594825aa53
systemd,compose: adjust restart policy
2022-09-28 16:35:26 +02:00
260ad07626
systemd(SystemCallFilter=~): allow resources group
2022-09-28 16:32:40 +02:00
0229ed60ec
systemd: add ExecStartPre directive
2022-09-28 16:31:50 +02:00
0747bb247b
systemd: increase restart timeout to 15s
2022-09-28 16:31:19 +02:00
1687d49526
systemd: adjust dependency relations
2022-09-28 16:31:01 +02:00
f461367c73
systemd: stop delegating cgroups
2022-09-28 16:29:50 +02:00
ea51959b59
systemd: use Environment for DRYness
2022-09-28 16:28:38 +02:00
ab4e6375e0
set RestrictAddressFamilies to unix,ipv4,ipv6
2022-04-20 16:54:52 +02:00
c27499e2d3
rm forgotten comment
2022-04-20 16:53:46 +02:00
2ddfd699c3
restrict all namespaces
2022-04-20 16:52:59 +02:00
02098c63d4
set ProtectProc,ProcSubset
2022-04-20 16:52:11 +02:00
9b6bc98086
tighten Capabilities and SystemCallFilter list
2022-04-20 16:51:14 +02:00
1d34e711f6
run service with "--remove-orphans"
2022-04-20 16:49:23 +02:00
358a77d168
update README.md
2022-03-26 03:13:07 +01:00
38e53c1060
create proper folder structer
2022-03-26 02:55:00 +01:00
e6e2a0233e
runner: {add,enable} tmate
2022-03-20 22:03:56 +01:00
8946441587
adjust runner {capacity,logs,labels,dash ui} conf
2022-03-20 22:01:11 +01:00
efb717f4f5
configure shorter timeout for the zombie reaper
2022-03-20 21:52:02 +01:00
9c91a662fc
expose metrics endpoint for anonymous scrapes
2022-03-20 21:51:26 +01:00
3fa9780020
make self-enrollment explicitly enabled
2022-03-20 21:50:00 +01:00
fd5af2d374
rm ssl host hardcode (available as onion as well)
2022-03-20 21:48:24 +01:00
a4752d70c1
add cookie configuration
2022-03-20 21:47:09 +01:00
c6acd44ffe
add user filter
...
basic sanity check to prevent anybody from registering and running a
cryptominer or similar BS in CI.
note:
any new users in need of access to CI are encouraged to leave us a PR
with appropriate changes to this config line for review
2022-03-20 21:11:29 +01:00
9a671da53b
starlark{ON}, jsonnet{OFF}
...
favour explicit configuration
2022-03-20 21:10:20 +01:00
06c126f270
disable debug and trace logs
2022-03-20 21:07:49 +01:00
88f8739cc7
set cron interval to 10m
2022-03-20 21:06:47 +01:00
8838510ec0
chore(vim): set filetype
2022-03-20 21:03:24 +01:00
2c3835d445
manage system access of the service using systemd
...
* add drone.slice (control resource usage)
* restrict can be accessed by the service
* adjust IO priority and NICEness of processes created withing the
service
* use "-p" with docker-compose invocation to specify a project that the
newly-spawned containers belong to (best practice)
* add commented override
2022-03-20 20:54:52 +01:00
ce2c05646a
feat: as a precaution, have some runner dirs under tmpfs
2020-05-30 11:10:30 +02:00
2c4c23362b
feat: added Unit file for drone
2020-05-29 12:58:04 +02:00
9ae38b5851
feat: added docker-compose.yml + env files
2020-05-29 12:57:21 +02:00
7bbf94a3af
feat: added .gitignore
2020-05-29 12:56:12 +02:00
6ec71e87cd
initial commit
2020-05-29 12:52:54 +02:00
