domain cutover: front doors + drone + per-run naming to ci.autonomic.zone
continuous-integration/drone/push Build is failing
continuous-integration/drone/push Build is failing
- acme-dns.nix: ONE dual-zone SAN cert (ci+*.ci.autonomic.zone AND ci+*.ci.commoninternet.net) via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff reads the new cert dir. Single secret pair => zero changes to the traefik reconciler. - dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit parentheses so && does not shadow the dashboard on the new host). - drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow. - harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay on the legacy zone (data-warm volumes; post-bake migration). - URLs in bridge/dashboard defaults + recipe-report.py follow the new names.
This commit is contained in:
+65
-10
@@ -1,8 +1,13 @@
|
||||
# Restricted DNS-01 certificate issuance for ci.commoninternet.net.
|
||||
# Restricted DNS-01 certificate issuance for ci.autonomic.zone (+ legacy ci.commoninternet.net).
|
||||
#
|
||||
# This host is authoritative only for acme.commoninternet.net. Gandi continues
|
||||
# to own commoninternet.net; it delegates this narrow zone and one permanent
|
||||
# _acme-challenge CNAME manually. No Gandi credential is present here.
|
||||
# to own commoninternet.net AND autonomic.zone; both zones delegate their narrow
|
||||
# _acme-challenge CNAME to the same acme-dns account. No Gandi credential is present here.
|
||||
#
|
||||
# Domain cutover 2026-09: ONE cert now covers BOTH zones (SANs: ci/*.ci.autonomic.zone +
|
||||
# ci/*.ci.commoninternet.net) — a single secret pair flows through the unchanged
|
||||
# warm_reconcile._traefik_setup ssl_cert/ssl_key flow, avoiding dual-cert SNI entirely.
|
||||
# The legacy commoninternet.net SANs are dropped in Phase 4 (post-bake reissue).
|
||||
{ config, pkgs, ... }:
|
||||
let
|
||||
publicIPv4 = config.cc-ci.publicIPv4;
|
||||
@@ -42,11 +47,40 @@ let
|
||||
|
||||
# These are wiring values only. The acme-dns account JSON is generated by
|
||||
# Lego below /var/lib/acme and never enters Nix, git, or /etc.
|
||||
# Storage path points at the NEW cert's dir; cc-ci-acme-storage-seed.service
|
||||
# (below) clones the legacy account entry into it under the new zone key so
|
||||
# Lego can write the new zone's TXT via the same (registration-disabled)
|
||||
# acme-dns account — the CNAME for _acme-challenge.ci.autonomic.zone already
|
||||
# delegates to that account's subdomain.
|
||||
legoEnvironment = pkgs.writeText "cc-ci-acme-dns-lego.env" ''
|
||||
ACME_DNS_API_BASE=http://127.0.0.1:8080
|
||||
ACME_DNS_STORAGE_PATH=/var/lib/acme/ci.commoninternet.net/acme-dns-accounts.json
|
||||
ACME_DNS_STORAGE_PATH=/var/lib/acme/ci.autonomic.zone/acme-dns-accounts.json
|
||||
ACME_DNS_ALLOWLIST=127.0.0.1/32
|
||||
'';
|
||||
|
||||
# Seed the new cert's acmedns storage from the legacy one: same acme-dns
|
||||
# account (same subdomain/credentials — the only thing the DNS CNAME points
|
||||
# at), re-keyed for the new zone. Idempotent; runs before the ACME unit.
|
||||
acmeStorageSeed = pkgs.writeShellApplication {
|
||||
name = "cc-ci-acme-storage-seed";
|
||||
runtimeInputs = with pkgs; [ jq coreutils ];
|
||||
text = ''
|
||||
src=/var/lib/acme/ci.commoninternet.net/acme-dns-accounts.json
|
||||
dst=/var/lib/acme/ci.autonomic.zone/acme-dns-accounts.json
|
||||
install -d -m 0700 /var/lib/acme/ci.autonomic.zone
|
||||
if [ ! -s "$src" ]; then
|
||||
echo "storage seed: no legacy accounts.json — skipping (fresh host?)"
|
||||
exit 0
|
||||
fi
|
||||
jq 'if has("ci.autonomic.zone") then .
|
||||
elif has("ci.commoninternet.net") then
|
||||
. + { "ci.autonomic.zone": .["ci.commoninternet.net"] }
|
||||
else . end' "$src" > "$dst.tmp"
|
||||
mv "$dst.tmp" "$dst"
|
||||
chmod 0600 "$dst"
|
||||
echo "storage seed: ok"
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = [ ./options.nix ];
|
||||
@@ -103,6 +137,20 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
# Seed the new cert's acmedns storage before the ACME unit first runs (see
|
||||
# acmeStorageSeed above). Ordering via the generated acme unit name.
|
||||
systemd.services.cc-ci-acme-storage-seed = {
|
||||
description = "Seed ci.autonomic.zone acme-dns storage from the legacy account";
|
||||
after = [ "acme-dns.service" ];
|
||||
wantedBy = [ "acme-ci.autonomic.zone.service" ];
|
||||
before = [ "acme-ci.autonomic.zone.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
UMask = "0077";
|
||||
};
|
||||
script = "${acmeStorageSeed}/bin/cc-ci-acme-storage-seed";
|
||||
};
|
||||
|
||||
# Traefik consumes its wildcard as immutable Swarm secrets, so a renewed
|
||||
# host certificate must be copied and reconciled rather than merely reloaded.
|
||||
# This service is started only by the production-mode ACME postRun hook.
|
||||
@@ -116,7 +164,7 @@ in
|
||||
UMask = "0077";
|
||||
};
|
||||
script = ''
|
||||
src=/var/lib/acme/ci.commoninternet.net
|
||||
src=/var/lib/acme/ci.autonomic.zone
|
||||
dst=/var/lib/ci-certs/live
|
||||
test -s "$src/fullchain.pem"
|
||||
test -s "$src/key.pem"
|
||||
@@ -144,11 +192,18 @@ in
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
certs."ci.commoninternet.net" = {
|
||||
domain = "ci.commoninternet.net";
|
||||
extraDomainNames = [ "*.ci.commoninternet.net" ];
|
||||
# Staging issuance succeeded using the permanent, narrowly delegated
|
||||
# CNAME. Production uses the same restricted acme-dns account.
|
||||
certs."ci.autonomic.zone" = {
|
||||
domain = "ci.autonomic.zone";
|
||||
# Dual-zone SANs: the new zone + the legacy one. One cert = one ssl_cert/ssl_key
|
||||
# secret pair = zero traefik reconciler changes. Phase 4 drops the legacy SANs.
|
||||
extraDomainNames = [
|
||||
"*.ci.autonomic.zone"
|
||||
"ci.commoninternet.net"
|
||||
"*.ci.commoninternet.net"
|
||||
];
|
||||
# Staging issuance proved the permanent, narrowly delegated CNAME and the
|
||||
# restricted acme-dns account. Production uses the same account (re-keyed
|
||||
# for the new zone by cc-ci-acme-storage-seed.service).
|
||||
dnsProvider = "acmedns";
|
||||
environmentFile = "/etc/acme-dns/lego.env";
|
||||
dnsResolver = "1.1.1.1:53";
|
||||
|
||||
@@ -33,7 +33,8 @@ let
|
||||
image: cc-ci-bridge:${imageTag}
|
||||
environment:
|
||||
- GITEA_API=https://git.autonomic.zone/api/v1
|
||||
- DRONE_URL=https://drone.ci.commoninternet.net
|
||||
- DRONE_URL=https://drone.ci.autonomic.zone
|
||||
- DASH_URL=https://ci.autonomic.zone
|
||||
- CI_REPO=recipe-maintainers/cc-ci
|
||||
- BRIDGE_LISTEN=0.0.0.0:8080
|
||||
# Polling is PRIMARY (outbound, read-only, always on); the /hook webhook is an optional
|
||||
@@ -57,7 +58,7 @@ let
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.services.ccci-bridge.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.ccci-bridge.rule=Host(`ci.commoninternet.net`) && PathPrefix(`/hook`)"
|
||||
- "traefik.http.routers.ccci-bridge.rule=(Host(`ci.autonomic.zone`) || Host(`ci.commoninternet.net`)) && PathPrefix(`/hook`)"
|
||||
- "traefik.http.routers.ccci-bridge.entrypoints=web-secure"
|
||||
- "traefik.http.routers.ccci-bridge.tls=true"
|
||||
networks:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Results dashboard (§4.5, D7): the YunoHost-CI-like overview at ci.commoninternet.net. Reads the
|
||||
# Results dashboard (§4.5, D7): the YunoHost-CI-like overview at ci.autonomic.zone. Reads the
|
||||
# Drone API (read-only) and renders latest-run-per-recipe + SVG badges. Packaged as a Nix-built OCI
|
||||
# image and run as a swarm service on `proxy`, routed by traefik at Host(ci.commoninternet.net) — the
|
||||
# comment-bridge's Host && PathPrefix(`/hook`) rule is longer, so /hook still wins (priority by rule
|
||||
@@ -33,7 +33,7 @@ let
|
||||
app:
|
||||
image: cc-ci-dashboard:${imageTag}
|
||||
environment:
|
||||
- DRONE_URL=https://drone.ci.commoninternet.net
|
||||
- DRONE_URL=https://drone.ci.autonomic.zone
|
||||
- CI_REPO=recipe-maintainers/cc-ci
|
||||
- DASH_LISTEN=0.0.0.0:8080
|
||||
- DRONE_TOKEN_FILE=/run/secrets/drone_token
|
||||
@@ -57,7 +57,7 @@ let
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.services.ccci-dashboard.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.ccci-dashboard.rule=Host(`ci.commoninternet.net`)"
|
||||
- "traefik.http.routers.ccci-dashboard.rule=Host(`ci.autonomic.zone`) || Host(`ci.commoninternet.net`)"
|
||||
- "traefik.http.routers.ccci-dashboard.entrypoints=web-secure"
|
||||
- "traefik.http.routers.ccci-dashboard.tls=true"
|
||||
networks:
|
||||
|
||||
@@ -30,9 +30,11 @@ let
|
||||
exit 0
|
||||
fi
|
||||
# NEVER prune mid-run: a live run-app stack means a deploy/test is in flight (mid-pull layers
|
||||
# can look prunable). Run-app services: <=4char>-<6hex>_ci_commoninternet_net_* (lifecycle.py).
|
||||
# can look prunable). Run-app services: <=4char>-<6hex>_<zone-stem>_* (lifecycle.py).
|
||||
# Zone stem matches BOTH ci_autonomic_zone (current) and ci_commoninternet_net
|
||||
# (legacy stacks from before the 2026-09 domain cutover) during the bake window.
|
||||
if docker service ls --format '{{.Name}}' \
|
||||
| grep -qE '^[a-z0-9]{1,4}-[0-9a-f]{6}_ci_commoninternet_net_'; then
|
||||
| grep -qE '^[a-z0-9]{1,4}-[0-9a-f]{6}_ci_(autonomic_zone|commoninternet_net)_'; then
|
||||
echo "docker-prune: a run-app stack is live — skipping (never prune mid-run)"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
@@ -35,7 +35,7 @@ in
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
environment = {
|
||||
DRONE_RPC_PROTO = "https";
|
||||
DRONE_RPC_HOST = "drone.ci.commoninternet.net";
|
||||
DRONE_RPC_HOST = "drone.ci.autonomic.zone";
|
||||
DRONE_RUNNER_CAPACITY = maxTests; # MAX_TESTS concurrency cap (see let-binding above)
|
||||
DRONE_RUNNER_NAME = "cc-ci-exec";
|
||||
# exec runner needs a writable root for build workspaces
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# Drone CI server = coop-cloud `drone` recipe via abra (swarm, traefik-routed at
|
||||
# drone.ci.commoninternet.net, Gitea SSO, wildcard cert / no ACME). The exec *runner* is a
|
||||
# drone.ci.autonomic.zone, Gitea SSO, wildcard cert / no ACME). The exec *runner* is a
|
||||
# separate host systemd service (modules/drone-runner.nix). See DECISIONS.md "CI engine"/"Drone
|
||||
# deployment shape".
|
||||
#
|
||||
@@ -17,7 +17,7 @@ let
|
||||
name = "cc-ci-reconcile-drone";
|
||||
runtimeInputs = with pkgs; [ abra docker jq gnused gnugrep coreutils git curl ];
|
||||
text = ''
|
||||
DRONE_DOMAIN="drone.ci.commoninternet.net"
|
||||
DRONE_DOMAIN="drone.ci.autonomic.zone"
|
||||
ENV_FILE="$HOME/.abra/servers/default/$DRONE_DOMAIN.env"
|
||||
|
||||
if [ ! -r /run/secrets/drone_rpc_secret ] || [ ! -r /run/secrets/drone_gitea_client_secret ]; then
|
||||
|
||||
@@ -73,7 +73,7 @@ let
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.services.ccci-reports.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.ccci-reports.rule=Host(`report.ci.commoninternet.net`)"
|
||||
- "traefik.http.routers.ccci-reports.rule=Host(`report.ci.autonomic.zone`) || Host(`report.ci.commoninternet.net`)"
|
||||
- "traefik.http.routers.ccci-reports.entrypoints=web-secure"
|
||||
- "traefik.http.routers.ccci-reports.tls=true"
|
||||
networks:
|
||||
|
||||
Reference in New Issue
Block a user