add CF Access service token for Gitea Actions runner

The Gitea CI runners need to authenticate to git.neuralplatform.ai through Cloudflare Access without going through Google OAuth. Add a non-identity service token Will can attach to the existing dashboard-managed Gitea Access application via a Service Auth policy. The application itself stays dashboard-managed for now to avoid drifting the human-auth policy that's already working. The token id goes to Vault at secret/gitea-runner-cf-access where ESO picks it up into the runner secret.
2026-05-04 16:14:42 -05:00
9 changed files with 203 additions and 168 deletions
@@ -0,0 +1,165 @@
+---
+# Gitea CI runner — general-purpose (legion)
+# Uses host Docker socket for container management and docker build/push.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea-runner
+  namespace: ci
+  labels:
+    app: gitea-runner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea-runner
+  template:
+    metadata:
+      labels:
+        app: gitea-runner
+      annotations:
+        config-version: "2026-04-27-containerd-sock"
+    spec:
+      securityContext:
+        runAsNonRoot: false  # act_runner needs root for container management
+      initContainers:
+        - name: register
+          image: registry.neuralplatform.ai/ci-base:latest
+          workingDir: /data
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              act_runner register \
+                --instance "$GITEA_INSTANCE_URL" \
+                --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
+                --name legion \
+                --labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
+                --no-interactive
+              cat > /data/config.yaml << 'EOF'
+              runner:
+                capacity: 2
+                timeout: 3h
+              container:
+                network: host
+                docker_host: "unix:///run/k3s/containerd/containerd.sock"
+                force_pull: false
+                valid_volumes: []
+                default_image: "registry.neuralplatform.ai/ci-base:latest"
+                extra_hosts:
+                  - "gitea.git.svc.cluster.local:10.43.1.53"
+              EOF
+          envFrom:
+            - secretRef:
+                name: gitea-runner-secret
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      containers:
+        - name: runner
+          image: registry.neuralplatform.ai/ci-base:latest
+          workingDir: /data
+          command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
+          envFrom:
+            - secretRef:
+                name: gitea-runner-secret
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
+          resources:
+            requests:
+              memory: 512Mi
+              cpu: 250m
+            limits:
+              memory: 4Gi
+              cpu: "4"
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: docker-sock
+          hostPath:
+            path: /run/k3s/containerd/containerd.sock
+            type: Socket
+---
+# Neuron Technologies CI runner
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: neuron-technologies-runner
+  namespace: ci
+  labels:
+    app: neuron-technologies-runner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: neuron-technologies-runner
+  template:
+    metadata:
+      labels:
+        app: neuron-technologies-runner
+      annotations:
+        config-version: "2026-04-27-containerd-sock"
+    spec:
+      securityContext:
+        runAsNonRoot: false
+      initContainers:
+        - name: register
+          image: registry.neuralplatform.ai/ci-base:latest
+          workingDir: /data
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              act_runner register \
+                --instance "$GITEA_INSTANCE_URL" \
+                --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
+                --name neuron-technologies \
+                --labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
+                --no-interactive
+              cat > /data/config.yaml << 'EOF'
+              runner:
+                capacity: 2
+                timeout: 3h
+              container:
+                network: host
+                docker_host: "unix:///run/k3s/containerd/containerd.sock"
+                force_pull: false
+                valid_volumes: []
+                default_image: "registry.neuralplatform.ai/ci-base:latest"
+                extra_hosts:
+                  - "gitea.git.svc.cluster.local:10.43.1.53"
+              EOF
+          envFrom:
+            - secretRef:
+                name: neuron-technologies-runner-secret
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      containers:
+        - name: runner
+          image: registry.neuralplatform.ai/ci-base:latest
+          workingDir: /data
+          command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
+          envFrom:
+            - secretRef:
+                name: neuron-technologies-runner-secret
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
+          resources:
+            requests:
+              memory: 512Mi
+              cpu: 250m
+            limits:
+              memory: 4Gi
+              cpu: "4"
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: docker-sock
+          hostPath:
+            path: /run/k3s/containerd/containerd.sock
+            type: Socket
@@ -23,16 +23,3 @@ resource "cloudflare_record" "np_web_stage" {
  proxied = true
  ttl     = 1
 }
-
-# vault.neuralplatform.ai — GCE Raft HA Vault cluster via GCP Global HTTPS LB.
-# DNS-only (not proxied) — GCP managed TLS cert terminates at the LB.
-# Vault nodes listen on plain HTTP 8200 internally; LB does TLS.
-# IP: terraform output vault_lb_ip from servers/gcp workspace = 34.54.164.21
-resource "cloudflare_record" "np_vault" {
-  zone_id = local.zone_neuralplatform_ai
-  name    = "vault"
-  type    = "A"
-  content = "34.54.164.21"
-  proxied = false
-  ttl     = 60
-}
@@ -85,15 +85,3 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
    && apt-get update \
    && apt-get install -y --no-install-recommends gh \
    && rm -rf /var/lib/apt/lists/*
-
-# Cloudflare Access bootstrap for git clones to git.neuralplatform.ai.
-# This script is sourced by bash in build containers via BASH_ENV (set by
-# act_runner's container.env in deployment.yaml) so it runs before every
-# step. It configures git insteadOf + CF Access extraHeaders from
-# CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET env vars.
-#
-# We deliberately don't set ENTRYPOINT / CMD here — act_runner spawns
-# build containers with its own entrypoint to keep them alive between
-# steps, and overriding it breaks job execution.
-COPY git-cf-access-init.sh /usr/local/bin/git-cf-access-init.sh
-RUN chmod +x /usr/local/bin/git-cf-access-init.sh
@@ -8,7 +8,7 @@ metadata:
  labels:
    app: gitea-runner
  annotations:
-    config-version: "2026-05-04-cf-access-public-url"
+    config-version: "2026-05-04-docker-sock-fix"
 spec:
  replicas: 1
  selector:
@@ -19,7 +19,7 @@ spec:
      labels:
        app: gitea-runner
      annotations:
-        config-version: "2026-05-04-cf-access-public-url"
+        config-version: "2026-05-04-docker-sock-fix"
    spec:
      securityContext:
        runAsNonRoot: false
@@ -35,7 +35,7 @@ spec:
                --name legion \
                --labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
                --no-interactive
-              cat > /data/config.yaml << EOF
+              cat > /data/config.yaml << 'EOF'
              runner:
                capacity: 2
                timeout: 3h
@@ -45,16 +45,6 @@ spec:
                force_pull: false
                valid_volumes: []
                default_image: "registry.neuralplatform.ai/ci-base:latest"
-                # Build containers run with network: host. The in-cluster
-                # gitea name does not resolve there, so we redirect git
-                # operations to https://git.neuralplatform.ai using CF
-                # Access service-token headers. BASH_ENV makes bash source
-                # /usr/local/bin/git-cf-access-init.sh before every step,
-                # which sets up the redirect + headers.
-                env:
-                  CF_ACCESS_CLIENT_ID: "${CF_ACCESS_CLIENT_ID}"
-                  CF_ACCESS_CLIENT_SECRET: "${CF_ACCESS_CLIENT_SECRET}"
-                  BASH_ENV: "/usr/local/bin/git-cf-access-init.sh"
                extra_hosts:
                  - "gitea.git.svc.cluster.local:10.43.1.53"
              EOF
@@ -102,7 +92,7 @@ metadata:
  labels:
    app: neuron-technologies-runner
  annotations:
-    config-version: "2026-05-04-cf-access-public-url"
+    config-version: "2026-05-04-docker-sock-fix"
 spec:
  replicas: 2
  selector:
@@ -113,7 +103,7 @@ spec:
      labels:
        app: neuron-technologies-runner
      annotations:
-        config-version: "2026-05-04-cf-access-public-url"
+        config-version: "2026-05-04-docker-sock-fix"
    spec:
      securityContext:
        runAsNonRoot: false
@@ -129,7 +119,7 @@ spec:
                --name "legion-nt-$(hostname)" \
                --labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
                --no-interactive
-              cat > /data/config.yaml << EOF
+              cat > /data/config.yaml << 'EOF'
              runner:
                capacity: 2
                timeout: 3h
@@ -139,16 +129,6 @@ spec:
                force_pull: false
                valid_volumes: []
                default_image: "registry.neuralplatform.ai/ci-base:latest"
-                # Build containers run with network: host. The in-cluster
-                # gitea name does not resolve there, so we redirect git
-                # operations to https://git.neuralplatform.ai using CF
-                # Access service-token headers. BASH_ENV makes bash source
-                # /usr/local/bin/git-cf-access-init.sh before every step,
-                # which sets up the redirect + headers.
-                env:
-                  CF_ACCESS_CLIENT_ID: "${CF_ACCESS_CLIENT_ID}"
-                  CF_ACCESS_CLIENT_SECRET: "${CF_ACCESS_CLIENT_SECRET}"
-                  BASH_ENV: "/usr/local/bin/git-cf-access-init.sh"
                extra_hosts:
                  - "gitea.git.svc.cluster.local:10.43.1.53"
              EOF
@@ -1,20 +1,12 @@
 ---
 # gitea-runner-secret — neural-platform org runner token
-#
-# GITEA_INSTANCE_URL stays as the in-cluster URL — the act_runner daemon
-# polls it constantly and we don't want every poll to hit Cloudflare Access.
-# Build containers, however, need the public URL because they run with
-# network: host and can't resolve gitea.git.svc.cluster.local. The
-# git-cf-access-init.sh entrypoint in the ci-base image rewrites the
-# in-cluster URL to https://git.neuralplatform.ai with the CF Access
-# headers from CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET below.
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
  name: gitea-runner-secret
  namespace: ci
  annotations:
-    force-sync: "2026-05-04-cf-access"
+    force-sync: "2026-04-23"
 spec:
  refreshInterval: 1h
  secretStoreRef:
@@ -27,21 +19,11 @@ spec:
      data:
        GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
        GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
-        CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
-        CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
  data:
    - secretKey: runner_token
      remoteRef:
        key: secret/data/gitea
        property: runner_token
-    - secretKey: cf_access_client_id
-      remoteRef:
-        key: secret/data/gitea-runner-cf-access
-        property: client_id
-    - secretKey: cf_access_client_secret
-      remoteRef:
-        key: secret/data/gitea-runner-cf-access
-        property: client_secret
 ---
 # neuron-technologies-runner-secret — neuron-technologies org runner token
 apiVersion: external-secrets.io/v1beta1
@@ -49,8 +31,6 @@ kind: ExternalSecret
 metadata:
  name: neuron-technologies-runner-secret
  namespace: ci
-  annotations:
-    force-sync: "2026-05-04-cf-access"
 spec:
  refreshInterval: 1h
  secretStoreRef:
@@ -63,18 +43,8 @@ spec:
      data:
        GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
        GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
-        CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
-        CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
  data:
    - secretKey: runner_token
      remoteRef:
        key: secret/data/gitea
        property: neuron_technologies_runner_token
-    - secretKey: cf_access_client_id
-      remoteRef:
-        key: secret/data/gitea-runner-cf-access
-        property: client_id
-    - secretKey: cf_access_client_secret
-      remoteRef:
-        key: secret/data/gitea-runner-cf-access
-        property: client_secret
@@ -1,50 +0,0 @@
-#!/bin/sh
-# git-cf-access-init.sh
-#
-# Configures git so any clone/fetch from Gitea ends up going to
-# git.neuralplatform.ai with the runner's Cloudflare Access service-token
-# headers attached.
-#
-# How this gets invoked:
-#   The forgejo-runner job execution path runs each step via a
-#   non-interactive bash invocation inside the build container. Setting
-#   BASH_ENV=/usr/local/bin/git-cf-access-init.sh in act_runner's
-#   container.env causes bash to source this script before any step's
-#   commands run. (See servers/legion/k8s/gitea-runner/deployment.yaml.)
-#
-# What it does:
-#   1. Rewrites http://gitea.git.svc.cluster.local:3000/ → https://git.neuralplatform.ai/
-#      via insteadOf. The runner registered against the in-cluster URL (no
-#      CF Access on the daemon's polling loop), so act_runner advertises
-#      that URL to the build container as github.server_url. Build
-#      containers run with network: host and can't resolve
-#      *.svc.cluster.local, so we need to redirect to the public URL.
-#   2. Adds the CF Access service-token headers to outbound requests to
-#      git.neuralplatform.ai so the clone authenticates through CF Access.
-#
-# Idempotent — re-runs replace any prior config keys without accumulating
-# duplicate header entries.
-#
-# Known limitation: actions/checkout sets an Authorization extraheader
-# keyed to the server URL it was given (the in-cluster URL). After
-# insteadOf substitution the request goes to the public URL where git
-# matches http.<public>.extraheader, and the in-cluster-keyed
-# Authorization header is dropped. For public repos this is fine. For
-# private repos the per-job token will not be sent — see the PR
-# description for the follow-up plan if dharma-el's CI needs that token.
-
-if [ -n "${CF_ACCESS_CLIENT_ID:-}" ] && [ -n "${CF_ACCESS_CLIENT_SECRET:-}" ]; then
-    git config --global --replace-all \
-        url."https://git.neuralplatform.ai/".insteadOf \
-        "http://gitea.git.svc.cluster.local:3000/" 2>/dev/null || true
-
-    # Reset extraHeader on the public URL, then add both CF Access headers.
-    git config --global --unset-all \
-        http."https://git.neuralplatform.ai/".extraHeader 2>/dev/null || true
-    git config --global --add \
-        http."https://git.neuralplatform.ai/".extraHeader \
-        "CF-Access-Client-Id: ${CF_ACCESS_CLIENT_ID}" 2>/dev/null || true
-    git config --global --add \
-        http."https://git.neuralplatform.ai/".extraHeader \
-        "CF-Access-Client-Secret: ${CF_ACCESS_CLIENT_SECRET}" 2>/dev/null || true
-fi
@@ -82,12 +82,7 @@ spec:
    apiVersion: apps/v1
    kind: Deployment
    name: neuron-marketing
-  # minReplicas=1 to match the file's own convention (see header comment).
-  # Kubernetes only allows minReplicas=0 when at least one Object or External
-  # metric is configured (queue depth, custom signal, etc.); with only a
-  # Resource (CPU) metric, scale-to-zero is rejected and the whole HPA is
-  # invalid — which was blocking neuron-prod's Argo CD sync.
-  minReplicas: 1
+  minReplicas: 0
  maxReplicas: 8
  metrics:
    - type: Resource
@@ -117,32 +117,6 @@ spec:
            matchLabels:
              kubernetes.io/metadata.name: neuron-prod
 ---
-# ── dharma: accept from Traefik (kube-system) and neuron-prod namespace ──────
-# The dharma pod was healthy and the IngressRoute was correct, but cross-
-# namespace ingress from kube-system (Traefik) was denied by default-deny-all,
-# so every external request landed at Traefik and bounced back as 502. This
-# allow rule mirrors `allow-mcp-ingress` and brings dharma into line with the
-# other neuron-prod services.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-dharma-ingress
-  namespace: neuron-prod
-spec:
-  podSelector:
-    matchLabels:
-      app: dharma
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: neuron-prod
---
 # ── Egress: all prod pods may reach platform (postgres/redis), vault,
 #            monitoring (alloy OTLP), kube-dns, and the internet (external APIs) ─
 apiVersion: networking.k8s.io/v1
@@ -92,11 +92,37 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
      }
    }

-    # vault.neuralplatform.ai — moved to GCP Global HTTPS LB (34.54.164.21)
-    # DNS is now a direct A record (not proxied) in dns-neuralplatform.tf
+    ingress_rule {
+      hostname = "vault.neuralplatform.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }

-    # watch.nook.family, jellyfin.nook.family, bazarr.nook.family — removed
-    # This infrastructure is focused on Neuron; nook.family media stack retired
+    ingress_rule {
+      hostname = "watch.nook.family"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    ingress_rule {
+      hostname = "jellyfin.nook.family"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    ingress_rule {
+      hostname = "bazarr.nook.family"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }


    # fornax.neuralplatform.ai — Fornax torrent coordinator (qBittorrent API proxy)