bmr_bluecap/bcs-website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
bcs-website/docs/adr/0007-gitea-actions-and-packages.md
Brad Rodgers fc64909f3d
All checks were successful
CI / ci (push) Successful in 1m56s
Details
docs: reconcile to as-built (ADR-0008, deploy runbook); clean text hero on detail pages 
- ADR-0008: private package, External-Secrets pull over public HTTPS (no k3s restart);
  CI auth via CI_TOKEN PAT; Playwright dropped from CI. Marks ADR-0007 partially superseded.
- gitops-deployment-strategy + deployment.md updated to as-built flow + operate/troubleshoot runbook
- content-deviations: detail-page heroes are text-only (no image)
- service/focus detail pages: clean text hero (drop shared photo/icon)
2026-07-20 08:27:35 -04:00

2.4 KiB
Raw Permalink Blame History

ADR-0007: CI on Gitea Actions, images in Gitea Packages

Status: Accepted — 2026-07-15 · Supersedes the GitHub Actions + GHCR specifics of ADR-0001 (the ArgoCD/GitOps model itself stands).

⚠️ Partially superseded by ADR-0008. The registry-visibility (public → private), image-pull path (registries.yaml/k3s-restart → public-HTTPS pull, no restart), CI auth (auto token → CI_TOKEN PAT), and pipeline (Playwright e2e removed from CI) below were changed once built. The "CI on Gitea Actions, images in Gitea Packages" core still holds. Read ADR-0008 for the as-built details.

Context

The repo lives on the homelab's self-hosted Gitea (bmr_bluecap/bcs-website), not GitHub, so GitHub Actions and GHCR do not apply. Gitea runs an act_runner (GitHub-Actions-compatible) and a built-in container registry (Gitea Packages, OCI /v2/ confirmed live at 10.66.15.22:3000). The runner mounts /var/run/docker.sock; its label is ubuntu-latest (jobs run in a node:18-bullseye container).

Decision

  • CI = Gitea Actions, workflow at .gitea/workflows/ci.yml, runs-on: ubuntu-latest.
  • Registry = Gitea Packages at 10.66.15.22:3000/bmr_bluecap/bcs-website, immutable <git-sha> tags. Auth via the run's automatic token.
  • Pipeline: npm ci → build (typecheck) → seo:lint → Playwright e2e → build & push image → bump the image tag in k8s/kustomization.yaml and commit back to main ([skip ci] + paths-ignore to avoid a loop). ArgoCD then reconciles k3s (unchanged from ADR-0001).
  • Package visibility: public (recommended) — the image contains only the compiled public site, so a public package removes the need for a cluster imagePullSecret. Private + an External-Secrets-managed pull secret is the documented alternative.

Consequences

  • No external CI/registry dependency; everything stays in the homelab.
  • New infra prerequisites (see docs/gitops-deployment-strategy.md): k3s must trust the HTTP registry (registries.yaml / k3s_registry_mirrors entry for 10.66.15.22:3000); the runner host's Docker daemon needs 10.66.15.22:3000 as an insecure registry; docker must be usable from job containers (act_runner socket passthrough) or the build switches to kaniko.
  • GHCR/GitHub references in ADR-0001 and older doc revisions are superseded by this ADR.