Repair ana-docker database backups and bound CI build caches

configs/buildkit/ana-docker/README.md

@@ -0,0 +1,20 @@
+# CI cache budget
+
+Deploy: `scripts/elway infra-ops@10.250.50.70 --playbook playbooks/ana-docker-cache-budget.yaml`.
+
+The hourly `buildkit-cache-prune.timer` runs `prune.sh` against the explicitly
+named Worldtree, Skaldsong and Soong builders. Each running builder prunes unused
+cache toward 10 GiB (`--keep-storage 10240`). This is periodic reclamation, not
+a hard disk quota; in-use cache and growth between runs can exceed the target.
+Missing and stopped builders are skipped and are never started by the timer.
+Build caches are regenerable, but subsequent builds can take longer.
+
+On 2026-09-10, Skaldsong reclaimed 10.41 GB and Worldtree reported 74.89 GB
+reclaimed (BuildKit accounting). Worldtree was temporarily started for that
+initial prune, then returned to stopped. Soong remained stopped. Following
+cache pruning and the Gitea backup repair/cleanup, root usage fell from 84% to
+51%, with 115 GiB available. Use filesystem `df` for actual capacity rather than
+summing cache reports and logical file sizes.
+
+Checks: `systemctl status buildkit-cache-prune.timer`,
+`journalctl -u buildkit-cache-prune.service`, and `df -h /`.

configs/buildkit/ana-docker/buildkit-cache-prune.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Bound ana-docker CI builder cache usage
+After=docker.service
+ConditionPathExists=/var/run/docker.sock
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/pfi-buildkit-cache-prune
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+TimeoutStartSec=30min

configs/buildkit/ana-docker/buildkit-cache-prune.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Hourly budget enforcement for ana-docker CI builder caches
+
+[Timer]
+OnCalendar=hourly
+RandomizedDelaySec=5min
+Persistent=true
+
+[Install]
+WantedBy=timers.target

configs/buildkit/ana-docker/prune.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Bound regenerable cache on ana-docker's named CI builders. BuildKit protects
+# in-use references. Stopped builders cannot grow and are left stopped.
+set -euo pipefail
+failed=0
+for builder in buildx_buildkit_worldtree-builder0 buildx_buildkit_skaldsong-builder0 buildx_buildkit_soong-builder0; do
+  if ! state=$(docker inspect --format '{{.State.Running}}' "$builder" 2>/dev/null); then
+    echo "$builder: absent, skipped"
+    continue
+  fi
+  if [ "$state" != true ]; then
+    echo "$builder: stopped, skipped"
+    continue
+  fi
+  echo "$builder: reclaim unused cache toward 10 GiB budget"
+  if ! docker exec "$builder" buildctl prune --all --keep-storage 10240 | tail -1; then
+    echo "$builder: cache pruning failed" >&2
+    failed=1
+  fi
+done
+exit "$failed"