Will Anderson
bec948bcca
The Gitea Actions runners on Legion need build containers to be able to clone repos. They run with network: host so they can't resolve gitea.git.svc.cluster.local — they have to use the public URL. The public URL sits behind Cloudflare Access, which is why the previous naive switch (#3) had to be reverted. This change keeps the runner daemon registered against the in-cluster URL (no CF Access on the polling loop) but rewrites http://gitea.git.svc.cluster.local:3000/ to https://git.neuralplatform.ai/ inside the build container, with the CF Access service-token headers injected via git extraHeader. The redirect script is sourced before every job step via BASH_ENV; the CF Access credentials reach the build container through act_runner's container.env, which we now populate from the new gitea-runner-cf-access Vault path that PR #5's Terraform writes. Known limitation documented in the init script: actions/checkout's per-job auth header is keyed to the in-cluster URL and gets dropped after the insteadOf rewrite. Public repos work; private repos that need that token will need a follow-up.
51 lines
2.5 KiB
Bash
51 lines
2.5 KiB
Bash
#!/bin/sh
|
|
# git-cf-access-init.sh
|
|
#
|
|
# Configures git so any clone/fetch from Gitea ends up going to
|
|
# git.neuralplatform.ai with the runner's Cloudflare Access service-token
|
|
# headers attached.
|
|
#
|
|
# How this gets invoked:
|
|
# The forgejo-runner job execution path runs each step via a
|
|
# non-interactive bash invocation inside the build container. Setting
|
|
# BASH_ENV=/usr/local/bin/git-cf-access-init.sh in act_runner's
|
|
# container.env causes bash to source this script before any step's
|
|
# commands run. (See servers/legion/k8s/gitea-runner/deployment.yaml.)
|
|
#
|
|
# What it does:
|
|
# 1. Rewrites http://gitea.git.svc.cluster.local:3000/ → https://git.neuralplatform.ai/
|
|
# via insteadOf. The runner registered against the in-cluster URL (no
|
|
# CF Access on the daemon's polling loop), so act_runner advertises
|
|
# that URL to the build container as github.server_url. Build
|
|
# containers run with network: host and can't resolve
|
|
# *.svc.cluster.local, so we need to redirect to the public URL.
|
|
# 2. Adds the CF Access service-token headers to outbound requests to
|
|
# git.neuralplatform.ai so the clone authenticates through CF Access.
|
|
#
|
|
# Idempotent — re-runs replace any prior config keys without accumulating
|
|
# duplicate header entries.
|
|
#
|
|
# Known limitation: actions/checkout sets an Authorization extraheader
|
|
# keyed to the server URL it was given (the in-cluster URL). After
|
|
# insteadOf substitution the request goes to the public URL where git
|
|
# matches http.<public>.extraheader, and the in-cluster-keyed
|
|
# Authorization header is dropped. For public repos this is fine. For
|
|
# private repos the per-job token will not be sent — see the PR
|
|
# description for the follow-up plan if dharma-el's CI needs that token.
|
|
|
|
if [ -n "${CF_ACCESS_CLIENT_ID:-}" ] && [ -n "${CF_ACCESS_CLIENT_SECRET:-}" ]; then
|
|
git config --global --replace-all \
|
|
url."https://git.neuralplatform.ai/".insteadOf \
|
|
"http://gitea.git.svc.cluster.local:3000/" 2>/dev/null || true
|
|
|
|
# Reset extraHeader on the public URL, then add both CF Access headers.
|
|
git config --global --unset-all \
|
|
http."https://git.neuralplatform.ai/".extraHeader 2>/dev/null || true
|
|
git config --global --add \
|
|
http."https://git.neuralplatform.ai/".extraHeader \
|
|
"CF-Access-Client-Id: ${CF_ACCESS_CLIENT_ID}" 2>/dev/null || true
|
|
git config --global --add \
|
|
http."https://git.neuralplatform.ai/".extraHeader \
|
|
"CF-Access-Client-Secret: ${CF_ACCESS_CLIENT_SECRET}" 2>/dev/null || true
|
|
fi
|