feat(ci_ephemeral_provisioner): alert before the Tailscale auth key expires

jfraeys commented

2026-10-08 20:20:57 -04:00

Owner

Stacked on #23 (fix/deploy-services-authkey-env): merge that first, or this PR also shows its commits. deploy-services.sh records the key expiry (CI_EPHEMERAL_TAILSCALE_AUTHKEY_EXPIRES_AT, Unix seconds) when it mints a key; the role writes it as a node-exporter textfile metric (skipped when unset so a known value is never blanked, malformed values fail the play); Prometheus warns 48h before expiry (CIEphemeralAuthKeyExpiringSoon) and goes critical once expired (CIEphemeralAuthKeyExpired), via the existing Alertmanager email route. After merging, deploy the role and Prometheus with the current key expiry exported (conservatively 1792101600, 2026-10-15 22:00Z). Tested: stubbed script runs, rendered alert YAML, local Ansible run of the assert and metric task; PromQL not run through promtool (not installed), not deployed. -- Generated with Claude Code

Stacked on #23 (fix/deploy-services-authkey-env): merge that first, or this PR also shows its commits. deploy-services.sh records the key expiry (CI_EPHEMERAL_TAILSCALE_AUTHKEY_EXPIRES_AT, Unix seconds) when it mints a key; the role writes it as a node-exporter textfile metric (skipped when unset so a known value is never blanked, malformed values fail the play); Prometheus warns 48h before expiry (CIEphemeralAuthKeyExpiringSoon) and goes critical once expired (CIEphemeralAuthKeyExpired), via the existing Alertmanager email route. After merging, deploy the role and Prometheus with the current key expiry exported (conservatively 1792101600, 2026-10-15 22:00Z). Tested: stubbed script runs, rendered alert YAML, local Ansible run of the assert and metric task; PromQL not run through promtool (not installed), not deployed. -- Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 5 commits

2026-10-08 20:20:57 -04:00

fix(deploy-services): keep the caller's authkey over .env, mint 168h keys 33917f8d2b

The script sourced .env after the caller's exports, so a stale
CI_EPHEMERAL_TAILSCALE_AUTHKEY line there overrode a freshly minted key and
the deploy kept writing the expired one. Snapshot the caller's
CI_EPHEMERAL_TAILSCALE_AUTHKEY / FORGEJO_RUNNER_APP_SKELETON_DEPLOY_KEY,
drop whatever .env or vault set for them (with a warning), then restore the
caller's. The self-minted key now lasts 168h instead of 4h: the provisioner
reuses it for every VM cycle until the next deploy.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(ci_ephemeral_provisioner): don't blank the installed app-skeleton deploy key f56be67b34

The install task wrote the exported key unconditionally, so a deploy run
without FORGEJO_RUNNER_APP_SKELETON_DEPLOY_KEY replaced the installed key
with an empty file. force is now true only when a key was supplied; the file
is still created when absent because the provisioner script opens it every
cycle.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs(ci_ephemeral_provisioner): note why the deploy key task uses force, not when

Lint / lint (pull_request) Successful in 1m22s

Details

52126669c7

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

feat(ci_ephemeral_provisioner): alert before the Tailscale auth key expires 431bd8a77e

deploy-services.sh records the key's expiry when it mints one
(CI_EPHEMERAL_TAILSCALE_AUTHKEY_EXPIRES_AT, Unix seconds); the role writes it
as a node-exporter textfile metric, and Prometheus warns 48h before expiry
and goes critical once expired, reaching the existing Alertmanager email
route. A deploy without an expiry leaves the last known metric in place; a
malformed value fails the play.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs(ci_ephemeral_provisioner): drop the wrong history from the app-skeleton deploy key comment

Lint / lint (pull_request) Successful in 1m17s

Details

abcb33f04c

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit 8fcae645dc into main

2026-10-08 20:22:03 -04:00

jfraeys referenced this pull request from a commit

2026-10-08 20:22:05 -04:00

Merge pull request 'feat(ci_ephemeral_provisioner): alert before the Tailscale auth key expires' (#24) from jfraeys/feat/authkey-expiry-alert into main

Rows
Columns

feat(ci_ephemeral_provisioner): alert before the Tailscale auth key expires #24