Merge pull request 'domain cutover: ci.autonomic.zone — cert, front doors, drone, harness naming' (#39) from domain-cutover into main
continuous-integration/drone/push Build is failing

This commit was merged in pull request #39.
This commit is contained in:
2026-09-21 16:53:34 +00:00
16 changed files with 102 additions and 34 deletions
+2 -2
View File
@@ -41,11 +41,11 @@ from datetime import UTC, datetime
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
GITEA_API = os.environ.get("GITEA_API", "https://git.autonomic.zone/api/v1")
DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.commoninternet.net")
DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.autonomic.zone")
# Dashboard base URL — where per-run artifacts (summary card PNG, level badge SVG) are served
# (Phase 3 U2.3: /runs/<run_id>/...). The PR comment (U3) embeds the card + badge from here. The
# run_id is the Drone build number (== `num`), so the URLs are /runs/<num>/{summary.png,badge.svg}.
DASH_URL = os.environ.get("DASH_URL", "https://ci.commoninternet.net")
DASH_URL = os.environ.get("DASH_URL", "https://ci.autonomic.zone")
CI_REPO = os.environ.get("CI_REPO", "recipe-maintainers/cc-ci")
TRIGGER = "!testme"
# Hidden HTML-comment marker embedded in the bot's PR comment so a re-`!testme` UPDATES the same
+1 -1
View File
@@ -22,7 +22,7 @@ import urllib.error
import urllib.request
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.commoninternet.net")
DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.autonomic.zone")
CI_REPO = os.environ.get("CI_REPO", "recipe-maintainers/cc-ci")
CACHE_TTL = int(os.environ.get("CACHE_TTL", "30"))
# Per-recipe history display cap (phase dash): a long-lived recipe (plausible/custom-html have 30+
+65 -10
View File
@@ -1,8 +1,13 @@
# Restricted DNS-01 certificate issuance for ci.commoninternet.net.
# Restricted DNS-01 certificate issuance for ci.autonomic.zone (+ legacy ci.commoninternet.net).
#
# This host is authoritative only for acme.commoninternet.net. Gandi continues
# to own commoninternet.net; it delegates this narrow zone and one permanent
# _acme-challenge CNAME manually. No Gandi credential is present here.
# to own commoninternet.net AND autonomic.zone; both zones delegate their narrow
# _acme-challenge CNAME to the same acme-dns account. No Gandi credential is present here.
#
# Domain cutover 2026-09: ONE cert now covers BOTH zones (SANs: ci/*.ci.autonomic.zone +
# ci/*.ci.commoninternet.net) — a single secret pair flows through the unchanged
# warm_reconcile._traefik_setup ssl_cert/ssl_key flow, avoiding dual-cert SNI entirely.
# The legacy commoninternet.net SANs are dropped in Phase 4 (post-bake reissue).
{ config, pkgs, ... }:
let
publicIPv4 = config.cc-ci.publicIPv4;
@@ -42,11 +47,40 @@ let
# These are wiring values only. The acme-dns account JSON is generated by
# Lego below /var/lib/acme and never enters Nix, git, or /etc.
# Storage path points at the NEW cert's dir; cc-ci-acme-storage-seed.service
# (below) clones the legacy account entry into it under the new zone key so
# Lego can write the new zone's TXT via the same (registration-disabled)
# acme-dns account — the CNAME for _acme-challenge.ci.autonomic.zone already
# delegates to that account's subdomain.
legoEnvironment = pkgs.writeText "cc-ci-acme-dns-lego.env" ''
ACME_DNS_API_BASE=http://127.0.0.1:8080
ACME_DNS_STORAGE_PATH=/var/lib/acme/ci.commoninternet.net/acme-dns-accounts.json
ACME_DNS_STORAGE_PATH=/var/lib/acme/ci.autonomic.zone/acme-dns-accounts.json
ACME_DNS_ALLOWLIST=127.0.0.1/32
'';
# Seed the new cert's acmedns storage from the legacy one: same acme-dns
# account (same subdomain/credentials — the only thing the DNS CNAME points
# at), re-keyed for the new zone. Idempotent; runs before the ACME unit.
acmeStorageSeed = pkgs.writeShellApplication {
name = "cc-ci-acme-storage-seed";
runtimeInputs = with pkgs; [ jq coreutils ];
text = ''
src=/var/lib/acme/ci.commoninternet.net/acme-dns-accounts.json
dst=/var/lib/acme/ci.autonomic.zone/acme-dns-accounts.json
install -d -m 0700 /var/lib/acme/ci.autonomic.zone
if [ ! -s "$src" ]; then
echo "storage seed: no legacy accounts.json skipping (fresh host?)"
exit 0
fi
jq 'if has("ci.autonomic.zone") then .
elif has("ci.commoninternet.net") then
. + { "ci.autonomic.zone": .["ci.commoninternet.net"] }
else . end' "$src" > "$dst.tmp"
mv "$dst.tmp" "$dst"
chmod 0600 "$dst"
echo "storage seed: ok"
'';
};
in
{
imports = [ ./options.nix ];
@@ -103,6 +137,20 @@ in
};
};
# Seed the new cert's acmedns storage before the ACME unit first runs (see
# acmeStorageSeed above). Ordering via the generated acme unit name.
systemd.services.cc-ci-acme-storage-seed = {
description = "Seed ci.autonomic.zone acme-dns storage from the legacy account";
after = [ "acme-dns.service" ];
wantedBy = [ "acme-ci.autonomic.zone.service" ];
before = [ "acme-ci.autonomic.zone.service" ];
serviceConfig = {
Type = "oneshot";
UMask = "0077";
};
script = "${acmeStorageSeed}/bin/cc-ci-acme-storage-seed";
};
# Traefik consumes its wildcard as immutable Swarm secrets, so a renewed
# host certificate must be copied and reconciled rather than merely reloaded.
# This service is started only by the production-mode ACME postRun hook.
@@ -116,7 +164,7 @@ in
UMask = "0077";
};
script = ''
src=/var/lib/acme/ci.commoninternet.net
src=/var/lib/acme/ci.autonomic.zone
dst=/var/lib/ci-certs/live
test -s "$src/fullchain.pem"
test -s "$src/key.pem"
@@ -144,11 +192,18 @@ in
security.acme = {
acceptTerms = true;
certs."ci.commoninternet.net" = {
domain = "ci.commoninternet.net";
extraDomainNames = [ "*.ci.commoninternet.net" ];
# Staging issuance succeeded using the permanent, narrowly delegated
# CNAME. Production uses the same restricted acme-dns account.
certs."ci.autonomic.zone" = {
domain = "ci.autonomic.zone";
# Dual-zone SANs: the new zone + the legacy one. One cert = one ssl_cert/ssl_key
# secret pair = zero traefik reconciler changes. Phase 4 drops the legacy SANs.
extraDomainNames = [
"*.ci.autonomic.zone"
"ci.commoninternet.net"
"*.ci.commoninternet.net"
];
# Staging issuance proved the permanent, narrowly delegated CNAME and the
# restricted acme-dns account. Production uses the same account (re-keyed
# for the new zone by cc-ci-acme-storage-seed.service).
dnsProvider = "acmedns";
environmentFile = "/etc/acme-dns/lego.env";
dnsResolver = "1.1.1.1:53";
+3 -2
View File
@@ -33,7 +33,8 @@ let
image: cc-ci-bridge:${imageTag}
environment:
- GITEA_API=https://git.autonomic.zone/api/v1
- DRONE_URL=https://drone.ci.commoninternet.net
- DRONE_URL=https://drone.ci.autonomic.zone
- DASH_URL=https://ci.autonomic.zone
- CI_REPO=recipe-maintainers/cc-ci
- BRIDGE_LISTEN=0.0.0.0:8080
# Polling is PRIMARY (outbound, read-only, always on); the /hook webhook is an optional
@@ -57,7 +58,7 @@ let
labels:
- "traefik.enable=true"
- "traefik.http.services.ccci-bridge.loadbalancer.server.port=8080"
- "traefik.http.routers.ccci-bridge.rule=Host(`ci.commoninternet.net`) && PathPrefix(`/hook`)"
- "traefik.http.routers.ccci-bridge.rule=(Host(`ci.autonomic.zone`) || Host(`ci.commoninternet.net`)) && PathPrefix(`/hook`)"
- "traefik.http.routers.ccci-bridge.entrypoints=web-secure"
- "traefik.http.routers.ccci-bridge.tls=true"
networks:
+3 -3
View File
@@ -1,4 +1,4 @@
# Results dashboard (§4.5, D7): the YunoHost-CI-like overview at ci.commoninternet.net. Reads the
# Results dashboard (§4.5, D7): the YunoHost-CI-like overview at ci.autonomic.zone. Reads the
# Drone API (read-only) and renders latest-run-per-recipe + SVG badges. Packaged as a Nix-built OCI
# image and run as a swarm service on `proxy`, routed by traefik at Host(ci.commoninternet.net) — the
# comment-bridge's Host && PathPrefix(`/hook`) rule is longer, so /hook still wins (priority by rule
@@ -33,7 +33,7 @@ let
app:
image: cc-ci-dashboard:${imageTag}
environment:
- DRONE_URL=https://drone.ci.commoninternet.net
- DRONE_URL=https://drone.ci.autonomic.zone
- CI_REPO=recipe-maintainers/cc-ci
- DASH_LISTEN=0.0.0.0:8080
- DRONE_TOKEN_FILE=/run/secrets/drone_token
@@ -57,7 +57,7 @@ let
labels:
- "traefik.enable=true"
- "traefik.http.services.ccci-dashboard.loadbalancer.server.port=8080"
- "traefik.http.routers.ccci-dashboard.rule=Host(`ci.commoninternet.net`)"
- "traefik.http.routers.ccci-dashboard.rule=Host(`ci.autonomic.zone`) || Host(`ci.commoninternet.net`)"
- "traefik.http.routers.ccci-dashboard.entrypoints=web-secure"
- "traefik.http.routers.ccci-dashboard.tls=true"
networks:
+4 -2
View File
@@ -30,9 +30,11 @@ let
exit 0
fi
# NEVER prune mid-run: a live run-app stack means a deploy/test is in flight (mid-pull layers
# can look prunable). Run-app services: <=4char>-<6hex>_ci_commoninternet_net_* (lifecycle.py).
# can look prunable). Run-app services: <=4char>-<6hex>_<zone-stem>_* (lifecycle.py).
# Zone stem matches BOTH ci_autonomic_zone (current) and ci_commoninternet_net
# (legacy stacks from before the 2026-09 domain cutover) during the bake window.
if docker service ls --format '{{.Name}}' \
| grep -qE '^[a-z0-9]{1,4}-[0-9a-f]{6}_ci_commoninternet_net_'; then
| grep -qE '^[a-z0-9]{1,4}-[0-9a-f]{6}_ci_(autonomic_zone|commoninternet_net)_'; then
echo "docker-prune: a run-app stack is live skipping (never prune mid-run)"
exit 0
fi
+1 -1
View File
@@ -35,7 +35,7 @@ in
wantedBy = [ "multi-user.target" ];
environment = {
DRONE_RPC_PROTO = "https";
DRONE_RPC_HOST = "drone.ci.commoninternet.net";
DRONE_RPC_HOST = "drone.ci.autonomic.zone";
DRONE_RUNNER_CAPACITY = maxTests; # MAX_TESTS concurrency cap (see let-binding above)
DRONE_RUNNER_NAME = "cc-ci-exec";
# exec runner needs a writable root for build workspaces
+2 -2
View File
@@ -1,5 +1,5 @@
# Drone CI server = coop-cloud `drone` recipe via abra (swarm, traefik-routed at
# drone.ci.commoninternet.net, Gitea SSO, wildcard cert / no ACME). The exec *runner* is a
# drone.ci.autonomic.zone, Gitea SSO, wildcard cert / no ACME). The exec *runner* is a
# separate host systemd service (modules/drone-runner.nix). See DECISIONS.md "CI engine"/"Drone
# deployment shape".
#
@@ -17,7 +17,7 @@ let
name = "cc-ci-reconcile-drone";
runtimeInputs = with pkgs; [ abra docker jq gnused gnugrep coreutils git curl ];
text = ''
DRONE_DOMAIN="drone.ci.commoninternet.net"
DRONE_DOMAIN="drone.ci.autonomic.zone"
ENV_FILE="$HOME/.abra/servers/default/$DRONE_DOMAIN.env"
if [ ! -r /run/secrets/drone_rpc_secret ] || [ ! -r /run/secrets/drone_gitea_client_secret ]; then
+1 -1
View File
@@ -73,7 +73,7 @@ let
labels:
- "traefik.enable=true"
- "traefik.http.services.ccci-reports.loadbalancer.server.port=80"
- "traefik.http.routers.ccci-reports.rule=Host(`report.ci.commoninternet.net`)"
- "traefik.http.routers.ccci-reports.rule=Host(`report.ci.autonomic.zone`) || Host(`report.ci.commoninternet.net`)"
- "traefik.http.routers.ccci-reports.entrypoints=web-secure"
- "traefik.http.routers.ccci-reports.tls=true"
networks:
+4 -1
View File
@@ -117,7 +117,10 @@ def assert_serving(domain: str, meta) -> None:
# app is routed (Traefik serves the wildcard zone-wide). The serving proof is steps 12 above.
verified, detail = served_cert(domain)
assert verified, f"{domain}: served wildcard cert is not trusted/valid — {detail}"
assert "commoninternet.net" in detail.lower(), f"{domain}: served cert unexpected — {detail}"
# Dual-zone cert (2026-09 cutover): the SAN list covers both *.ci zones; a run
# domain in either zone must be covered by the one serving wildcard.
zone = "autonomic.zone" if domain.endswith(".autonomic.zone") else "commoninternet.net"
assert zone in detail.lower(), f"{domain}: served cert unexpected — {detail}"
# ---- Op/assertion split (Phase 1e HC3) -------------------------------------------------------
+2 -2
View File
@@ -25,7 +25,7 @@ from . import meta as meta_mod
GATEWAY_IP = "143.244.213.108" # *.ci.commoninternet.net -> gateway (TLS passthrough to cc-ci)
# A run app domain is "<recipe[:4]>-<6hex>.ci.commoninternet.net" (see DECISIONS.md). Used by the
# janitor to recognise orphaned run apps (infra apps like traefik/drone/backups don't match).
RUN_APP_RE = re.compile(r"^[a-z0-9]{1,4}-[0-9a-f]{6}\.ci\.commoninternet\.net$")
RUN_APP_RE = re.compile(r"^[a-z0-9]{1,4}-[0-9a-f]{6}\.ci\.(?:autonomic\.zone|commoninternet\.net)$")
class TeardownError(RuntimeError):
@@ -1190,7 +1190,7 @@ def janitor() -> None:
# also catch stacks whose .env was already deleted (abra ls won't list them)
for svc in _docker_names("service", ""):
# svc like cust-c95a69_ci_commoninternet_net_app -> reconstruct domain
m = re.match(r"^([a-z0-9]{1,4}-[0-9a-f]{6})_ci_commoninternet_net_", svc)
m = re.match(r"^([a-z0-9]{1,4}-[0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_", svc)
if m:
seen.add(f"{m.group(1)}.ci.commoninternet.net")
+4 -2
View File
@@ -1,7 +1,9 @@
"""Shared run-app domain naming (used by the conftest fixtures and the orchestrator).
Domain = "<recipe[:4]>-<6hex(recipe|pr|ref)>.ci.commoninternet.net" — short enough for Docker's
Domain = "<recipe[:4]>-<6hex(recipe|pr|ref)>.ci.autonomic.zone" — short enough for Docker's
64-char swarm config/secret name limit, unique per run, collision-safe across recipes (DECISIONS.md).
(Migrated from *.ci.commoninternet.net 2026-09; the legacy zone remains valid until the bake
window ends — lifecycle/warm name matching accepts both.)
"""
from __future__ import annotations
@@ -18,4 +20,4 @@ def app_domain(recipe: str, pr: str = "0", ref: str | None = None) -> str:
ref = ref or ("local" + str(int(time.time())))
tag = _short(recipe, 4).lower()
h = hashlib.sha1(f"{recipe}|{pr}|{ref}".encode()).hexdigest()[:6]
return f"{tag}-{h}.ci.commoninternet.net"
return f"{tag}-{h}.ci.autonomic.zone"
+5 -1
View File
@@ -25,6 +25,9 @@ import urllib.request
# Recipes that, when declared as a dep, are served from a shared live-warm instance at a stable
# domain instead of being co-deployed per run. Maps dep-recipe -> stable domain.
WARM_DOMAINS = {
# Warm stacks stay on the legacy zone through the 2026-09 domain cutover (data-warm
# volumes + stack names are tied to the abra app name; renaming re-seeds the CI bases).
# They move to *.ci.autonomic.zone in a post-bake phase together with their stacks.
"keycloak": "warm-keycloak.ci.commoninternet.net",
}
@@ -38,11 +41,12 @@ _CTX.check_hostname = False
_CTX.verify_mode = ssl.CERT_NONE
# A cold per-run stack name looks like "<tag>-<6hex>_ci_commoninternet_net_<svc>"; extract the hex.
_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_commoninternet_net_")
_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_")
def stable_domain(recipe: str) -> str:
"""The stable warm domain for a recipe: `warm-<recipe>.ci.commoninternet.net` — the canonical
base's hostname (legacy zone until the post-bake warm-stack migration; see WARM_DOMAINS note).
scheme for BOTH the live-warm keycloak and the data-warm canonicals (WC2), distinct from cold
per-run `<recipe[:4]>-<6hex>`. (WARM_DOMAINS['keycloak'] equals stable_domain('keycloak').)"""
return f"warm-{recipe}.ci.commoninternet.net"
+2 -2
View File
@@ -13,10 +13,10 @@ set -euo pipefail
: "${GITEA_USERNAME:?set GITEA_USERNAME}"
: "${GITEA_PASSWORD:?set GITEA_PASSWORD}"
GITEA="${GITEA:-https://git.autonomic.zone}"
DRONE="${DRONE:-https://drone.ci.commoninternet.net}"
DRONE="${DRONE:-https://drone.ci.autonomic.zone}"
CLIENT_ID="${CLIENT_ID:-ab4cdb9d-ee96-4867-875f-87384505fc52}"
REPO="${REPO:-recipe-maintainers/cc-ci}"
RES=(--resolve "drone.ci.commoninternet.net:443:127.0.0.1")
RES=(--resolve "drone.ci.autonomic.zone:443:127.0.0.1")
export PATH=/run/current-system/sw/bin:"$PATH"
cj=$(mktemp)
+1 -1
View File
@@ -15,7 +15,7 @@ sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner")
from harness import lifecycle # noqa: E402
HELPERS = os.path.join(os.path.dirname(__file__), "helpers.py")
DOMAIN = "test-abc123.ci.commoninternet.net" # matches RUN_APP_RE
DOMAIN = "test-abc123.ci.autonomic.zone" # matches RUN_APP_RE
class HelperPool:
+2 -1
View File
@@ -72,7 +72,8 @@ def UPGRADE_SECRET_PREP(ctx):
import subprocess
# abra derives STACK_NAME from the domain by replacing dots with underscores
# (e.g. gite-e1cb78.ci.commoninternet.net → gite-e1cb78_ci_commoninternet_net).
# (e.g. gite-e1cb78.ci.autonomic.zone → gite-e1cb78_ci_autonomic_zone; legacy
# *.ci.commoninternet.net run stacks are matched too during the bake window).
stack_name = ctx.domain.replace(".", "_")
docker_secret = f"{stack_name}_lfs_jwt_secret_v1"
value = base64.urlsafe_b64encode(_os.urandom(32)).rstrip(b"=").decode()