joshbairstow/jb-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
8 commits 1 branch 0 tags 102 KiB
Commit graph

8 commits

This branch
This branch
All branches
Author SHA1 Message Date
Josh Bairstow
5bb124acfd docs: rsync prod compose to VPS; clarify package vs repo visibility 
Repo-public does not imply package-public in Forgejo (packages are
owner-scoped, created on first push). Add verify-then-fix guidance.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-02 23:33:20 +10:00
Josh Bairstow
ef24f96b14 docs: define every Actions variable/secret in step 6 
REGISTRY_USER/OWNER, REGISTRY_TOKEN, DEPLOY_HOST/USER/SSH_KEY each spelled
out with what to store and why, plus deploy-keypair generation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-02 23:16:54 +10:00
Josh Bairstow
2979816ac7 fix(runner): point unit at /usr/local/sbin, gitignore bare .runner, fix step 5 
- ExecStart path matches the actual install location (/usr/local/sbin)
- .gitignore: bare '.runner' so the secret is ignored in any dir (was only runner/.runner)
- step 5: register inside ~/forgejo-runner (subshell), fix stray cd that broke
  the later 'cp runner/...' paths; note how to relocate a misplaced .runner

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-02 23:05:07 +10:00
Josh Bairstow
d02844366a feat(runner): add always-on systemd unit + wire into runbook step 5 
System service running as the desktop user (already in docker group); starts
at boot, auto-restarts, auto-claims queued jobs. WorkingDirectory under $HOME
because snap Docker can't read build contexts outside home. README step 5 now
covers binary install, registration, and enabling the service.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-02 22:42:52 +10:00
Josh Bairstow
74b1c3fcbb docs: add admin password-reset recipe; gitignore local secret notes 
- README maintenance: reset admin password via UI or 'forgejo admin
  user change-password' (no email/old password needed)
- .gitignore: secrets.local.md + *.local.secret so off-git credential
  backups can never be committed

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-02 22:12:11 +10:00
Josh Bairstow
7a3a8fb400 docs: replace clone placeholder with rsync bootstrap + flesh out Forgejo first-run 
- step 3: rsync files from desktop (Forgejo can't host its own bootstrap repo;
  VPS can't pull from a NAT'd desktop); note permanent Forgejo home + git bundle
- step 4: confirm Application URL / SSH domain+port / DB / RunAs=git, disable
  self-registration, create lowercase admin under Administrator Account Settings

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-02 17:55:44 +10:00
Josh Bairstow
75fabc864e docs: record live VPS details + DNS-at-Cloudflare caveat; add pre-flight script 
- scripts/check-vps.sh: read-only reachability/ports/SSH-facts/DNS checker
- README: real IPv4/IPv6 + Debian 13 + existing swap; firewall already on Vultr
- DNS is managed at Cloudflare (NS delegated), not VentraIP — records must be
  DNS-only (grey cloud) so Caddy issues real certs and port 222 works
- fix git remote to ssh:// form for the custom 222 port

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-02 16:13:45 +10:00
Josh Bairstow
76df80a26c chore: initial VPS edge stack (caddy-docker-proxy + Forgejo) 
Edge reverse proxy (TLS + label routing) and self-hosted Forgejo (git +
Actions + container registry) for joshbairstow.com, plus the desktop runner
config and the one-time bootstrap runbook.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-02 15:31:25 +10:00