Brad Rodgers
fc64909f3d
All checks were successful
CI / ci (push) Successful in 1m56s
- ADR-0008: private package, External-Secrets pull over public HTTPS (no k3s restart); CI auth via CI_TOKEN PAT; Playwright dropped from CI. Marks ADR-0007 partially superseded. - gitops-deployment-strategy + deployment.md updated to as-built flow + operate/troubleshoot runbook - content-deviations: detail-page heroes are text-only (no image) - service/focus detail pages: clean text hero (drop shared photo/icon)
40 lines
2.4 KiB
Markdown
40 lines
2.4 KiB
Markdown
# ADR-0007: CI on Gitea Actions, images in Gitea Packages
|
|
|
|
**Status:** Accepted — 2026-07-15 · **Supersedes** the GitHub Actions + GHCR specifics of
|
|
[ADR-0001](0001-gitops-with-argocd.md) (the ArgoCD/GitOps model itself stands).
|
|
|
|
> ⚠️ **Partially superseded by [ADR-0008](0008-private-package-external-secrets-pull.md).** The
|
|
> registry-visibility (public → **private**), image-pull path (registries.yaml/k3s-restart →
|
|
> **public-HTTPS pull, no restart**), CI auth (auto token → **`CI_TOKEN` PAT**), and pipeline
|
|
> (**Playwright e2e removed from CI**) below were changed once built. The "CI on Gitea Actions,
|
|
> images in Gitea Packages" core still holds. Read ADR-0008 for the as-built details.
|
|
|
|
## Context
|
|
|
|
The repo lives on the homelab's self-hosted **Gitea** (`bmr_bluecap/bcs-website`), not GitHub, so
|
|
GitHub Actions and GHCR do not apply. Gitea runs an **`act_runner`** (GitHub-Actions-compatible)
|
|
and a built-in **container registry** (Gitea Packages, OCI `/v2/` confirmed live at
|
|
`10.66.15.22:3000`). The runner mounts `/var/run/docker.sock`; its label is `ubuntu-latest`
|
|
(jobs run in a `node:18-bullseye` container).
|
|
|
|
## Decision
|
|
|
|
- **CI = Gitea Actions**, workflow at `.gitea/workflows/ci.yml`, `runs-on: ubuntu-latest`.
|
|
- **Registry = Gitea Packages** at `10.66.15.22:3000/bmr_bluecap/bcs-website`, immutable
|
|
`<git-sha>` tags. Auth via the run's automatic token.
|
|
- Pipeline: `npm ci` → build (typecheck) → `seo:lint` → Playwright e2e → build & push image →
|
|
bump the image tag in `k8s/kustomization.yaml` and commit back to `main` (`[skip ci]` +
|
|
`paths-ignore` to avoid a loop). **ArgoCD** then reconciles k3s (unchanged from ADR-0001).
|
|
- **Package visibility: public** (recommended) — the image contains only the compiled public
|
|
site, so a public package removes the need for a cluster imagePullSecret. Private + an
|
|
External-Secrets-managed pull secret is the documented alternative.
|
|
|
|
## Consequences
|
|
|
|
- No external CI/registry dependency; everything stays in the homelab.
|
|
- **New infra prerequisites** (see `docs/gitops-deployment-strategy.md`): k3s must trust the HTTP
|
|
registry (`registries.yaml` / `k3s_registry_mirrors` entry for `10.66.15.22:3000`); the runner
|
|
host's Docker daemon needs `10.66.15.22:3000` as an insecure registry; docker must be usable
|
|
from job containers (act_runner socket passthrough) or the build switches to kaniko.
|
|
- `GHCR`/`GitHub` references in ADR-0001 and older doc revisions are superseded by this ADR.
|