Christopher Mühl
b7ba4c1c0a
Remove hardcoded nomad-addr input — NOMAD_ADDR is now injected by the Forgejo runner via container.options using host.docker.internal. Switch Nomad Variable path from static-sites/s3 to nomad/jobs so all jobs in the namespace can read it without explicit ACL policies. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
86 lines
2.5 KiB
Nix
86 lines
2.5 KiB
Nix
let
|
|
domain = builtins.getEnv "DOMAIN";
|
|
siteHash = builtins.getEnv "SITE_HASH";
|
|
serverImage = builtins.getEnv "SERVER_IMAGE";
|
|
datacenter = builtins.getEnv "DATACENTER";
|
|
s3Bucket = builtins.getEnv "S3_BUCKET";
|
|
|
|
jobId = "site-" + builtins.replaceStrings [ "." ] [ "-" ] domain;
|
|
|
|
startupCmd =
|
|
"mkdir -p /var/www && " +
|
|
"aws s3 cp s3://${s3Bucket}/sites/${domain}/${siteHash}.tar.gz - " +
|
|
"| tar xz -C /var/www/ && " +
|
|
"exec static-web-server --port 8080 --root /var/www";
|
|
|
|
templateData =
|
|
"{{ with nomadVar \"nomad/jobs\" }}" +
|
|
"AWS_ACCESS_KEY_ID={{ .access_key }}\n" +
|
|
"AWS_SECRET_ACCESS_KEY={{ .secret_key }}\n" +
|
|
"AWS_ENDPOINT_URL={{ .endpoint }}\n" +
|
|
"{{ end }}";
|
|
|
|
job = {
|
|
Job = {
|
|
ID = jobId;
|
|
Name = jobId;
|
|
Namespace = "static-sites";
|
|
Type = "service";
|
|
Datacenters = [ datacenter ];
|
|
Update = {
|
|
MinHealthyTime = 5000000000;
|
|
HealthyDeadline = 60000000000;
|
|
MaxParallel = 1;
|
|
};
|
|
TaskGroups = [
|
|
{
|
|
Name = "site";
|
|
Count = 1;
|
|
Networks = [
|
|
{ DynamicPorts = [ { Label = "http"; To = 8080; } ]; }
|
|
];
|
|
Services = [
|
|
{
|
|
Name = jobId;
|
|
Provider = "nomad";
|
|
PortLabel = "http";
|
|
Tags = [
|
|
"traefik.enable=true"
|
|
"traefik.http.routers.${jobId}.rule=Host(`${domain}`)"
|
|
"traefik.http.routers.${jobId}.entrypoints=websecure"
|
|
"traefik.http.routers.${jobId}.tls.certresolver=letsencrypt"
|
|
];
|
|
Checks = [
|
|
{ Type = "http"; Path = "/"; Interval = 30000000000; Timeout = 5000000000; }
|
|
];
|
|
}
|
|
];
|
|
Tasks = [
|
|
{
|
|
Name = "server";
|
|
Driver = "docker";
|
|
Config = {
|
|
image = serverImage;
|
|
command = "/bin/bash";
|
|
args = [ "-c" startupCmd ];
|
|
ports = [ "http" ];
|
|
};
|
|
Templates = [
|
|
{
|
|
EmbeddedTmpl = templateData;
|
|
DestPath = "secrets/s3.env";
|
|
Envvars = true;
|
|
}
|
|
];
|
|
Resources = {
|
|
CPU = 100;
|
|
MemoryMB = 128;
|
|
};
|
|
}
|
|
];
|
|
}
|
|
];
|
|
};
|
|
};
|
|
in
|
|
builtins.toJSON job
|