feat(actions): bootstrap sol runner

bootstrap/gitea-actions/scripts/bootstrap-sol.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+MODULE_DIR="$(cd -- "${SCRIPT_DIR}/.." && pwd -P)"
+REPO_ROOT="$(cd -- "${MODULE_DIR}/../.." && pwd -P)"
+
+SOL_HOST="${SOL_HOST:-149.50.96.162}"
+SOL_USER="${SOL_USER:-user}"
+SOL_SSH_KEY="${SOL_SSH_KEY:-/home/user/dev/mcp/keys/mpabi/mevnode_mcp}"
+REMOTE_STAGING_DIR="${REMOTE_STAGING_DIR:-/tmp/trade-gitops-bootstrap}"
+
+ssh_sol() {
+  ssh -i "$SOL_SSH_KEY" -o IdentitiesOnly=yes -o StrictHostKeyChecking=no "$SOL_USER@$SOL_HOST" "$@"
+}
+
+"${SCRIPT_DIR}/create-runner-registration-secret.sh"
+
+tar -C "$REPO_ROOT" -cf - bootstrap/gitea-actions | \
+  ssh_sol "rm -rf ${REMOTE_STAGING_DIR} && mkdir -p ${REMOTE_STAGING_DIR} && tar -C ${REMOTE_STAGING_DIR} -xf -"
+
+ssh_sol "sudo mkdir -p /var/lib/trade-gitops/gitea-actions/runner-data"
+ssh_sol "sudo k3s kubectl apply -k ${REMOTE_STAGING_DIR}/bootstrap/gitea-actions"
+ssh_sol "sudo k3s kubectl -n gitea-actions rollout status deploy/trade-next-act-runner --timeout=180s"
+
+"${SCRIPT_DIR}/sync-k3s-kubeconfig-org-secret.sh"
+
+ssh_sol "sudo k3s kubectl -n gitea-actions get pods -o wide"

bootstrap/gitea-actions/scripts/create-runner-registration-secret.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ORG="${ORG:-trade-next}"
+GITEA_URL="${GITEA_URL:-https://gitea.mpabi.pl}"
+GITEA_TOKEN_FILE="${GITEA_TOKEN_FILE:-/home/user/dev/mcp/tools/tokens/gitea.token}"
+SOL_HOST="${SOL_HOST:-149.50.96.162}"
+SOL_USER="${SOL_USER:-user}"
+SOL_SSH_KEY="${SOL_SSH_KEY:-/home/user/dev/mcp/keys/mpabi/mevnode_mcp}"
+NAMESPACE="${NAMESPACE:-gitea-actions}"
+SECRET_NAME="${SECRET_NAME:-act-runner-registration-token}"
+
+gitea_token() {
+  cut -d: -f2- "$GITEA_TOKEN_FILE" | head -n1 | tr -d '[:space:]'
+}
+
+ssh_sol() {
+  ssh -i "$SOL_SSH_KEY" -o IdentitiesOnly=yes -o StrictHostKeyChecking=no "$SOL_USER@$SOL_HOST" "$@"
+}
+
+API_TOKEN="$(gitea_token)"
+if [ -z "$API_TOKEN" ]; then
+  echo "Gitea API token is empty" >&2
+  exit 1
+fi
+
+REG_TOKEN="$(
+  curl -fsS \
+    -X POST \
+    -H "Authorization: token ${API_TOKEN}" \
+    "${GITEA_URL}/api/v1/orgs/${ORG}/actions/runners/registration-token" \
+    | jq -r '.token'
+)"
+
+if [ -z "$REG_TOKEN" ] || [ "$REG_TOKEN" = "null" ]; then
+  echo "Failed to obtain runner registration token" >&2
+  exit 1
+fi
+
+ssh_sol "sudo k3s kubectl get ns ${NAMESPACE} >/dev/null 2>&1 || sudo k3s kubectl create ns ${NAMESPACE} >/dev/null"
+
+printf '%s' "$REG_TOKEN" | ssh_sol "tmp=\$(mktemp); cat >\"\$tmp\"; sudo k3s kubectl -n ${NAMESPACE} create secret generic ${SECRET_NAME} --from-file=token=\"\$tmp\" --dry-run=client -o yaml | sudo k3s kubectl apply -f - >/dev/null; rm -f \"\$tmp\""
+
+echo "Runner registration secret synced to ${SOL_HOST}:${NAMESPACE}/${SECRET_NAME}"

bootstrap/gitea-actions/scripts/sync-k3s-kubeconfig-org-secret.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ORG="${ORG:-trade-next}"
+SECRET_NAME="${SECRET_NAME:-K3S_KUBECONFIG_B64}"
+GITEA_URL="${GITEA_URL:-https://gitea.mpabi.pl}"
+GITEA_TOKEN_FILE="${GITEA_TOKEN_FILE:-/home/user/dev/mcp/tools/tokens/gitea.token}"
+SOL_HOST="${SOL_HOST:-149.50.96.162}"
+SOL_USER="${SOL_USER:-user}"
+SOL_SSH_KEY="${SOL_SSH_KEY:-/home/user/dev/mcp/keys/mpabi/mevnode_mcp}"
+DEPLOY_NAMESPACE="${DEPLOY_NAMESPACE:-gitea-actions}"
+DEPLOY_SERVICE_ACCOUNT="${DEPLOY_SERVICE_ACCOUNT:-trade-gitops-deployer}"
+KUBE_API_SERVER="${KUBE_API_SERVER:-https://149.50.96.162:6443}"
+
+gitea_token() {
+  cut -d: -f2- "$GITEA_TOKEN_FILE" | head -n1 | tr -d '[:space:]'
+}
+
+ssh_sol() {
+  ssh -i "$SOL_SSH_KEY" -o IdentitiesOnly=yes -o StrictHostKeyChecking=no "$SOL_USER@$SOL_HOST" "$@"
+}
+
+API_TOKEN="$(gitea_token)"
+if [ -z "$API_TOKEN" ]; then
+  echo "Gitea API token is empty" >&2
+  exit 1
+fi
+
+CA_DATA="$(ssh_sol "sudo k3s kubectl config view --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}'")"
+SA_TOKEN="$(ssh_sol "sudo k3s kubectl -n ${DEPLOY_NAMESPACE} create token ${DEPLOY_SERVICE_ACCOUNT} --duration=8760h")"
+
+if [ -z "$CA_DATA" ] || [ -z "$SA_TOKEN" ]; then
+  echo "Failed to generate deployer kubeconfig material" >&2
+  exit 1
+fi
+
+KUBECONFIG_B64="$(
+  cat <<EOF | base64 -w0
+apiVersion: v1
+kind: Config
+clusters:
+- cluster:
+    certificate-authority-data: ${CA_DATA}
+    server: ${KUBE_API_SERVER}
+  name: sol
+contexts:
+- context:
+    cluster: sol
+    namespace: default
+    user: ${DEPLOY_SERVICE_ACCOUNT}
+  name: sol
+current-context: sol
+users:
+- name: ${DEPLOY_SERVICE_ACCOUNT}
+  user:
+    token: ${SA_TOKEN}
+EOF
+)"
+
+PAYLOAD="$(jq -nc --arg data "$KUBECONFIG_B64" --arg description "k3s deploy kubeconfig for trade-next on sol" '{data:$data,description:$description}')"
+
+curl -fsS \
+  -X PUT \
+  -H "Authorization: token ${API_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d "$PAYLOAD" \
+  "${GITEA_URL}/api/v1/orgs/${ORG}/actions/secrets/${SECRET_NAME}" \
+  >/dev/null
+
+echo "Organization secret ${ORG}/${SECRET_NAME} updated"