Will Anderson
c31edc8b83
Replaces the GCE VM runner with a k8s Deployment in the ci namespace on neuron-platform GKE. Uses Docker-in-Docker for build isolation since Autopilot doesn't expose the node socket. Runner token pulled from Secret Manager via ESO + Workload Identity. - servers/gcp/k8s/gitea-runner/: namespace, serviceaccount, external-secrets, deployment manifests (ci namespace, dind sidecar, idempotent registration) - servers/gcp/k8s/argocd-apps/gitea-runner-gke.yaml: Argo CD Application - servers/gcp/gitea-runner.tf: gitea-runner-gke GCP SA with secretAccessor on gitea-runner-token, Workload Identity binding for ci/gitea-runner, artifactregistry.reader for pulling ci-base image
infrastructure
Personal infrastructure-as-code for Legion (k3s home server) and supporting tooling.
| Doc | What it covers |
|---|---|
AGENTS.md |
Full reference: machines, secrets, services, domains, namespaces, common operations |
servers/legion/README.md |
What's running on Legion and how deployment works |
servers/legion/RUNBOOK.md |
Disaster recovery — full restore from scratch |
Quick start
cd servers/legion
direnv allow
terraform plan
terraform apply
Push to servers/ to deploy app changes via Argo CD.