- Rust 85.6%
- Nix 9%
- Go 3.6%
- Shell 1.6%
- Python 0.2%
tsk
40dedcf653Add named Forgejo registrations with independent credentials, labels, polling, retry backoff, and health status. Share one scheduler and its concurrency, CPU, memory, disk, and template admission limits, rotating admission priority between registrations. Namespace task IDs at the client boundary so overlapping remote IDs keep separate jobs, archives, fetch journals, and delivery retries. Bind saved deliveries to their original server and runner, and preserve legacy IDs and single-registration configuration. Expose NixOS registration options with writable locks and logs for Agenix-managed credentials. Isolate unavailable registration credentials at service startup while retaining strict manual configuration checks. Document configuration, recovery, and credential rotation. Cover shared budgets, fair admission, overlapping IDs, credential isolation, restart recovery, and configuration compatibility with tests. Live multi-registration Firecracker validation remains pending. Fixes #8 |
||
|---|---|---|
| docs | ||
| examples | ||
| forgejo-engine | ||
| nix | ||
| proto/runner/v1 | ||
| src | ||
| templates/custom-guest | ||
| tests | ||
| .gitignore | ||
| build.rs | ||
| Cargo.lock | ||
| Cargo.toml | ||
| flake.lock | ||
| flake.nix | ||
| README.md | ||
| unified-ci-compute-platform.md | ||
Rith
Rith runs Forgejo Actions jobs in disposable Firecracker VMs. A controller registers with Forgejo, selects a NixOS or Ubuntu guest image by job labels, starts a fresh VM, streams logs, and reports the result. Each job gets its own writable rootfs; changes disappear when the VM is cleaned up.
The executable, Rust crate, and NixOS service are currently named unified-ci.
Start with Setup and first CI job. It covers host storage, registration credentials, a complete NixOS deployment example, a first Nix workflow, caching, and troubleshooting.
Current scope
Rith targets x86_64 Linux hosts with systemd, KVM, and Btrfs or reflink-enabled XFS storage. Packaged guests include the pinned Forgejo v13 execution engine, Node.js, Git, and shell tools. NixOS images include Nix with flakes enabled; Ubuntu 24.04 provides its native userspace, apt, and passwordless sudo inside the disposable VM. Docker-capable images are available for both distributions.
The live Forgejo integration smoke covers private repository checkout through real checkout actions, workflow dependencies and outputs, cross-job artifact upload/download, log delivery, and terminal status reporting. Rust and Nix checks cover controller scheduling, recovery, resource admission, and helper policy. The combined hardware smoke additionally exercises VM isolation, cancellation, restart recovery, signed Nix cache substitution, and concurrent VM I/O limits. Both NixOS and Ubuntu hardware suites passed on this workstation; see the validation report for coverage and the Ubuntu archive DNS workaround. Run the suites on each deployment host to check its storage, networking, and virtualization setup.
Compatibility follows the pinned engine and tested workflows. Service containers require an explicit job
container:; host-mode services are rejected rather than silently omitted.
Artifacts use Forgejo storage, and optional Actions caching uses an external
Forgejo Runner cache server with repository-scoped access. Nix binary cache
substitution is separate; build outputs are not automatically uploaded.
Nostr/Cashu settlement is not implemented. State is durable local JSON with exclusive controller ownership,
bounded history, and retry of unacknowledged results; there is no HA controller
or shared multi-controller state backend.
Documentation
- Setup and first CI job
- NixOS deployment example
- Forgejo workflow examples
- Custom guests and Nix caching
- Configuration, status API, and monitoring
- Limits, isolation, recovery, and hardware validation
- Documentation index and architecture notes
Development and validation
From the Rith checkout:
cargo fmt -- --check
cargo test --offline
cargo clippy --all-targets -- -D warnings
nix flake check
nix run .#forgejo-live-smoke
nix run .#ubuntu-guest-smoke # CPU emulation; does not verify Firecracker isolation
On a suitable KVM host, run:
sudo nix run .#firecracker-smoke
sudo nix run .#forgejo-firecracker-smoke
sudo nix run .#forgejo-ubuntu-firecracker-smoke
sudo nix run .#firecracker-egress-smoke
Hardware smoke apps require root, systemd, KVM, and reflink-capable scratch
storage. They return exit code 77 with SKIP when prerequisites are missing;
this is not a pass. The combined test needs four available CPUs, approximately
10 GiB of available RAM, and space for two writable VM images. See the
validation reference for scratch
paths, overrides, and the scenarios each check covers.