vh
91d5417b0b
Two-service compose (chamber + forseti sidecar daemon) sharing a single
SQLite store via bind-mount under /opt/docker/conf/althing-chamber/data.
eventbus.bridge_from_db is the cross-process glue — forseti's commits
reach chamber's SSE subscribers via the bridge.
Pattern matches task-board's build-on-host deploy:
- elway playbook clones vh/althing into /opt/docker/build/
- docker build -t althing-chamber:local . (no registry)
- playbook uploads compose + seeds .env one-time, brings both
services up, polls /health
- Gitea Actions workflow lives in vh/althing; reference copy here.
Internal tooling — host port 7881 (chamber's default of 7878 collides
with task-board). LAN-direct, no Traefik. Container always listens on
8000 internally.
Scaffold will fail to bring the chamber container up healthy until
galdrabok-side commits land:
- Dockerfile at vh/althing repo root (two-stage: uv-bookworm-slim
build → python:3.12-slim runtime, locked per open_questions §2
of the v1 contract).
- GET /health endpoint on the chamber app (200, no DB read).
- ALTHING_BIND / ALTHING_PORT env-var support in
core.cli.chamber_serve / core.chamber.cli (env > config.yaml >
defaults precedence).
Coordinated via althing thread 01KRMAK7RD7TP6C8DF4KXV31RT.
92 lines
3.5 KiB
Plaintext
92 lines
3.5 KiB
Plaintext
# Gitea Actions workflow for althing-chamber.
|
|
#
|
|
# THIS FILE LIVES IN THE VH/ALTHING REPO, NOT HERE.
|
|
# Copy to vh/althing:.gitea/workflows/deploy.yaml and commit.
|
|
# (The canonical copy lives in the althing repo; this file is a
|
|
# reference for what shape the workflow takes.)
|
|
#
|
|
# What it does on every push to main (and on manual workflow_dispatch):
|
|
# 1. Checks out althing itself (the triggering repo).
|
|
# 2. Checks out vh/esh-pfi-infrastructure to pick up the elway
|
|
# playbook and helper scripts.
|
|
# 3. Configures SSH so elway can reach ana-docker.
|
|
# 4. Runs `scripts/elway ana-docker --playbook playbooks/deploy-althing-chamber.yaml`
|
|
# pinning to the commit SHA that triggered the workflow.
|
|
#
|
|
# Required Actions secrets (configure under
|
|
# https://gitea.phasefinal.com/vh/althing/settings/actions/secrets,
|
|
# or org-level for reuse across repos):
|
|
#
|
|
# DEPLOY_SSH_KEY Private SSH key whose pubkey is in
|
|
# ~lkraven/.ssh/authorized_keys on ana-docker.
|
|
# Used by the runner to invoke the elway playbook.
|
|
# Generate fresh; don't reuse a personal key.
|
|
#
|
|
# MGMT_REPO_TOKEN Gitea PAT (read:repository scope) on
|
|
# vh/esh-pfi-infrastructure, used to clone the
|
|
# management repo. Generate at
|
|
# https://gitea.phasefinal.com/-/user/settings/applications.
|
|
|
|
name: Deploy althing-chamber
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
# `pfi-fleet` matches the central runner on ana-docker. Pin to
|
|
# `ana-docker` instead if you want to refuse running on a future
|
|
# site-local runner. The runner's label embeds a default image
|
|
# (node:20-bookworm-slim) — has node + git out of the box, so
|
|
# actions/checkout@v4 (a JS action) works without a custom
|
|
# container. We just apt-install python3 + pyyaml for elway.
|
|
runs-on: pfi-fleet
|
|
|
|
steps:
|
|
- name: Install playbook prerequisites
|
|
run: |
|
|
apt-get update -qq
|
|
apt-get install -y --no-install-recommends \
|
|
python3 python3-yaml openssh-client
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
- name: Checkout althing (triggering repo)
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Checkout management repo (eshpfi-management)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: vh/esh-pfi-infrastructure
|
|
token: ${{ secrets.MGMT_REPO_TOKEN }}
|
|
path: _mgmt
|
|
|
|
- name: Configure SSH to ana-docker
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
# The DEPLOY_SSH_KEY secret is the full private key contents,
|
|
# newline-terminated. ssh refuses keys that aren't 0600.
|
|
printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
|
|
# ssh_config alias so elway resolves "ana-docker" the same
|
|
# way it would on a workstation. accept-new is fine for a
|
|
# fresh job container — host key gets cached for the lifetime
|
|
# of this job only.
|
|
cat > ~/.ssh/config <<'EOF'
|
|
Host ana-docker
|
|
HostName 10.250.50.70
|
|
User lkraven
|
|
IdentityFile ~/.ssh/id_ed25519
|
|
StrictHostKeyChecking accept-new
|
|
EOF
|
|
chmod 600 ~/.ssh/config
|
|
|
|
- name: Deploy althing-chamber (elway playbook, pinned to this commit)
|
|
working-directory: _mgmt
|
|
run: |
|
|
scripts/elway ana-docker \
|
|
--playbook playbooks/deploy-althing-chamber.yaml \
|
|
--var ref=${{ github.sha }}
|