In-cluster registry: GitHub-free deploy path #168

New issue

Open

opened 2026-05-28 11:57:39 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-28 11:57:39 +00:00

Owner

Context

Backend (and the other deployable repos) deployed via GitHub Actions joining the tailnet over OIDC, then tailscale ssh deploy@kai-server to sideload images. That path broke when the May 26 Tailscale stack-merge recreated the per-repo federated identities without re-syncing TS_CLIENT_ID/TS_AUDIENCE to GitHub.

Direction (from Kai): GitHub should never join the tailnet. All TS_* secrets have been stripped from backend, eco-jobs-tracker, galaxy-gen, personal-dashboard, repo-recall. Deploys move to the in-cluster Forgejo runner pushing to an in-cluster registry.

This issue

Stand up an in-cluster OCI registry as the build->deploy bridge.

deploy/registry.yml - registry:2, namespace registry, NodePort 192.168.0.194:30500, applied + healthy
deploy/forgejo-runner.yml - DinD --insecure-registry, applied + both runner pods healthy
docs/k3s-deploy-notes.md section 11 - bring-up runbook
host-root: /etc/rancher/k3s/registries.yaml insecure entry + k3s restart on kai-server (dispatched as o2r agent-channel task Q9WR)
verify plain-http push + pull round-trip
per-repo: .forgejo/workflows/build-publish-deploy.yml, deployer ServiceAccount/RBAC + kubeconfig secret, deploy-manifest image ref, remove dead .github/workflows/build-and-publish.yml (backend first, then the other 4)
tear down the now-orphaned tailscale_federated_identity.ci + repos.yaml in terraform/tailscale/

## Context Backend (and the other deployable repos) deployed via GitHub Actions joining the tailnet over OIDC, then `tailscale ssh deploy@kai-server` to sideload images. That path broke when the May 26 Tailscale stack-merge recreated the per-repo federated identities without re-syncing `TS_CLIENT_ID`/`TS_AUDIENCE` to GitHub. Direction (from Kai): **GitHub should never join the tailnet.** All `TS_*` secrets have been stripped from backend, eco-jobs-tracker, galaxy-gen, personal-dashboard, repo-recall. Deploys move to the in-cluster Forgejo runner pushing to an in-cluster registry. ## This issue Stand up an in-cluster OCI registry as the build->deploy bridge. - [x] `deploy/registry.yml` - registry:2, namespace `registry`, NodePort `192.168.0.194:30500`, applied + healthy - [x] `deploy/forgejo-runner.yml` - DinD `--insecure-registry`, applied + both runner pods healthy - [x] `docs/k3s-deploy-notes.md` section 11 - bring-up runbook - [ ] host-root: `/etc/rancher/k3s/registries.yaml` insecure entry + k3s restart on kai-server (dispatched as o2r agent-channel task Q9WR) - [ ] verify plain-http push + pull round-trip - [ ] per-repo: `.forgejo/workflows/build-publish-deploy.yml`, deployer ServiceAccount/RBAC + kubeconfig secret, deploy-manifest image ref, remove dead `.github/workflows/build-and-publish.yml` (backend first, then the other 4) - [ ] tear down the now-orphaned `tailscale_federated_identity.ci` + `repos.yaml` in `terraform/tailscale/`

coilysiren referenced this issue

2026-05-28 11:58:59 +00:00

Stand up in-cluster registry foundation #169

coilysiren referenced this issue

2026-05-28 12:31:47 +00:00

k3s systemd Type=notify never signals READY restart blocks forever #170

coilysiren referenced this issue

2026-05-28 12:31:47 +00:00

registries.yaml only on kai-server, not fleet-wide #171

coilysiren referenced this issue from coilyco-gaming/galaxy-gen

2026-05-28 12:41:20 +00:00

Migrate deploy off GitHub Actions to Forgejo + in-cluster registry #17