coilyco-flight-deck/infrastructure

Watch

deploy: add an in-cluster NuGet caching proxy for runner builds #571

New issue

Closed

opened 2026-07-22 06:42:44 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-22 06:42:44 +00:00

Member

Context

eco-app required image builds have reproduced the known flaky public NuGet egress failure from eco-app#69. Forgejo Actions run 105 reached the mod packaging stage, then dotnet restore timed out fetching https://api.nuget.org/v3/index.json with NU1301. The restore consumed about 10 minutes before failing.

The previous application-side retry mitigation was deliberately retired because it turned deterministic outages into 20 to 40 minute sinks. eco-app#110 moved the mod checks out of required CI, and eco-app#111 retained shared NuGet caching or proxying as the unresolved prerequisite for a trustworthy required path. The new container-native mod packaging work makes that prerequisite concrete.

Related evidence:

eco-app#69 - original flaky NuGet egress mitigation
eco-app#110 - mod checks moved to a manual diagnostic workflow
eco-app#111 - durable required-CI design follow-up
eco-app#141 - current image-build and package-publish blocker
Forgejo Actions run 105, build-image task 14518 - NU1301 service-index timeout before any per-mod publish job started

Required outcome

Deploy a stable internal NuGet v3 caching proxy or mirror that the Forgejo Docker and Docker-build runner lanes can reach from job containers and DinD builds. The proxy should cache upstream nuget.org packages and remove direct public-feed availability from the critical restore path after the cache is warm.

Follow the existing runner deployment precedent. Keep endpoint and cluster deployment knowledge in infrastructure. eco-app can add the smallest consumer-side NuGet.Config change once the stable logical feed endpoint exists.

Acceptance

A source-controlled deployment and runbook define the NuGet proxy, persistence, upstream, resource limits, and recovery behavior.
Forgejo general and image-build runner jobs can restore through the internal NuGet v3 endpoint.
An operator verifies the service from the live runner and DinD execution paths.
eco-app run 105-equivalent completes build-image, then all four independent mod publish jobs run.
Required CI does not use retry loops to hide public NuGet timeouts.
The live verification result is recorded before eco-app#141 closes.

## Context eco-app required image builds have reproduced the known flaky public NuGet egress failure from eco-app#69. Forgejo Actions run 105 reached the mod packaging stage, then `dotnet restore` timed out fetching `https://api.nuget.org/v3/index.json` with NU1301. The restore consumed about 10 minutes before failing. The previous application-side retry mitigation was deliberately retired because it turned deterministic outages into 20 to 40 minute sinks. eco-app#110 moved the mod checks out of required CI, and eco-app#111 retained shared NuGet caching or proxying as the unresolved prerequisite for a trustworthy required path. The new container-native mod packaging work makes that prerequisite concrete. Related evidence: * eco-app#69 - original flaky NuGet egress mitigation * eco-app#110 - mod checks moved to a manual diagnostic workflow * eco-app#111 - durable required-CI design follow-up * eco-app#141 - current image-build and package-publish blocker * Forgejo Actions run 105, build-image task 14518 - NU1301 service-index timeout before any per-mod publish job started ## Required outcome Deploy a stable internal NuGet v3 caching proxy or mirror that the Forgejo Docker and Docker-build runner lanes can reach from job containers and DinD builds. The proxy should cache upstream nuget.org packages and remove direct public-feed availability from the critical restore path after the cache is warm. Follow the existing runner deployment precedent. Keep endpoint and cluster deployment knowledge in infrastructure. eco-app can add the smallest consumer-side `NuGet.Config` change once the stable logical feed endpoint exists. ## Acceptance * A source-controlled deployment and runbook define the NuGet proxy, persistence, upstream, resource limits, and recovery behavior. * Forgejo general and image-build runner jobs can restore through the internal NuGet v3 endpoint. * An operator verifies the service from the live runner and DinD execution paths. * eco-app run 105-equivalent completes `build-image`, then all four independent mod publish jobs run. * Required CI does not use retry loops to hide public NuGet timeouts. * The live verification result is recorded before eco-app#141 closes.

coilyco-ops added the

autonomy

live-collab

label

2026-07-22 06:42:50 +00:00

coilyco-ops referenced this issue from coilyco-gaming/eco-app

2026-07-22 06:43:05 +00:00

interactive: inspect repeated CI image-build failure #141

coilyco-ops referenced this issue from coilyco-gaming/eco-app

2026-07-22 06:43:05 +00:00

Design a real required CI path for C# / NuGet checks #111

coilyco-ops referenced this issue

2026-07-22 06:51:19 +00:00

Add an allowlisted egress proxy for Forgejo Actions runner jobs #563

coilyco-ops commented

2026-07-22 06:51:33 +00:00

Author

Member

The canonical fix should diagnose and repair or proxy the general DinD egress path in #563. A dedicated NuGet cache can be reconsidered later for build performance, but it is not the first root-cause fix.

Closing as a duplicate of #563. The previously recorded Telegram curl-container test establishes the shared runner-network context: ordinary Kubernetes pods can reach the destination, while the Forgejo DinD path is destination-sensitive, with IPv6 unavailable and forced IPv4 stalling after TLS ClientHello. The new NuGet timeout is a second affected destination. The canonical fix should diagnose and repair or proxy the general DinD egress path in #563. A dedicated NuGet cache can be reconsidered later for build performance, but it is not the first root-cause fix.

coilyco-ops closed this issue

2026-07-22 06:51:40 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#571

No description provided.

Rows
Columns