Skip to content

Commit 8828bfe

Browse files
thphamthpham
committed
♻️ refactor: centralize debug config and secrets in runner profiles
- Move debug.sshKeyFile configuration to dev.nix for all runners - Move GitHub secrets from deploy/secrets.nix to github-runners.nix - Remove debug.sshKeyFile from gitea-runners.nix and gitlab-runners.nix - Remove debug.sshKeyFile from registry-cache module (not VM-related) - Refactor fireactions debug option from boolean to attrset structure - Add fireglab settings to dev.nix and prod.nix profiles - Exclude MMDS (169.254.169.254) from Squid NAT redirect rules - Remove bootcmd MMDS route from cloud-init configs (not needed) - Update fireglab README to reference centralized dev profile
1 parent b640a51 commit 8828bfe

16 files changed

Lines changed: 65 additions & 143 deletions

File tree

‎deploy/secrets.nix‎

Lines changed: 11 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -21,51 +21,25 @@
2121
};
2222

2323
# Define secrets that will be decrypted to /run/secrets/
24+
# Runner-specific secrets are defined in their respective profiles:
25+
# - profiles/github-runners.nix (github-app-id, github-app-key)
26+
# - profiles/gitlab-runners.nix (gitlab-access-token, gitlab-instance-url, etc.)
27+
# - profiles/gitea-runners.nix (gitea-registration-token, gitea-instance-url, etc.)
2428
secrets = {
25-
# GitHub App ID for fireactions
26-
"github-app-id" = {
27-
# Path in secrets.yaml: github_app_id
28-
key = "github_app_id";
29-
30-
# Permissions
31-
mode = "0400";
32-
owner = "root";
33-
group = "root";
34-
35-
# Restart fireactions when secret changes
36-
restartUnits = [ "fireactions-config.service" ];
37-
};
38-
39-
# GitHub App private key for fireactions
40-
"github-app-key" = {
41-
# Path in secrets.yaml: github_app_private_key
42-
key = "github_app_private_key";
43-
44-
# Permissions
45-
mode = "0400";
46-
owner = "root";
47-
group = "root";
48-
49-
# Restart fireactions when secret changes
50-
restartUnits = [ "fireactions-config.service" ];
51-
};
52-
53-
# Debug SSH key for VM access (optional, used by dev profile)
29+
# Debug SSH key for VM access (used by dev profile for all runner types)
5430
"debug-ssh-key" = {
55-
# Path in secrets.yaml: debug_ssh_key
5631
key = "debug_ssh_key";
57-
58-
# Permissions
5932
mode = "0400";
6033
owner = "root";
6134
group = "root";
62-
63-
# Restart fireactions-config to regenerate cloud-init user-data
64-
restartUnits = [ "fireactions-config.service" ];
35+
# Restart all config services to regenerate cloud-init user-data
36+
restartUnits = [
37+
"fireactions-config.service"
38+
"fireteact-config.service"
39+
"fireglab-config.service"
40+
];
6541
};
6642

67-
# Gitea secrets for fireteact are defined in modules/fireteact/default.nix
68-
# They are conditional based on which *File options are used
6943
};
7044
};
7145
}

‎fireglab/README.md‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -435,11 +435,8 @@ DELETE /api/v4/runners/:id
435435

436436
### Debug SSH Access
437437

438-
Enable SSH access to VMs for debugging:
439-
440-
```nix
441-
services.fireglab.debug.sshKeyFile = config.sops.secrets."debug-ssh-key".path;
442-
```
438+
SSH access to VMs is automatically enabled when using the `dev` profile (`profiles/dev.nix`).
439+
The debug SSH key is configured centrally for all runner types (fireactions, fireteact, fireglab).
443440

444441
Then SSH into a running VM:
445442

‎images/docker/ubuntu-24.04/CHANGELOG.md‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,6 @@ Versioning format: `{runner_version}-{increment}` (e.g., `2.330.0-1` for GitHub,
1010

1111
Initial release with new versioning scheme.
1212

13-
#### Fixed
14-
15-
- **MMDS route reliability**: Added `bootcmd` to create route to 169.254.169.254 before cloud-init
16-
fetches metadata. Previously worked by timing luck; now deterministic per Firecracker docs:
17-
"guest applications must insert a new rule into the routing table"
18-
1913
#### Components
2014

2115
| Component | Version |
@@ -38,12 +32,6 @@ Ephemeral runner mode for proper VM recycling.
3832
- **Immediate VM recycling**: New VMs spawn immediately after job completion (no 10s delay)
3933
- **Improved logging**: Structured logging for runner lifecycle events
4034

41-
#### Fixed
42-
43-
- **MMDS route reliability**: Added `bootcmd` to create route to 169.254.169.254 before cloud-init
44-
fetches metadata. Previously worked by timing luck; now deterministic per Firecracker docs:
45-
"guest applications must insert a new rule into the routing table"
46-
4735
#### Components
4836

4937
| Component | Version |
@@ -66,13 +54,6 @@ Initial release with GitLab CI runner support.
6654
- **Runner types**: Support for instance_type, group_type, and project_type
6755
- **Ephemeral runners**: One job per VM with immediate recycling
6856

69-
#### Fixed
70-
71-
- **MMDS route reliability**: Added `bootcmd` to create route to 169.254.169.254 before cloud-init
72-
fetches metadata. This was the root cause of MMDS failures - fireglab boots faster than
73-
fireteact/fireactions, causing cloud-init to run before the route existed. Now deterministic
74-
per Firecracker docs: "guest applications must insert a new rule into the routing table"
75-
7657
#### Components
7758

7859
| Component | Version |

‎images/docker/ubuntu-24.04/overlay/gitea/etc/cloud/cloud.cfg.d/99-fireteact.cfg‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,6 @@
77
#
88
# The user-data is provided by the host via MMDS at 169.254.169.254
99

10-
# CRITICAL: Add route to MMDS endpoint before cloud-init tries to fetch metadata
11-
# Firecracker MMDS requires an explicit route in the guest OS:
12-
# "guest applications must insert a new rule into the routing table"
13-
# See: https://github.com/firecracker-microvm/firecracker/blob/main/docs/mmds/mmds-user-guide.md
14-
# We use cloud-init's bootcmd to ensure the route exists before metadata fetch
15-
bootcmd:
16-
- ip route add 169.254.169.254 dev eth0
17-
1810
# Use EC2 datasource (MMDS is EC2-compatible)
1911
datasource_list: [Ec2, None]
2012

‎images/docker/ubuntu-24.04/overlay/github/etc/cloud/cloud.cfg.d/99-fireactions.cfg‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,6 @@
77
#
88
# The user-data is provided by the host via MMDS at 169.254.169.254
99

10-
# CRITICAL: Add route to MMDS endpoint before cloud-init tries to fetch metadata
11-
# Firecracker MMDS requires an explicit route in the guest OS:
12-
# "guest applications must insert a new rule into the routing table"
13-
# See: https://github.com/firecracker-microvm/firecracker/blob/main/docs/mmds/mmds-user-guide.md
14-
# We use cloud-init's bootcmd to ensure the route exists before metadata fetch
15-
bootcmd:
16-
- ip route add 169.254.169.254 dev eth0
17-
1810
# Use EC2 datasource (MMDS is EC2-compatible)
1911
datasource_list: [Ec2, None]
2012

‎images/docker/ubuntu-24.04/overlay/gitlab/etc/cloud/cloud.cfg.d/99-fireglab.cfg‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,6 @@
77
#
88
# The user-data is provided by the host via MMDS at 169.254.169.254
99

10-
# CRITICAL: Add route to MMDS endpoint before cloud-init tries to fetch metadata
11-
# Firecracker MMDS requires an explicit route in the guest OS:
12-
# "guest applications must insert a new rule into the routing table"
13-
# See: https://github.com/firecracker-microvm/firecracker/blob/main/docs/mmds/mmds-user-guide.md
14-
# We use cloud-init's bootcmd to ensure the route exists before metadata fetch
15-
bootcmd:
16-
- ip route add 169.254.169.254 dev eth0
17-
1810
# Use EC2 datasource (MMDS is EC2-compatible)
1911
datasource_list: [Ec2, None]
2012

‎modules/fireactions/default.nix‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -225,10 +225,13 @@ in
225225
description = "Log level for fireactions";
226226
};
227227

228-
debug = lib.mkOption {
229-
type = lib.types.bool;
230-
default = false;
231-
description = "Enable debug mode";
228+
# Debug configuration (matches fireteact/fireglab structure)
229+
debug = {
230+
sshKeyFile = lib.mkOption {
231+
type = lib.types.nullOr lib.types.path;
232+
default = null;
233+
description = "SSH public key file for VM debugging access";
234+
};
232235
};
233236

234237
# Metrics configuration

‎modules/fireactions/services.nix‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,6 @@ let
102102
fireactionsConfig = {
103103
bind_address = cfg.bindAddress;
104104
log_level = cfg.logLevel;
105-
debug = cfg.debug;
106105
basic_auth_enabled = cfg.basicAuth.enable;
107106
}
108107
// lib.optionalAttrs (cfg.basicAuth.enable && cfg.basicAuth.users != { }) {
@@ -349,9 +348,7 @@ in
349348
# Registry cache configuration
350349
export REGISTRY_CACHE_GATEWAY="${lib.optionalString needsRegistryCache registryCacheCfg._internal.primaryGateway}"
351350
export DEBUG_SSH_KEY_FILE="${
352-
lib.optionalString (
353-
needsRegistryCache && registryCacheCfg._internal.debugSshKeyFile != null
354-
) registryCacheCfg._internal.debugSshKeyFile
351+
lib.optionalString (cfg.debug.sshKeyFile != null) cfg.debug.sshKeyFile
355352
}"
356353
357354
# Zot registry mirror configuration

‎modules/microvm-base/dnsmasq.nix‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ in
5151
# DHCP ranges with tags for each bridge
5252
dhcp-range = map (b: "set:${b.name},${b.dhcpStart},${b.dhcpEnd},${b.netmask},12h") bridgeConfigs;
5353

54-
# Per-bridge gateway and DNS options
54+
# Per-bridge gateway, DNS, and route options
5555
dhcp-option = lib.flatten (
5656
map (b: [
5757
"tag:${b.name},3,${b.gateway}" # Gateway

‎modules/registry-cache/default.nix‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -459,14 +459,6 @@ in
459459
};
460460
};
461461

462-
debug = {
463-
sshKeyFile = lib.mkOption {
464-
type = lib.types.nullOr lib.types.path;
465-
default = null;
466-
description = "SSH public key for VM debugging";
467-
};
468-
};
469-
470462
# ========================================
471463
# INTERNAL OPTIONS (for downstream consumers)
472464
# ========================================
@@ -508,13 +500,6 @@ in
508500
default = caCertPath;
509501
};
510502

511-
debugSshKeyFile = lib.mkOption {
512-
type = lib.types.nullOr lib.types.path;
513-
internal = true;
514-
readOnly = true;
515-
default = cfg.debug.sshKeyFile;
516-
};
517-
518503
squidSslBumpMode = lib.mkOption {
519504
type = lib.types.str;
520505
internal = true;

0 commit comments

Comments
 (0)