the main host's serve keeps its
  # bots': the operator approves once at
  # https://<domain>/oauth/bot?account=<the runner's handle>, and it lasts
  # two years if used every three months. Its own client key, beside the
  # session, never leaves this host. It follows no feed and keeps no index.
  bots:
    image: knotless:current
    profiles: [bots]
    restart: always
    logging:
      driver: journald
      options:
        tag: "{{.Name}}"
    command:
      - knotless-serve
      - --listen
      - 0.0.0.0:2590
      - --public-url
      - https://${KNOTLESS_RUNNER_DOMAIN:-}
      - --bots
      - /var/lib/knotless-run/bots
    environment:
      KNOTLESS_CONFIG_DIR: /var/lib/knotless-serve/config
      KNOTLESS_CACHE_DIR: /var/lib/knotless-serve/cache
      # The runner's account, the one bot that may log in here.
      KNOTLESS_BOT_DIDS: ${KNOTLESS_BOT_DIDS:-}
      RUST_LOG: ${KNOTLESS_LOG:-info}
    volumes:
      - /var/lib/knotless-serve:/var/lib/knotless-serve
      - /var/lib/knotless-run/bots:/var/lib/knotless-run/bots
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256m

  # TLS for the bot login, and nothing else of serve's (Caddyfile).
  caddy:
    image: caddy:2
    profiles: [bots]
    restart: always
    ports:
      - "80:80"
      - "443:443"
    environment:
      KNOTLESS_RUNNER_DOMAIN: ${KNOTLESS_RUNNER_DOMAIN:-}
    volumes:
      - /etc/knotless/Caddyfile:/etc/caddy/Caddyfile:ro
      - /var/lib/caddy:/data
    depends_on:
      - bots
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256m