stem95su: scheduled Drive->site sync CronJob (every 10m)
CronJob stem95su-gdrive-sync (*/10) mounts the content PVC RW and rclone-syncs the read-only Drive folder "claude" (stem claude/files) onto it (rclone/rclone:1.74.3, scope=drive.readonly, empty-source guard + --max-delete 25). ESO ExternalSecret stem95su-rclone <- Vault secret/stem95su. Requires the GCP OAuth app published to Production or the refresh token expires ~weekly. Lands the gdrive-sync stack on master (it had landed on a feature branch by accident on the shared devvm checkout). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin
parent
05b50d2b96
commit
6d224861c4
1168 changed files with 120 additions and 358547 deletions
|
|
@ -1,158 +0,0 @@
|
|||
networks:
|
||||
registry:
|
||||
driver: bridge
|
||||
|
||||
services:
|
||||
# registry:2 is pinned after the 2026-04-13 + 2026-04-19 orphan-index incidents.
|
||||
# Floating tags were swapping to regressed versions between GC runs. Upgrade
|
||||
# path: bump all six registry-* services in lockstep and bounce via
|
||||
# `systemctl restart docker-compose-registry.service`.
|
||||
registry-dockerhub:
|
||||
image: registry:2.8.3
|
||||
container_name: registry-dockerhub
|
||||
restart: always
|
||||
volumes:
|
||||
- /opt/registry/data/dockerhub:/var/lib/registry
|
||||
- /opt/registry/config-dockerhub.yml:/etc/docker/registry/config.yml:ro
|
||||
networks:
|
||||
- registry
|
||||
ports:
|
||||
- "5001:5001"
|
||||
healthcheck:
|
||||
test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
|
||||
registry-ghcr:
|
||||
image: registry:2.8.3
|
||||
container_name: registry-ghcr
|
||||
restart: always
|
||||
volumes:
|
||||
- /opt/registry/data/ghcr:/var/lib/registry
|
||||
- /opt/registry/config-ghcr.yml:/etc/docker/registry/config.yml:ro
|
||||
networks:
|
||||
- registry
|
||||
healthcheck:
|
||||
test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
|
||||
registry-quay:
|
||||
image: registry:2.8.3
|
||||
container_name: registry-quay
|
||||
restart: always
|
||||
volumes:
|
||||
- /opt/registry/data/quay:/var/lib/registry
|
||||
- /opt/registry/config-quay.yml:/etc/docker/registry/config.yml:ro
|
||||
networks:
|
||||
- registry
|
||||
healthcheck:
|
||||
test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
|
||||
registry-k8s:
|
||||
image: registry:2.8.3
|
||||
container_name: registry-k8s
|
||||
restart: always
|
||||
volumes:
|
||||
- /opt/registry/data/k8s:/var/lib/registry
|
||||
- /opt/registry/config-k8s.yml:/etc/docker/registry/config.yml:ro
|
||||
networks:
|
||||
- registry
|
||||
healthcheck:
|
||||
test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
|
||||
registry-kyverno:
|
||||
image: registry:2.8.3
|
||||
container_name: registry-kyverno
|
||||
restart: always
|
||||
volumes:
|
||||
- /opt/registry/data/kyverno:/var/lib/registry
|
||||
- /opt/registry/config-kyverno.yml:/etc/docker/registry/config.yml:ro
|
||||
networks:
|
||||
- registry
|
||||
healthcheck:
|
||||
test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
|
||||
# registry-private decommissioned in Phase 4 of
|
||||
# forgejo-registry-consolidation 2026-05-07 — image migration completed,
|
||||
# cluster flipped to forgejo.viktorbarzin.me/viktor/<image>. The remaining
|
||||
# five services on this VM are pull-through caches for upstream registries.
|
||||
# After 1 week of no incidents, `rm -rf /opt/registry/data/private/` on the
|
||||
# VM frees ~2.6 GB. The tarball break-glass under
|
||||
# /opt/registry/data/private/_breakglass/ stays — it's how we recover
|
||||
# infra-ci if Forgejo ever goes fully down.
|
||||
|
||||
nginx:
|
||||
image: nginx:alpine
|
||||
container_name: registry-nginx
|
||||
restart: always
|
||||
# 5050 dropped Phase 4 of forgejo-registry-consolidation 2026-05-07.
|
||||
ports:
|
||||
- "5000:5000"
|
||||
- "5010:5010"
|
||||
- "5020:5020"
|
||||
- "5030:5030"
|
||||
- "5040:5040"
|
||||
volumes:
|
||||
- /opt/registry/nginx.conf:/etc/nginx/nginx.conf:ro
|
||||
- /opt/registry/tls:/etc/nginx/tls:ro
|
||||
- nginx-cache:/var/cache/nginx
|
||||
networks:
|
||||
- registry
|
||||
depends_on:
|
||||
registry-dockerhub:
|
||||
condition: service_healthy
|
||||
registry-ghcr:
|
||||
condition: service_healthy
|
||||
registry-quay:
|
||||
condition: service_healthy
|
||||
registry-k8s:
|
||||
condition: service_healthy
|
||||
registry-kyverno:
|
||||
condition: service_healthy
|
||||
healthcheck:
|
||||
test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
|
||||
registry-ui:
|
||||
image: joxit/docker-registry-ui:latest
|
||||
container_name: registry-ui
|
||||
restart: always
|
||||
ports:
|
||||
- "8080:80"
|
||||
environment:
|
||||
- NGINX_PROXY_PASS_URL=http://registry-dockerhub:5000
|
||||
- DELETE_IMAGES=true
|
||||
- SINGLE_REGISTRY=true
|
||||
- SHOW_CONTENT_DIGEST=true
|
||||
- SHOW_CATALOG_NB_TAGS=true
|
||||
- CATALOG_ELEMENTS_LIMIT=1000
|
||||
- TAGLIST_PAGE_SIZE=100
|
||||
- REGISTRY_TITLE=viktorbarzin.me
|
||||
networks:
|
||||
- registry
|
||||
depends_on:
|
||||
registry-dockerhub:
|
||||
condition: service_healthy
|
||||
|
||||
volumes:
|
||||
nginx-cache:
|
||||
Loading…
Add table
Add a link
Reference in a new issue