thanhnvandClaude Sonnet 4.6
9892e82221
Infrastructure (H3 CI gate, H5 KMS): - Gitea Actions enabled (GITEA__actions__ENABLED=true) - act_runner: Docker-outside-of-Docker for deploy job - Vault Transit RSA-2048 signing keys (casan-audit-key, casan-policy-key) Vault KMS scripts (H5 governance): - .specify/scripts/bash/vault-kms.sh — sign/verify/pubkey/ensure-key - .specify/scripts/bash/sign-audit-head.sh — sign audit chain via Vault - Updated sign-policy-bundle.sh — Vault path + local fallback - Updated security-gate.sh — KMS gate added (PASS=11 FAIL=0) OKR app deployment (port 80/3001): - Dockerfile.backend — node:22-slim (node:sqlite requires Node 22) - Dockerfile.frontend — node:20-alpine build + nginx:alpine runtime - nginx/nginx.conf — React SPA + /api/v1/* proxy to okr-backend:3001 - backend/entrypoint.sh — auto init DB on first run + seed - .dockerignore CI pipeline (.gitea/workflows/ci.yml): - Job 1: Vitest frontend tests (H3) - Job 2: CASAN security gate + Vault KMS signing (H4/H5) - Job 3: Deploy OKR → port 80 (runs on push to main after tests pass) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
37 lines
1.2 KiB
YAML
37 lines
1.2 KiB
YAML
# act_runner configuration for CASAN CI on Oracle Cloud VPS (1 GB RAM)
|
|
# Deploy to: /opt/gitea/act-runner-config.yaml on the VPS.
|
|
|
|
log:
|
|
level: info
|
|
|
|
runner:
|
|
# Unique name shown in Gitea → Site Administration → Runners
|
|
name: "casan-runner-oracle"
|
|
|
|
# Only 1 concurrent job — VPS has 1 GB RAM (Gitea ≈ 200 MB + job container ≈ 300 MB)
|
|
capacity: 1
|
|
|
|
# Map "ubuntu-latest" jobs to the catthehacker image that has git, curl, jq,
|
|
# openssl, Node.js 18, and Python3 pre-installed. The workflow steps upgrade
|
|
# Node.js to 20 via actions/setup-node and add python-is-python3.
|
|
labels:
|
|
- "ubuntu-latest:docker://catthehacker/ubuntu:act-22.04"
|
|
|
|
# How often the runner polls Gitea for new jobs
|
|
fetch_interval: 5s
|
|
fetch_timeout: 30s
|
|
|
|
# Where to store the runner's working directory (inside the container)
|
|
# Default is /workspace — works fine.
|
|
|
|
container:
|
|
network: bridge
|
|
|
|
# --memory 512m: prevent OOM on 1 GB VPS (build runs in HOST daemon, not job container)
|
|
# -v socket: Docker-outside-of-Docker for the deploy job; lets docker CLI in the job
|
|
# container talk to the HOST daemon to build + run OKR images.
|
|
options: "--memory 512m --cpus 1.5 -v /var/run/docker.sock:/var/run/docker.sock"
|
|
|
|
valid_volumes:
|
|
- "**"
|