Andreas Niemann
cfa71847ba
A separate, isolated Pulumi project (peer to bootstrap/provision/offsite-backup) that provisions runner VM(s) on a libvirt host and registers Forgejo Actions runners with a distinct `fenced` label — so ecosystem/untrusted jobs run OFF the forge VM. Decoupled ON PURPOSE: a @pulumi/libvirt provider dials the runner host on every up/refresh, so keeping it in `bootstrap` would make the foundation undeployable/ unrefreshable whenever the host (crunchy01) is down or unreachable (the Terraform coupling trap). As its own stack, bootstrap never imports it — foundation ops never touch crunchy01, and this stack's health is independent. One-way dependency: it mints a runner token FROM the forge, i.e. runs after the foundation stands. Codifies what was built + hardened by hand this session (runners/README.md): Ubuntu VM on the LAN bridge (docker + qemu-guest-agent via cloud-init), the kube-router-proof FORWARD timer, and runner registration. Typechecked; the live `pulumi up` cutover from the hand-built VM is the remaining validation step. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
16 lines
475 B
JSON
16 lines
475 B
JSON
{
|
|
"name": "@olsitec/foundation",
|
|
"private": true,
|
|
"version": "0.0.0",
|
|
"description": "olsitec-foundation mono-repo — the bootstrap egg (bootstrap/) + vendored shared Pulumi modules (packages/*). One git clone = the full DR unit (000_TOPOLOGY.md, ADR-005).",
|
|
"workspaces": [
|
|
"packages/*",
|
|
"bootstrap",
|
|
"provision",
|
|
"offsite-backup",
|
|
"runners"
|
|
],
|
|
"devDependencies": {
|
|
"typescript": "^5.0.0"
|
|
}
|
|
}
|