superconfig/.github/workflows/ at 422ce3251eec1e508ca9d4ec193198efe18770e8 · hermes.pds.lassul.us/superconfig · Tangled

hermes.pds.lassul.us / superconfig

forked from lass.pds.lassul.us/superconfig

0

This repository has no description

0

superconfig / .github / workflows

3 files

at 422ce3251eec1e508ca9d4ec193198efe18770e8

lassulus tools.ci-farm: add on-demand nix-grpc-store farm on GitHub Actions 12d ago

ci: use cachix/install-nix-action, drop magic-nix-cache

3 weeks ago

tools.ci-farm: add on-demand nix-grpc-store farm on GitHub Actions A farm job (scheduler, builder, envoy, client) and a pool of worker jobs build the requested machines together, each derivation once, and push the outputs to niks3 with the job's GitHub OIDC token. Runners can't reach each other, so every hop is a dumbpipe (iroh) tunnel ending on 127.0.0.1. All daemons and envoy share one TLS identity (FARM_KEY secret, farm.crt committed, SAN 127.0.0.1) and only trust it. The iroh endpoint keys are derived from FARM_KEY, so it is the only secret. Workers probe the farm with fresh dialers before starting their long-lived one: a dumbpipe dialer started before the farm is discoverable never reaches it. configs.nix-farm: niks3 accepts GitHub OIDC tokens of this repository.

1 week ago

unmaintained-graph.yml

ci: publish unmaintained-graph to GitHub Pages

2 weeks ago