7e52494880
All checks were successful
CI / Unit & Component Tests (pull_request) Successful in 3m4s
CI / OCR Service Tests (pull_request) Successful in 18s
CI / Backend Unit Tests (pull_request) Successful in 2m42s
CI / fail2ban Regex (pull_request) Successful in 41s
CI / Compose Bucket Idempotency (pull_request) Successful in 1m0s
The observability stack's bind-mount sources pointed to workspace-relative paths. When CI wiped the workspace between runs, containers kept running but their config files disappeared — causing Docker to auto-create directories at the missing paths and crash the services on next restart. Fix: mount /opt/familienarchiv/ into CI job containers via runner-config.yaml, then copy infra/observability/ and docker-compose.observability.yml there before docker compose up. Compose runs from the permanent path, so bind mounts resolve to stable host paths that survive workspace wipes. Docker Compose reads /opt/familienarchiv/.env automatically (no --env-file flag), which is managed on the server and persists between CI runs. Closes #601 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
30 lines
1.6 KiB
YAML
30 lines
1.6 KiB
YAML
# runner-config.yaml — only the relevant section
|
|
container:
|
|
# passed as DOCKER_HOST inside the job container
|
|
docker_host: "unix:///var/run/docker.sock"
|
|
# Job workspaces are stored here on the NAS and mounted at the same
|
|
# absolute path inside job containers. Identical host ↔ container path
|
|
# is the requirement: Docker Compose resolves relative bind mounts to
|
|
# $(pwd) inside the job container and passes that absolute path to the
|
|
# host daemon — the daemon must find the file at that exact host path.
|
|
# Prerequisite: mkdir -p /srv/gitea-workspace on the host, and add
|
|
# - /srv/gitea-workspace:/srv/gitea-workspace
|
|
# to the runner service volumes in gitea's compose.yaml.
|
|
workdir_parent: /srv/gitea-workspace
|
|
# whitelists volumes that workflow steps may bind-mount
|
|
valid_volumes:
|
|
- "/var/run/docker.sock"
|
|
- "/srv/gitea-workspace"
|
|
- "/opt/familienarchiv"
|
|
# appended to `docker run` when the runner spawns a job container
|
|
# SECURITY: Mounting the Docker socket grants job containers root-equivalent
|
|
# access to the host Docker daemon. Acceptable here because only trusted code
|
|
# from this private repo runs on this runner. Do NOT use on a runner that
|
|
# accepts untrusted PRs from external contributors.
|
|
# /opt/familienarchiv is mounted so the nightly job can deploy observability
|
|
# configs to the permanent location without needing ssh or nsenter.
|
|
options: "-v /var/run/docker.sock:/var/run/docker.sock -v /srv/gitea-workspace:/srv/gitea-workspace -v /opt/familienarchiv:/opt/familienarchiv"
|
|
# keep network mode default (bridge) — Testcontainers handles its own networking
|
|
force_pull: false
|
|
|