vole
Clone
Read only, no credentials:
https://rodent.software/vole.git
Write over SSH with a registered key:
git clone ssh://git@rodent.software:2222/vole.git
A free and open-source forge that lives in your Git repo.
Drop the Terraform configurations; cloud-init is the deployment path
51624dc663738e70cc37b8ac5e232841fd49aaf8 · Keenan Nemetz · 3d ago · parent e21f6c5e
Drop the Terraform configurations; cloud-init is the deployment path A Vole instance is one package, one configuration file, and one directory. The first-boot file that installs the package and writes the configuration is that same work described once, and it needs no provider, no state file, and no cloud token with write access to an account. What Terraform did outside the machine — firewall, address, DNS record — is three fields in a console the operator already has open. So the three configurations go, and with them what existed only to check them: the pinned Terraform download in the verify image, the `fmt -check` step, the .terraform entries in the ignore file, and the directory skip in the link checker. The deployment check now needs python3 and PyYAML and nothing else — no network, no credentials. deploy/README.md keeps the reasoning, so the next person tempted to add a provider back sees what it would buy and what it would cost. The templates' header comments no longer name a renderer that is gone: render.sh fills them in, and check-deploy.py renders them the same way.
.vole/images/verify.yaml +3−11
| @@ -1,8 +1,7 @@ | |||
| 1 | 1 | # The image .vole/workflows/verify.yaml runs in. It carries everything the steps call: the Go toolchain | |
| 2 | 2 | # (with gcc, so -race works), the SQLite development headers the driver links | |
| 3 | 3 | # against, git and the ssh client and keygen the server tests spawn, python3 for | |
| 4 | # the link check, PyYAML for the deployment check, and Terraform for the | ||
| 5 | # configurations under deploy/terraform. | ||
| 4 | # the link check, and PyYAML for the deployment check. | ||
| 6 | 5 | # | |
| 7 | 6 | # The toolchain is the one go.mod pins (go 1.27.3), and the base image is pinned | |
| 8 | 7 | # by digest so the scanner and the compiler that pass a push are the ones the | |
| @@ -17,10 +16,7 @@ | |||
| 17 | 16 | # --container-user. | |
| 18 | 17 | ||
| 19 | 18 | # nfpm is not installed here: the packaging step fetches it at a pinned version, so | |
| 20 | # that a local run and a pushed run execute the same command. Terraform is | ||
| 21 | # installed here rather than fetched by each step, because it is a single binary | ||
| 22 | # that the deployment check runs three times; its version and both architectures' | ||
| 23 | # checksums are below, so a pushed run and a local one format with the same tool. | ||
| 19 | # that a local run and a pushed run execute the same command. | ||
| 24 | 20 | version: 1 | |
| 25 | 21 | from: golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 | |
| 26 | 22 | env: | |
| @@ -33,9 +29,5 @@ env: | |||
| 33 | 29 | GOMODCACHE: "/cache/go-mod" | |
| 34 | 30 | GOCACHE: "/cache/go-build" | |
| 35 | 31 | run: | |
| 36 | - apt-get update && apt-get install -y --no-install-recommends libsqlite3-dev git git-lfs openssh-client python3 python3-yaml gettext-base ca-certificates curl unzip && rm -rf /var/lib/apt/lists/* | ||
| 37 | # Terraform, pinned by version and by checksum for each architecture a runner can | ||
| 38 | # be. It is used by `terraform fmt -check` in the deployment step; `terraform | ||
| 39 | # validate` is left to people, because it downloads three providers. | ||
| 40 | - set -eu; ver=1.17.1; case "$(dpkg --print-architecture)" in amd64) sum=4638628058e71a55212b1c563712eac03b902128f40740f3dc8174df12135061 ;; arm64) sum=988e950a1c23058093b0e66ab2d5fb53fc18345ecfbd5871acf51dbac9325edd ;; *) echo "no pinned Terraform for $(dpkg --print-architecture)" >&2; exit 1 ;; esac; curl -fsSLo /tmp/tf.zip "https://releases.hashicorp.com/terraform/$ver/terraform_${ver}_linux_$(dpkg --print-architecture).zip"; echo "$sum /tmp/tf.zip" | sha256sum -c -; unzip -q /tmp/tf.zip -d /usr/local/bin; rm -f /tmp/tf.zip; terraform version | ||
| 32 | - apt-get update && apt-get install -y --no-install-recommends libsqlite3-dev git git-lfs openssh-client python3 python3-yaml ca-certificates && rm -rf /var/lib/apt/lists/* | ||
| 41 | 33 | - useradd --uid 1000 --create-home --shell /bin/sh ci | |