buenosair/lvmh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: agent deploys — passwordless ssh key (alarm/desk/blanc-nas + gitea), write-scope gitea token, secrets mounts, gitconfig, APPEND_SYSTEM deploy guide

Browse Source
This commit is contained in:
Raphael Westphal
2026-08-20 09:34:17 +02:00
parent b51a3b564f
commit 6d10877e34
11 changed files with 338 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
daemon/docker.go
+23 -10
View File
@@ -40,16 +40,19 @@ const (
stateRunning string = "running"
stateError string = "error"
imageRefWorker string = "lvmh-worker:latest"
labelSession string = "lvmh.session"
volumeRepoPrefix string = "lvmh-repo-"
volumeSessions string = "lvmh-sessions"
volumePiCache string = "lvmh-pi-cache" // pi package cache (git:/npm:), shared across spawns
cacheMount string = "/root/.pi/agent/cache"
authMountTarget string = "/root/.pi/agent/auth.json"
envHostPiAgentDir string = "LVMH_HOST_PI_AGENT_DIR"
workspaceMount string = "/workspace"
sessionsMount string = "/pi-sessions"
imageRefWorker string = "lvmh-worker:latest"
labelSession string = "lvmh.session"
volumeRepoPrefix string = "lvmh-repo-"
volumeSessions string = "lvmh-sessions"
volumePiCache string = "lvmh-pi-cache" // pi package cache (git:/npm:), shared across spawns
cacheMount string = "/root/.pi/agent/cache"
authMountTarget string = "/root/.pi/agent/auth.json"
envHostPiAgentDir string = "LVMH_HOST_PI_AGENT_DIR"
envSecretsDir string = "LVMH_SECRETS_DIR"
sshMountTarget string = "/root/.ssh"
gitconfigMountTarget string = "/root/.gitconfig"
workspaceMount string = "/workspace"
sessionsMount string = "/pi-sessions"
envWorkerDockerfile string = "LVMH_WORKER_DOCKERFILE"
defaultDockerfile string = "/app/build/docker/worker.Dockerfile"
@@ -522,6 +525,16 @@ func (s *Spawner) createAndStart(ctx context.Context, repo, slug, sessionID stri
if hostAgent := os.Getenv(envHostPiAgentDir); hostAgent != "" {
binds = append(binds, hostAgent+"/auth.json:"+authMountTarget+":ro")
}
// Deploy secrets (ssh key + known_hosts + config, gitconfig), read-only.
// Bind sources resolve on the HOST (docker.sock semantics), so this env
// must carry the host path of the secrets dir.
if sec := os.Getenv(envSecretsDir); sec != "" {
binds = append(
binds,
sec+":"+sshMountTarget+":ro",
sec+"/gitconfig:"+gitconfigMountTarget+":ro",
)
}
cfg := &container.Config{
Image: image,
Env: []string{