Petru Paler
c548ead4f7
New services: - animaltrack.hcl: Python app with health checks and auto_revert - act-runner.hcl: Gitea Actions runner on Nomad New infrastructure: - nix-runner/: Custom Nix Docker image for CI with modern Nix, local cache (c3), and bundled tools (skopeo, jq, etc.) Modified: - gitea.hcl: Enable Gitea Actions The CI workflow (in animaltrack repo) builds Docker images with Nix, pushes to Gitea registry, and triggers Nomad deployments with automatic rollback on health check failure. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
88 lines
2.1 KiB
HCL
88 lines
2.1 KiB
HCL
# ABOUTME: Nomad job for AnimalTrack - poultry farm management app.
|
|
# ABOUTME: Runs FastHTML Python app with SQLite, behind Traefik with OIDC auth.
|
|
|
|
# Setup required before running:
|
|
# sudo mkdir -p /data/services/animaltrack && sudo chown 1000:1000 /data/services/animaltrack
|
|
# nomad var put secrets/animaltrack csrf_secret="$(nix shell nixpkgs#openssl -c openssl rand -base64 32)"
|
|
|
|
job "animaltrack" {
|
|
datacenters = ["alo"]
|
|
|
|
# Force re-pull of :latest images on each nomad run
|
|
meta {
|
|
uuid = uuidv4()
|
|
}
|
|
|
|
update {
|
|
max_parallel = 1
|
|
health_check = "checks"
|
|
min_healthy_time = "30s"
|
|
healthy_deadline = "5m"
|
|
progress_deadline = "10m"
|
|
auto_revert = true
|
|
}
|
|
|
|
group "web" {
|
|
network {
|
|
port "http" {
|
|
to = 3366
|
|
}
|
|
}
|
|
|
|
task "app" {
|
|
driver = "docker"
|
|
user = "1000"
|
|
|
|
config {
|
|
image = "gitea.v.paler.net/ppetru/animaltrack:latest"
|
|
ports = ["http"]
|
|
force_pull = true
|
|
volumes = ["/data/services/animaltrack:/var/lib/animaltrack"]
|
|
}
|
|
|
|
env {
|
|
DB_PATH = "/var/lib/animaltrack/animaltrack.db"
|
|
AUTH_HEADER_NAME = "X-Oidc-Username"
|
|
SEED_ON_START = "true"
|
|
TRUSTED_PROXY_IPS = "192.168.1.0/24"
|
|
}
|
|
|
|
# Template needed for nomadVar interpolation (secrets)
|
|
template {
|
|
destination = "secrets/env.env"
|
|
env = true
|
|
data = <<EOH
|
|
CSRF_SECRET={{ with nomadVar "secrets/animaltrack" }}{{ .csrf_secret }}{{ end }}
|
|
EOH
|
|
}
|
|
|
|
resources {
|
|
memory = 512
|
|
}
|
|
|
|
service {
|
|
name = "animaltrack"
|
|
port = "http"
|
|
|
|
tags = [
|
|
"traefik.enable=true",
|
|
"traefik.http.routers.animaltrack.entryPoints=websecure",
|
|
"traefik.http.routers.animaltrack.middlewares=oidc-auth@file",
|
|
]
|
|
|
|
check {
|
|
type = "http"
|
|
path = "/healthz"
|
|
interval = "10s"
|
|
timeout = "5s"
|
|
|
|
check_restart {
|
|
limit = 3
|
|
grace = "60s"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|