From ab37879f089c87ebdc6086af1077222e7a061cc5 Mon Sep 17 00:00:00 2001 From: Henrik Jess Nielsen Date: Mon, 29 Jun 2026 16:15:06 +0200 Subject: [PATCH] Trying to have a chatservice --- .gitea/workflows/deploy.yml | 51 ++++++++++++ continuwuity.hcl | 150 ++++++++++++++++++++++++++++++++++++ 2 files changed, 201 insertions(+) create mode 100644 .gitea/workflows/deploy.yml create mode 100644 continuwuity.hcl diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml new file mode 100644 index 0000000..4f84de5 --- /dev/null +++ b/.gitea/workflows/deploy.yml @@ -0,0 +1,51 @@ +name: Deploy continuwuity to Nomad + +on: + push: + branches: [main] + paths: + - 'continuwuity.hcl' + - '.gitea/workflows/deploy.yml' + workflow_dispatch: + +jobs: + deploy: + name: nomad job run continuwuity + runs-on: debian-host + + env: + NOMAD_ADDR: ${{ secrets.NOMAD_ADDR }} + NOMAD_TOKEN: ${{ secrets.NOMAD_TOKEN }} + + steps: + - uses: actions/checkout@v4 + + - name: Check nomad CLI + run: | + if ! command -v nomad >/dev/null 2>&1; then + echo "❌ nomad CLI not found on the runner (debian-host). Install it on the runner host." + exit 1 + fi + nomad version + + - name: Validate job + run: nomad job validate continuwuity.hcl + + - name: Plan (diff, non-blocking) + run: | + # plan exit codes: 0 = no changes, 1 = changes will be made, anything else = error + set +e + nomad job plan continuwuity.hcl + code=$? + set -e + if [ "$code" -gt 1 ]; then + echo "❌ nomad job plan failed (exit $code)" + exit "$code" + fi + echo "✅ plan ok (exit $code)" + + - name: Run + run: nomad job run continuwuity.hcl + + - name: Status + run: nomad job status continuwuity diff --git a/continuwuity.hcl b/continuwuity.hcl new file mode 100644 index 0000000..71ca17d --- /dev/null +++ b/continuwuity.hcl @@ -0,0 +1,150 @@ +job "continuwuity" { + datacenters = ["dc1"] + type = "service" + node_pool = "default" + + group "continuwuity" { + count = 1 + + network { + port "http" { + static = 6167 + } + } + + service { + name = "continuwuity" + port = "http" + tags = [ + "traefik.enable=true", + + # --- Homeserver (client + federation API) on cn.i80.dk --- + "traefik.http.routers.continuwuity.rule=Host(`cn.i80.dk`)", + "traefik.http.routers.continuwuity.entrypoints=https", + "traefik.http.routers.continuwuity.tls=true", + # No certresolver: Traefik serves the *.i80.dk wildcard cert from /certs via SNI. + + # --- Delegation: server_name is i80.dk, so the apex must serve /.well-known/matrix/* --- + # MXIDs become @user:i80.dk; federation/clients resolve i80.dk -> cn.i80.dk. + "traefik.http.routers.continuwuity-wk.rule=Host(`i80.dk`) && PathPrefix(`/.well-known/matrix`)", + "traefik.http.routers.continuwuity-wk.entrypoints=https", + "traefik.http.routers.continuwuity-wk.tls=true", + # Higher priority so it wins over any bare Host(`i80.dk`) website router. + # NOTE: requires the cert to include i80.dk as a SAN (a *.i80.dk wildcard alone does NOT cover the apex). + "traefik.http.routers.continuwuity-wk.priority=100", + + # --- http -> https redirect for both routers --- + "traefik.http.routers.continuwuity-http.rule=Host(`cn.i80.dk`)", + "traefik.http.routers.continuwuity-http.entrypoints=http", + "traefik.http.routers.continuwuity-http.middlewares=continuwuity-redirect", + "traefik.http.routers.continuwuity-wk-http.rule=Host(`i80.dk`) && PathPrefix(`/.well-known/matrix`)", + "traefik.http.routers.continuwuity-wk-http.entrypoints=http", + "traefik.http.routers.continuwuity-wk-http.middlewares=continuwuity-redirect", + "traefik.http.routers.continuwuity-wk-http.priority=100", + "traefik.http.middlewares.continuwuity-redirect.redirectscheme.scheme=https", + "traefik.http.middlewares.continuwuity-redirect.redirectscheme.permanent=true", + ] + + check { + name = "continuwuity-http" + type = "http" + port = "http" + path = "/_matrix/client/versions" + interval = "30s" + timeout = "5s" + + check_restart { + limit = 3 + grace = "60s" + } + } + } + + volume "continuwuity-volume" { + type = "csi" + read_only = false + source = "continuwuity-volume" + attachment_mode = "file-system" + access_mode = "single-node-writer" + per_alloc = false + } + + volume "continuwuity-media-volume" { + type = "csi" + read_only = false + source = "continuwuity-media-volume" + attachment_mode = "file-system" + access_mode = "single-node-writer" + per_alloc = false + + mount_options { + mount_flags = [] + } + } + + restart { + attempts = 3 + interval = "10m" + delay = "30s" + mode = "delay" + } + + update { + max_parallel = 1 + health_check = "checks" + min_healthy_time = "30s" + healthy_deadline = "5m" + auto_revert = true + } + + task "continuwuity" { + driver = "docker" + + env { + # server_name is PERMANENT — it is the suffix of every user/room ID (@henrik:i80.dk). + CONTINUWUITY_SERVER_NAME = "i80.dk" + CONTINUWUITY_TRUSTED_SERVERS = "[\"matrix.org\"]" + CONTINUWUITY_ALLOW_REGISTRATION = false + CONTINUWUITY_ADDRESS = "0.0.0.0" + CONTINUWUITY_PORT = 6167 + CONTINUWUITY_DATABASE_PATH = "/var/lib/continuwuity" + + # Delegation: the homeserver lives at cn.i80.dk, advertised via the apex .well-known. + # client = base URL (no port); server = host:port for federation. + CONTINUWUITY_WELL_KNOWN = <