221 lines
7.8 KiB
Bash
Executable File
221 lines
7.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Create a Flatcar VM on Proxmox and bootstrap a Docker-based Gitea Actions runner.
|
|
# Run this on the Proxmox host as root.
|
|
set -Eeuo pipefail
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
Usage:
|
|
VM_ID=9100 \
|
|
GITEA_INSTANCE_URL=https://gitea.example.com \
|
|
GITEA_RUNNER_REGISTRATION_TOKEN='token' \
|
|
SSH_PUBLIC_KEY="$(cat ~/.ssh/id_ed25519.pub)" \
|
|
./create-flatcar-gitea-runner.sh
|
|
|
|
Required environment variables:
|
|
VM_ID Proxmox VM ID that does not already exist
|
|
GITEA_INSTANCE_URL Gitea URL, including scheme
|
|
GITEA_RUNNER_REGISTRATION_TOKEN Repository, organization, or instance token
|
|
SSH_PUBLIC_KEY SSH public key for the Flatcar core user
|
|
|
|
Optional environment variables:
|
|
VM_NAME VM name, default flatcar-gitea-runner
|
|
CORES CPU cores, default 4
|
|
MEMORY_MB Memory in MiB, default 16384
|
|
DISK_SIZE Final disk size, default 100G
|
|
BRIDGE Proxmox bridge, default vmbr0
|
|
DISK_STORAGE Storage for the VM disk, default local-lvm
|
|
CLOUDINIT_STORAGE Storage for the Cloud-Init drive, default local-lvm
|
|
SNIPPET_STORAGE Proxmox storage containing snippets, default local
|
|
SNIPPET_DIR Host snippet directory, default /var/lib/vz/snippets
|
|
FLATCAR_IMAGE_URL Flatcar image URL, default Stable amd64 current image
|
|
FLATCAR_IMAGE_SHA256 Optional expected SHA256 for the downloaded image
|
|
IMAGE_CACHE_DIR Host image cache, default /var/lib/vz/template/cache
|
|
GITEA_RUNNER_NAME Runner name, default flatcar-gitea-runner-VM_ID
|
|
GITEA_RUNNER_LABELS Runner labels, default ubuntu-latest:docker://node:20-bookworm
|
|
GITEA_RUNNER_IMAGE Runner image, default docker.io/gitea/act_runner:latest
|
|
|
|
The script uses DHCP for the VM network. The generated VM receives an Ignition
|
|
configuration through Proxmox's user-data snippet mechanism. Do not reuse the
|
|
snippet file or VM disk without removing the registration token first.
|
|
EOF
|
|
}
|
|
|
|
die() {
|
|
echo "ERROR: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
require_command() {
|
|
command -v "$1" >/dev/null 2>&1 || die "required command not found: $1"
|
|
}
|
|
|
|
[[ "${1:-}" != "--help" && "${1:-}" != "-h" ]] || { usage; exit 0; }
|
|
|
|
[[ "$(id -u)" -eq 0 ]] || die "run this script as root on the Proxmox host"
|
|
|
|
for command_name in qm pvesm curl sha256sum jq; do
|
|
require_command "$command_name"
|
|
done
|
|
|
|
: "${VM_ID:?VM_ID is required}"
|
|
: "${GITEA_INSTANCE_URL:?GITEA_INSTANCE_URL is required}"
|
|
: "${GITEA_RUNNER_REGISTRATION_TOKEN:?GITEA_RUNNER_REGISTRATION_TOKEN is required}"
|
|
: "${SSH_PUBLIC_KEY:?SSH_PUBLIC_KEY is required}"
|
|
|
|
VM_NAME="${VM_NAME:-flatcar-gitea-runner}"
|
|
CORES="${CORES:-4}"
|
|
MEMORY_MB="${MEMORY_MB:-16384}"
|
|
DISK_SIZE="${DISK_SIZE:-100G}"
|
|
BRIDGE="${BRIDGE:-vmbr0}"
|
|
DISK_STORAGE="${DISK_STORAGE:-local-lvm}"
|
|
CLOUDINIT_STORAGE="${CLOUDINIT_STORAGE:-local-lvm}"
|
|
SNIPPET_STORAGE="${SNIPPET_STORAGE:-local}"
|
|
SNIPPET_DIR="${SNIPPET_DIR:-/var/lib/vz/snippets}"
|
|
FLATCAR_IMAGE_URL="${FLATCAR_IMAGE_URL:-https://stable.release.flatcar-linux.net/amd64-usr/current/flatcar_production_proxmoxve_image.img}"
|
|
IMAGE_CACHE_DIR="${IMAGE_CACHE_DIR:-/var/lib/vz/template/cache}"
|
|
GITEA_RUNNER_NAME="${GITEA_RUNNER_NAME:-flatcar-gitea-runner-${VM_ID}}"
|
|
GITEA_RUNNER_LABELS="${GITEA_RUNNER_LABELS:-ubuntu-latest:docker://node:20-bookworm}"
|
|
GITEA_RUNNER_IMAGE="${GITEA_RUNNER_IMAGE:-docker.io/gitea/act_runner:latest}"
|
|
|
|
[[ "$VM_ID" =~ ^[0-9]+$ ]] || die "VM_ID must be numeric"
|
|
[[ "$CORES" =~ ^[0-9]+$ ]] || die "CORES must be numeric"
|
|
[[ "$MEMORY_MB" =~ ^[0-9]+$ ]] || die "MEMORY_MB must be numeric"
|
|
[[ "$GITEA_INSTANCE_URL" =~ ^https?:// ]] || die "GITEA_INSTANCE_URL must begin with http:// or https://"
|
|
|
|
if qm status "$VM_ID" >/dev/null 2>&1; then
|
|
die "VM $VM_ID already exists; choose another VM_ID"
|
|
fi
|
|
|
|
storage_config="$(pvesm config "$SNIPPET_STORAGE" 2>/dev/null || true)"
|
|
grep -Eq '(^|,)snippets(,|$)' <<<"$storage_config" || die "storage $SNIPPET_STORAGE is not configured for snippets. Enable it with: pvesm set $SNIPPET_STORAGE --content snippets"
|
|
|
|
mkdir -p "$SNIPPET_DIR" "$IMAGE_CACHE_DIR"
|
|
chmod 0750 "$SNIPPET_DIR"
|
|
|
|
work_dir="$(mktemp -d /tmp/flatcar-runner.XXXXXX)"
|
|
cleanup() {
|
|
rm -rf "$work_dir"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
image_path="$IMAGE_CACHE_DIR/$(basename "$FLATCAR_IMAGE_URL")"
|
|
snippet_name="flatcar-gitea-runner-${VM_ID}-user-data"
|
|
snippet_path="$SNIPPET_DIR/$snippet_name"
|
|
|
|
if [[ -s "$image_path" ]]; then
|
|
echo "Using cached Flatcar image: $image_path"
|
|
else
|
|
echo "Downloading Flatcar image: $FLATCAR_IMAGE_URL"
|
|
curl --fail --location --retry 3 --output "$image_path.partial" "$FLATCAR_IMAGE_URL"
|
|
mv "$image_path.partial" "$image_path"
|
|
fi
|
|
|
|
if [[ -n "${FLATCAR_IMAGE_SHA256:-}" ]]; then
|
|
echo "Checking Flatcar image SHA256"
|
|
printf '%s %s\n' "$FLATCAR_IMAGE_SHA256" "$image_path" | sha256sum --check --strict -
|
|
fi
|
|
|
|
runner_env="$work_dir/runner.env"
|
|
cat >"$runner_env" <<EOF
|
|
GITEA_INSTANCE_URL=$GITEA_INSTANCE_URL
|
|
GITEA_RUNNER_REGISTRATION_TOKEN=$GITEA_RUNNER_REGISTRATION_TOKEN
|
|
GITEA_RUNNER_NAME=$GITEA_RUNNER_NAME
|
|
GITEA_RUNNER_LABELS=$GITEA_RUNNER_LABELS
|
|
EOF
|
|
|
|
runner_unit="$work_dir/gitea-runner.service"
|
|
cat >"$runner_unit" <<EOF
|
|
[Unit]
|
|
Description=Gitea Actions runner container
|
|
After=docker.service
|
|
Requires=docker.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
EnvironmentFile=/var/lib/gitea-runner/runner.env
|
|
ExecStartPre=-/usr/bin/docker rm --force gitea-runner
|
|
ExecStart=/usr/bin/docker run --name gitea-runner --rm \\
|
|
--env GITEA_INSTANCE_URL \\
|
|
--env GITEA_RUNNER_REGISTRATION_TOKEN \\
|
|
--env GITEA_RUNNER_NAME \\
|
|
--env GITEA_RUNNER_LABELS \\
|
|
--env-file /var/lib/gitea-runner/runner.env \\
|
|
--volume /var/run/docker.sock:/var/run/docker.sock \\
|
|
--volume /var/lib/gitea-runner:/data \\
|
|
$GITEA_RUNNER_IMAGE
|
|
ExecStop=/usr/bin/docker stop --time 30 gitea-runner
|
|
Restart=always
|
|
RestartSec=10s
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
jq -n \
|
|
--arg ssh_key "$SSH_PUBLIC_KEY" \
|
|
--arg hostname "$VM_NAME" \
|
|
--rawfile runner_env "$runner_env" \
|
|
--rawfile runner_unit "$runner_unit" \
|
|
'{
|
|
ignition: {version: "3.3.0"},
|
|
storage: {
|
|
directories: [
|
|
{path: "/var/lib/gitea-runner", mode: 448}
|
|
],
|
|
files: [
|
|
{path: "/etc/hostname", mode: 420, contents: {source: ("data:text/plain;charset=utf-8," + ($hostname | @uri))}},
|
|
{path: "/var/lib/gitea-runner/runner.env", mode: 384, user: {name: "root"}, group: {name: "root"}, contents: {source: ("data:text/plain;charset=utf-8," + ($runner_env | @uri))}}
|
|
]
|
|
},
|
|
systemd: {
|
|
units: [
|
|
{name: "docker.service", enabled: true},
|
|
{name: "gitea-runner.service", enabled: true, contents: $runner_unit}
|
|
]
|
|
},
|
|
passwd: {users: [{name: "core", sshAuthorizedKeys: [$ssh_key]}]}
|
|
}' >"$snippet_path"
|
|
|
|
chmod 0600 "$snippet_path"
|
|
|
|
echo "Creating Proxmox VM $VM_ID"
|
|
qm create "$VM_ID" \
|
|
--name "$VM_NAME" \
|
|
--ostype l26 \
|
|
--cores "$CORES" \
|
|
--memory "$MEMORY_MB" \
|
|
--net0 "virtio,bridge=$BRIDGE" \
|
|
--ipconfig0 ip=dhcp \
|
|
--agent enabled=1 \
|
|
--onboot 1 \
|
|
--scsihw virtio-scsi-single
|
|
|
|
qm disk import "$VM_ID" "$image_path" "$DISK_STORAGE"
|
|
qm set "$VM_ID" --scsi0 "$DISK_STORAGE:vm-${VM_ID}-disk-0"
|
|
qm resize "$VM_ID" scsi0 "$DISK_SIZE"
|
|
qm set "$VM_ID" --boot order=scsi0
|
|
qm set "$VM_ID" --ide2 "$CLOUDINIT_STORAGE:cloudinit"
|
|
qm set "$VM_ID" --cicustom "user=${SNIPPET_STORAGE}:snippets/${snippet_name}"
|
|
|
|
echo "Starting VM $VM_ID"
|
|
qm start "$VM_ID"
|
|
|
|
cat <<EOF
|
|
|
|
Flatcar Gitea runner VM created.
|
|
|
|
VM ID: $VM_ID
|
|
VM name: $VM_NAME
|
|
Runner name: $GITEA_RUNNER_NAME
|
|
Image: $FLATCAR_IMAGE_URL
|
|
Snippet: $snippet_path
|
|
|
|
Check the VM console or DHCP lease, then verify:
|
|
ssh core@<vm-ip> 'systemctl status docker gitea-runner --no-pager'
|
|
ssh core@<vm-ip> 'docker ps'
|
|
|
|
Security note: the runner mounts /var/run/docker.sock so workflow jobs can
|
|
launch Docker containers. Treat this VM as a dedicated CI trust boundary.
|
|
EOF
|