drone runner fron docker.io again

_sys/etc_consul.d/acl.hcl

@@ -0,0 +1,5 @@
+acl = {
+  enabled = true
+  default_policy = "allow"
+  enable_token_persistence = true
+}

_sys/vault/vault-service-policy.hcl

@@ -0,0 +1,13 @@
+https://developer.hashicorp.com/vault/tutorials/day-one-consul/deployment-guide
+#consul acl policy create -name vault-service -rules @vault-service-policy.hcl
+#consul acl token create \
+#    -description "Vault Service Token" \
+#   -policy-name vault-service
+
+
+service "vault" { policy = "write" }
+key_prefix "vault/" { policy = "write" }
+agent_prefix "" { policy = "read" }
+session_prefix "" { policy = "write" }
+
+

apps/drone/live-runner-podman.hcl

@@ -0,0 +1,73 @@
+job "drone-runner" {
+  datacenters = [
+    "nummer5",
+  ]
+  type = "service"
+
+  group "apps" {
+    count = 1
+
+    network {
+      mode = "host"
+      port "http" {
+        to = 3000
+      }
+
+    }
+    
+    service {
+        name = "drone-runner"
+        port = "http"
+    }
+
+    volume "drone-runner" {
+      type      = "csi"
+      source    = "drone-runner"
+      read_only = false
+      access_mode = "single-node-writer"
+      attachment_mode = "file-system"
+    }
+
+    restart {
+      attempts = 5
+      delay    = "30s"
+    }
+
+    task "drone-runner" {
+      driver = "podman"
+      volume_mount {
+        volume      = "drone-runner"
+        destination = "/data"
+        read_only   = false
+      }
+
+      config {
+        image = "cr.wks/drone/drone-runner-podman:latest"
+        force_pull = true
+        ports = ["http"]
+        volumes = [
+          "/run/podman/podman.sock:/run/podman/podman.sock",
+          "/run/podman/podman.sock:/var/run/docker.sock",
+          "/etc/containers:/etc/containers"
+        ]
+ 
+      }
+
+      env {
+        TZ                        = "Europe/Berlin"
+        DRONE_RUNNER_NAME         = "drone-runner01"
+        DRONE_RPC_SECRET          = "7eb685ed81d0c34bafc5efa7783c20b2"
+        DRONE_RPC_HOST            = "drone.service.nr5"
+        DRONE_RPC_PROTO           = "http"
+        DRONE_LOGS_DEBUG          = true
+        DRONE_LOGS_TRACE          = true
+      }
+
+      resources {
+        cpu    = 500
+        memory = 128 
+      }
+
+    }
+  }
+}

apps/drone/live-runner.hcl

@@ -20,14 +20,6 @@ job "drone-runner" {
         port = "http"
     }
 
-    volume "drone-runner" {
-      type      = "csi"
-      source    = "drone-runner"
-      read_only = false
-      access_mode = "single-node-writer"
-      attachment_mode = "file-system"
-    }
-
     restart {
       attempts = 5
       delay    = "30s"
@@ -35,14 +27,10 @@ job "drone-runner" {
 
     task "drone-runner" {
       driver = "podman"
-      volume_mount {
-        volume      = "drone-runner"
-        destination = "/drone"
-        read_only   = false
-      }
 
       config {
-        image = "docker.io/drone/drone-runner-docker:latest"
+        image = "drone/drone-runner-docker:latest"
+        force_pull = true
         ports = ["http"]
         volumes = [
           "/var/run/podman/podman.sock:/var/run/docker.sock",
@@ -62,8 +50,8 @@ job "drone-runner" {
       }
 
       resources {
-        cpu    = 500
+        cpu    = 100
-        memory = 128 
+        memory = 64 
       }
 
     }

apps/drone/live.hcl

@@ -23,6 +23,13 @@ job "drone" {
           "traefik.enable=true",
           "traefik.http.routers.drone.rule=Host(`drone.service.nr5`)",
         ]
+        
+        check {
+         type     = "http"
+         path     = "/welcome"
+         interval = "120s"
+         timeout  = "5s"
+       }
     }
 
     volume "drone-data" {

apps/gitea/live.hcl

@@ -51,6 +51,7 @@ job "gitea" {
 
     task "gitea" {
       driver = "podman"
+      
       volume_mount {
         volume      = "gitea-data"
         destination = "/data"
@@ -60,6 +61,7 @@ job "gitea" {
       config {
         image = "docker.io/gitea/gitea:latest"
         ports = ["ssh", "http"]
+        force_pull = true
       }
 
       env {
@@ -80,6 +82,7 @@ job "gitea" {
         GITEA__packages__ENABLED        = "true"
         GITEA__log__LEVEL               = "warn"
         GITEA__actions__ENABLED         = "true"
+        GITEA__webhook__ALLOWED_HOST_LIST = "private"
         
       }
 

apps/postgresql/live.hcl

@@ -48,7 +48,7 @@ job "postgres" {
       
       resources {
         cpu = 1000
-        memory = 1024
+        memory = 512
 
       }