mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-07 19:32:17 +00:00
kevinveenbirkenbachandClaude Opus 5
3781c30235
48845db97 made three capability decisions declarable and named them INFINITO_*, which put them under setdefault: the live environment wins and the value is written back. Makefile exports BASH_ENV, so .env is re-exported into every make recipe, and scripts/tests/code/run.sh reaches dotenv through 'make setup' on every test run. A declaration made for one run therefore became a machine fact on first regeneration and stayed one - that is what made the workspace failure intermittent rather than reproducible, and why fedora died on 11 assertions where debian passed the same code.
A dedicated handler writing through eb.set recomputes the value every time and discards whatever the environment held, so the key stays registered in default.env and visible to the lints while remaining structurally unpinnable. running_on/github.py already worked this way; the distinction now has a name in utils/env/README.md. The exporting shell still steers its own run, because load.sh preserves non-empty caller values.
The other two declarations are deleted rather than moved. image_mirror_enabled and docker_root_ephemeral both derive from runs_on_github(), and the orchestrator does not unset INFINITO_RUNNING_ON_GITHUB, so inside the workspace they were already true and the declarations restated a value that held anyway. Measured across all four runtime contexts: only the workspace row changes, and only for the cache.
Verified by reversing the probe: 'INFINITO_CACHE_STACK=false make dotenv' writes .env=true, where the registry path wrote the exported value back.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
381 lines
16 KiB
Bash
381 lines
16 KiB
Bash
# Single source of truth for the project's static defaults.
|
|
#
|
|
# Every key here is copied verbatim into the generated `.env` by
|
|
# `make dotenv` (which delegates to `python -m cli.meta.env`), together
|
|
# with the dynamic runtime-resolved values (distro, GHA flags,
|
|
# df/meminfo-derived sizes, sha256 secrets, repository owner, ...).
|
|
#
|
|
# Override at generation time by exporting the variable before running
|
|
# `make dotenv` -- already-set env vars take precedence over the
|
|
# defaults below.
|
|
#
|
|
# Convention: every key is preceded by a single-line `# ...` comment
|
|
# that explains what the value is for. The generator preserves the
|
|
# comments when materialising `.env`.
|
|
|
|
# Git repository holding the operator's terminal aliases (an `aliases` file at repo root); developers override this with their own repo.
|
|
INFINITO_ALIAS_REPOSITORY=https://github.com/kevinveenbirkenbach/alias
|
|
|
|
# Where scripts/meta/resolve/apps.sh runs the meta-CLI: host | docker.
|
|
INFINITO_APP_DISCOVERY_RUNNER=docker
|
|
|
|
# Per-app variant index map for credential generation, set per round by the swarm matrix orchestrator; empty elsewhere.
|
|
INFINITO_APP_VARIANTS=
|
|
|
|
# Host interface(s) the compose stack binds published ports to.
|
|
INFINITO_BIND_IP=127.0.0.1
|
|
|
|
# Optional app-discovery exclusion filter consumed by scripts/meta/resolve/apps.sh and the GHA workflows.
|
|
INFINITO_BLACKLIST=
|
|
|
|
# `1` builds the local image; `0` skips the build and pulls the published image (CI overrides via -e INFINITO_BUILD=0).
|
|
INFINITO_BUILD=1
|
|
|
|
# `1` keeps BuildKit on (default); `0` forces the compose wrapper to use the legacy builder.
|
|
INFINITO_BUILDKIT_ENABLED=1
|
|
|
|
# External docker network carrying the shared cache stack; empty on the primary instance, which owns the stack itself.
|
|
INFINITO_CACHE_NETWORK=
|
|
|
|
# Host directory holding the package-cache frontend CA materials.
|
|
INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR=/var/cache/infinito/core/cache/package/frontend/ca
|
|
|
|
# CA certificate file produced under INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR.
|
|
INFINITO_CACHE_PACKAGE_FRONTEND_CA_FILE=/var/cache/infinito/core/cache/package/frontend/ca/ca.crt
|
|
|
|
# Host directory holding the package-cache frontend TLS certificates.
|
|
INFINITO_CACHE_PACKAGE_FRONTEND_CERTS_DIR=/var/cache/infinito/core/cache/package/frontend/certs
|
|
|
|
# Init image used by the package-cache frontend cert-gen wrapper to run cert-gen.sh.
|
|
INFINITO_CACHE_PACKAGE_FRONTEND_INIT_IMAGE=alpine:latest
|
|
|
|
# Static IPv4 address the package-cache frontend takes on the docker bridge.
|
|
INFINITO_CACHE_PACKAGE_FRONTEND_IP=172.30.0.4
|
|
|
|
# Host directory backing the Nexus 3 package-cache blobstore.
|
|
INFINITO_CACHE_PACKAGE_HOST_PATH=/var/cache/infinito/core/cache/package/data
|
|
|
|
# Content freshness window (minutes) for immutable cached artifacts (wheels, debs, rpms). 8640 = 6 days.
|
|
INFINITO_CACHE_PACKAGE_MAX_AGE_MIN=8640
|
|
|
|
# Metadata + negative-cache window (minutes) for indexes / not-found lookups. 0 = always revalidate so new versions show at once.
|
|
INFINITO_CACHE_PACKAGE_METADATA_MAX_AGE_MIN=0
|
|
|
|
# Bind-mounted .npmrc fragment for the package-cache frontend.
|
|
INFINITO_CACHE_PACKAGE_NPMRC=./compose/package-cache/npmrc
|
|
|
|
# Bind-mounted pip.conf fragment for the package-cache frontend.
|
|
INFINITO_CACHE_PACKAGE_PIP_CONF=./compose/package-cache/pip.conf
|
|
|
|
# Host port the Nexus 3 package cache binds to on BIND_IP.
|
|
INFINITO_CACHE_PACKAGE_PORT=8081
|
|
|
|
# Host directory holding the registry-cache CA materials.
|
|
INFINITO_CACHE_REGISTRY_CA_HOST_PATH=/var/cache/infinito/core/cache/registry/ca
|
|
|
|
# Host directory backing the docker registry-mirror cache (bind mount).
|
|
INFINITO_CACHE_REGISTRY_HOST_PATH=/var/cache/infinito/core/cache/registry/mirror
|
|
|
|
# Static IPv4 of the registry-cache; resolved via extra_hosts since coredns can't resolve the container name.
|
|
INFINITO_CACHE_REGISTRY_IP=172.30.0.6
|
|
|
|
# Bind-mounted registry-cache proxy configuration consumed by the cache container.
|
|
INFINITO_CACHE_REGISTRY_PROXY_CONF=./compose/registry-cache/proxy.conf
|
|
|
|
# True where a persistent pull-through cache stack pays off (local dev).
|
|
INFINITO_CACHE_STACK=true
|
|
|
|
# Index of the deploy chunk the discovery emits; each chunk block of call-orchestrator.yml passes its own.
|
|
INFINITO_CI_CHUNK=0
|
|
|
|
# Runner slots a deploy chunk may assume are free; with the job timeout it sizes a chunk in cli.meta.ci.slots.
|
|
INFINITO_CI_CONCURRENCY=20
|
|
|
|
# Budget distros.sh spends before skipping the rest; stays under the 350-min step cap, which stays under the 355-min job cap.
|
|
INFINITO_CI_DISTRO_BUDGET_SECONDS=20400
|
|
|
|
# Job budget per workflow run cli.meta.ci.slots spends on the deploy chunks (GitHub matrix cap: 256).
|
|
INFINITO_CI_JOB_LIMIT=256
|
|
|
|
# Chunk job blocks call-orchestrator.yml declares; cli.meta.ci.slots must never plan more than these exist in the YAML.
|
|
INFINITO_CI_MAX_CHUNKS=3
|
|
|
|
# Regular rows a run skips before filling its chunks; a count or a selection token, 0 starts at the head of the ranking.
|
|
INFINITO_CI_OFFSET=0
|
|
|
|
# Hours a job may sit queued before GitHub cancels it; the ceiling a single chunk's waves must start within.
|
|
INFINITO_CI_QUEUE_HOURS=24
|
|
|
|
# Sweep number driving the deploy mode/tor rotation; CI passes the run number.
|
|
INFINITO_CI_SWEEP=0
|
|
|
|
# Compose service container name; generator overrides as infinito_nexus_${INFINITO_DISTRO}.
|
|
INFINITO_CONTAINER=infinito_nexus_debian
|
|
|
|
# `1` (default) keeps CA injection on in the container wrapper; `0` skips it.
|
|
INFINITO_CONTAINER_CA_ENABLED=1
|
|
|
|
# cpus cap applied to the infinito container; 0 means "unlimited".
|
|
INFINITO_CPUS=0
|
|
|
|
# Truthy enables debug behavior in the local deploy flows.
|
|
INFINITO_DEBUG=true
|
|
|
|
# Deploy mode the discovery matrix targets (compose|swarm) for per-mode services.yml skip; empty disables it.
|
|
INFINITO_DEPLOY_MODE=
|
|
|
|
# Seed the discovery sort's tie-breaker derives from; empty draws it per process, so the rendered plan can differ from the deploy.
|
|
INFINITO_DISCOVERY_SEED=
|
|
|
|
# Sort spec the CI app-discovery (scripts/meta/resolve/apps.sh) orders roles by; the order decides which rows a chunk takes first.
|
|
INFINITO_DISCOVERY_SORT="asc clone,asc covered_by,desc integrated,desc embeds,desc consumers,asc variant,asc random"
|
|
|
|
# Distro the build/test matrix is currently iterating over (generator may override).
|
|
INFINITO_DISTRO=debian
|
|
|
|
# Domain the host-side DNS-fallback / dnsmasq config wires up (consumed by scripts/system/network/dns/).
|
|
INFINITO_DNS_DOMAIN=infinito.example
|
|
|
|
# Path to the hosts file the DNS-fallback installer writes the BEGIN/END block into.
|
|
INFINITO_DNS_HOSTS_FILE=/etc/hosts
|
|
|
|
# IPv4 of the CoreDNS sidecar inside INFINITO_SUBNET; CI/dev default, overridden in real deploys.
|
|
INFINITO_DNS_IP=172.30.0.53
|
|
|
|
# Repo-relative path of the docker CLI install script.
|
|
INFINITO_DOCKER_CLI_INSTALL_SCRIPT=roles/sys-svc-container/files/shell/install-cli.sh
|
|
|
|
# Filesystem the docker data root runs on; empty until scripts/tests/deploy/utils/filesystem/resolve.sh settles the row's kind.
|
|
INFINITO_DOCKER_FILESYSTEM=
|
|
|
|
# Space-separated subset of ext4/btrfs/zfs the pick may use; empty draws from all three.
|
|
INFINITO_DOCKER_FILESYSTEM_ALLOWED=
|
|
|
|
# `true` when a human named the pick, so it binds: a host that cannot deliver it fails instead of falling back.
|
|
INFINITO_DOCKER_FILESYSTEM_ENFORCED=
|
|
|
|
# The filesystem the deploy matrix assigned one row; empty draws from INFINITO_DOCKER_FILESYSTEM_ALLOWED.
|
|
INFINITO_DOCKER_FILESYSTEM_PICK=
|
|
|
|
# `true` when the pick binds, because a human named it or nothing permitted is servable; the applying step then fails instead of declining.
|
|
INFINITO_DOCKER_FILESYSTEM_REQUIRED=
|
|
|
|
# Mount point inside the infinito container where INFINITO_DOCKER_VOLUME lands.
|
|
INFINITO_DOCKER_MOUNT=/var/lib/docker
|
|
|
|
# Docker volume backing /var/lib/docker; generator overrides to /mnt/docker on GHA.
|
|
INFINITO_DOCKER_VOLUME=docker
|
|
|
|
# Top-level project domain rendered into vhost/cert/test fixtures; CI/dev default, overridden in real deploys.
|
|
INFINITO_DOMAIN=infinito.example
|
|
|
|
# INFINITO_DOMAIN escaped for inclusion in regex patterns (literal `.`); keep in sync with INFINITO_DOMAIN.
|
|
INFINITO_DOMAIN_RE=infinito\.example
|
|
|
|
# Repo-relative path of the filesystem userland install script (ext4, btrfs, zfs).
|
|
INFINITO_FILESYSTEM_INSTALL_SCRIPT=scripts/install/filesystem.sh
|
|
|
|
# Repository name of the operator's fork; composed into INFINITO_FORK_REPOSITORY_URL by utils/env/handlers/infinito/fork_repository_url.py.
|
|
INFINITO_FORK_REPOSITORY_NAME=infinito-nexus-core
|
|
|
|
# IPv4 of the bridge gateway inside INFINITO_SUBNET.
|
|
INFINITO_GATEWAY=172.30.0.1
|
|
|
|
# Prefix path under which GHCR mirror lookups search for cached images.
|
|
INFINITO_GHCR_MIRROR_PREFIX=mirror
|
|
|
|
# Shared .git directory a worktree checkout points at; empty on the primary instance, which carries its own.
|
|
INFINITO_GIT_COMMON_DIR=
|
|
|
|
# Image tag used to address the published infinito image (CI publishes 'latest' on push).
|
|
INFINITO_IMAGE_TAG=latest
|
|
|
|
# Slot index isolating a parallel checkout: 0 owns the cache stack, 1..255 shift subnet, bind IP and container names.
|
|
INFINITO_INSTANCE=0
|
|
|
|
# Repo-relative path of the PHP/Ruby unit-suite toolchain install script.
|
|
INFINITO_INTERPRETERS_INSTALL_SCRIPT=scripts/install/interpreters.sh
|
|
|
|
# Repo-relative path to the Ansible vars file `infinito administration inventory provision --vars-file <...>` consumes.
|
|
INFINITO_INVENTORY_VARS_FILE=inventories/development/default.yml
|
|
|
|
# IPv4 of the infinito application container inside INFINITO_SUBNET; CI/dev default, overridden in real deploys.
|
|
INFINITO_IP4=172.30.0.10
|
|
|
|
# IPv6 loopback / public address the playbook's `internet` network defaults to when no host_var pin is set.
|
|
INFINITO_IP6=::1
|
|
|
|
# True when /proc/version identifies the host as WSL2; generator overrides via runtime detection.
|
|
INFINITO_IS_WSL2=false
|
|
|
|
# Keep act-swarm test cluster alive after the workflow for post-mortem inspection.
|
|
INFINITO_KEEP_SWARM_NODES=false
|
|
|
|
# Lifecycle envelope the CI test-deploy discovery exercises (scripts/meta/resolve/apps.sh --lifecycles); comma/space-separated.
|
|
INFINITO_LIFECYCLES="alpha beta rc stable maintained"
|
|
|
|
# Ansible limit pattern for local deploys.
|
|
INFINITO_LIMIT_HOST=localhost
|
|
|
|
# Where scripts/lint/wrapper.sh executes 'make lint*' / 'make autoformat': host | docker.
|
|
INFINITO_LINT_RUNNER=docker
|
|
|
|
# memswap_limit cap applied to the infinito container; 0 means "unlimited".
|
|
INFINITO_MEMSWAP_LIMIT=0
|
|
|
|
# mem_limit cap applied to the infinito container; 0 means "unlimited".
|
|
INFINITO_MEM_LIMIT=0
|
|
|
|
# Deploy modes CI rows may be drawn from: 'auto' for every mode a role offers, or a subset of 'host compose swarm'.
|
|
INFINITO_MODES=auto
|
|
|
|
# Repo checkout path on act-swarm DinD test nodes.
|
|
INFINITO_NODE_SRC_DIR=/opt/infinito-nexus
|
|
|
|
# MTU of the compose stack's bridge network; 1500 matches most hosts.
|
|
INFINITO_OUTER_NETWORK_MTU=1500
|
|
|
|
# Repo-relative path of the package build/install script.
|
|
INFINITO_PACKAGE_INSTALL_SCRIPT=scripts/install/package.sh
|
|
|
|
# GHCR owner of the pkgmgr base image. Composed into INFINITO_PARENT_IMAGE by utils/env/handlers/infinito/parent_image.py.
|
|
INFINITO_PARENT_IMAGE_OWNER=kevinveenbirkenbach
|
|
|
|
# Tag of the pkgmgr base image. Composed into INFINITO_PARENT_IMAGE by utils/env/handlers/infinito/parent_image.py.
|
|
INFINITO_PARENT_IMAGE_TAG=stable
|
|
|
|
# Variant of the pkgmgr base image. Currently only `full` is supported.
|
|
INFINITO_PARENT_IMAGE_VARIANT=full
|
|
|
|
# `true` keeps Playwright trace, screenshot, and video for every test; default `false` retains them only on failure.
|
|
INFINITO_PLAYWRIGHT_KEEP=false
|
|
|
|
# When `true`, the CI down-handler skips wiping the Docker volume so layer cache survives across jobs.
|
|
INFINITO_PRESERVE_DOCKER_CACHE=false
|
|
|
|
# App ids leading the CI deploy list; they get chunks of their own ahead of the regular rows.
|
|
INFINITO_PRIORITY=
|
|
|
|
# When `false`, the dev-stack container publishes no host ports (nested runner deploys share the outer daemon via DooD).
|
|
INFINITO_PUBLISH_PORTS=true
|
|
|
|
# Docker pull policy compose applies; generator overrides to `always` on GHA.
|
|
INFINITO_PULL_POLICY=never
|
|
|
|
# Repo-relative path of the system python install script.
|
|
INFINITO_PYTHON_INSTALL_SCRIPT=roles/dev-python/files/shell/install.sh
|
|
|
|
# The compose deploy runs the recover drill between PASS 1 and PASS 2 (backup/recover verification); set `false` to skip.
|
|
INFINITO_RECOVER_DRILL=true
|
|
|
|
# Absolute path of the repository root on the runner host; passed through to nested Ansible invocations.
|
|
INFINITO_REPO_ROOT=
|
|
|
|
# Per-runner CI storage budget; roles needing more are dropped from the matrix (scripts/meta/resolve/apps.sh).
|
|
INFINITO_REQUIRED_STORAGE=60GB
|
|
|
|
# Runner-side collection root for CI rescue diagnostics; uploaded as artifact (in-container snapshots use INFINITO_RESCUE_DIAGNOSTICS_DIR).
|
|
INFINITO_RESCUE_DIAGNOSTICS_BASE=/tmp/rescue-diagnostics
|
|
|
|
# Prefix applied to per-runner Docker Compose project names and container labels; empty in non-runner contexts.
|
|
INFINITO_RUNNER_PREFIX=infinito
|
|
|
|
# True when running under nektos/act locally; generator overrides via runtime detection.
|
|
INFINITO_RUNNING_ON_ACT=false
|
|
|
|
# True when running on real GitHub Actions; generator overrides via runtime detection.
|
|
INFINITO_RUNNING_ON_GITHUB=false
|
|
|
|
# Extra flags forwarded verbatim to 'docker run' by 'make run'.
|
|
INFINITO_RUN_FLAGS=
|
|
|
|
# Git repository holding the agent skills (skills-lock.json + make project target); developers override this with their own repo.
|
|
INFINITO_SKILLS_REPOSITORY=https://github.com/kevinveenbirkenbach/skills
|
|
|
|
# Absolute path to the bind-mounted repo root inside the dev container.
|
|
INFINITO_SRC_DIR=/opt/src/infinito
|
|
|
|
# CIDR of the internal docker bridge used by the compose stack.
|
|
INFINITO_SUBNET=172.30.0.0/24
|
|
|
|
# Fixed lab IP of the DR-drill backup host.
|
|
INFINITO_SWARM_BACKUP_IP=192.168.244.14
|
|
|
|
# Private-key path for the DR-drill backup user; write_extras generates the pair, the drill installs it on the backup host.
|
|
INFINITO_SWARM_BACKUP_KEY=/tmp/swarm-nfs-backup.key
|
|
|
|
# Pull-only backup-host base name in the act-swarm-test cluster; a non-swarm systemd node that mirrors the schema's arch-server2.
|
|
INFINITO_SWARM_BACKUP_NAME=swarm-bkp-01
|
|
|
|
# Lab bridge-network base name linking the act-swarm-test containers.
|
|
INFINITO_SWARM_LAB_NET_NAME=swarm-lab
|
|
|
|
# Lab bridge-network subnet of the act-swarm-test cluster; the node IPs must live inside it.
|
|
INFINITO_SWARM_LAB_SUBNET=192.168.244.0/24
|
|
|
|
# Fixed lab IP of the manager node (pinned via extra_hosts on every node so multi-network DNS stays deterministic).
|
|
INFINITO_SWARM_MGR_IP=192.168.244.10
|
|
|
|
# Manager-node base name in the act-swarm-test cluster (prefixed with the cluster id at runtime).
|
|
INFINITO_SWARM_MGR_NAME=swarm-mgr-01
|
|
|
|
# Fixed lab IP of the NFS-server sidecar.
|
|
INFINITO_SWARM_NFS_IP=192.168.244.13
|
|
|
|
# NFS-server sidecar base name in the act-swarm-test cluster.
|
|
INFINITO_SWARM_NFS_NAME=nfs-server
|
|
|
|
# Process ceiling per DinD node.
|
|
INFINITO_SWARM_NODE_PIDS_LIMIT=8192
|
|
|
|
# Ceiling in minutes for one distro's swarm matrix deploy in scripts/tests/deploy/swarm/routine/00_one.sh; swarm's step level.
|
|
INFINITO_SWARM_STEP_TIMEOUT_MINUTES=350
|
|
|
|
# Docker label stamped on every act-swarm-test container (DinD + NFS sidecar) so cleanup selects by label, not a guessed name.
|
|
INFINITO_SWARM_TEST_LABEL=infinito.swarm-test
|
|
|
|
# Fixed lab IP of worker node 1.
|
|
INFINITO_SWARM_WRK1_IP=192.168.244.11
|
|
|
|
# Worker-node-1 base name in the act-swarm-test cluster.
|
|
INFINITO_SWARM_WRK1_NAME=swarm-wrk-01
|
|
|
|
# Fixed lab IP of worker node 2.
|
|
INFINITO_SWARM_WRK2_IP=192.168.244.12
|
|
|
|
# Worker-node-2 base name in the act-swarm-test cluster.
|
|
INFINITO_SWARM_WRK2_NAME=swarm-wrk-02
|
|
|
|
# Glob `unittest discover -p` applies when running the test suites.
|
|
INFINITO_TEST_PATTERN=test*.py
|
|
|
|
# Where scripts/tests/code/wrapper.sh executes the test run: docker | host.
|
|
INFINITO_TEST_RUNNER=docker
|
|
|
|
# Integer multiplier applied to Ansible retry/delay values on slow self-hosted hardware; 1 = no scaling.
|
|
INFINITO_TIMEOUT_MULTIPLIER=1
|
|
|
|
# Tor axis of the CI deploy matrix: auto | enforced | exclusive | disabled. exclusive also drops the variants that cannot take an onion.
|
|
INFINITO_TOR=auto
|
|
|
|
# Node Tor SOCKS port; set by the env handler from svc-net-tor services.tor.ports.local.socks (SPOT).
|
|
INFINITO_TOR_SOCKS_PORT=
|
|
|
|
# Variant overlay (applications.<app> services/credentials) baked per round by the swarm matrix orchestrator; empty elsewhere.
|
|
INFINITO_VARS_PAYLOAD=
|
|
|
|
# Absolute path of the project virtualenv inside the dev container (and on the host when /opt is writable).
|
|
INFINITO_VENV_DIR=/opt/venvs/infinito
|
|
|
|
# Seconds 'make up' waits for the infinito container healthcheck before failing.
|
|
INFINITO_WAIT_HEALTH_TIMEOUT_S=600
|
|
|
|
# Optional app-discovery filter consumed by scripts/meta/resolve/apps.sh and the GHA workflow.
|
|
INFINITO_WHITELIST=
|
|
|
|
# Master toggle for the worker SPOT chain (INFINITO_WORKER_CPU / _FETCH); falsy values: 0/false/no/off.
|
|
INFINITO_WORKER_ENABLED=true
|
|
|
|
# Track directories scripts/tests/workspace/00_orchestrator.sh runs, in the order given.
|
|
INFINITO_WORKSPACE_TRACKS=base compose swarm
|