talos — Conduction CI platform

Self-hosted forgejo-runners on Kubernetes that run Codeberg (Forgejo) Actions for the Conduction organisation, on the production cluster con-prod, in an isolated namespace (con-ci). It replaces Codeberg's hosted runners (resource limits / fair-use on a non-profit) with our own GitOps-managed, isolated, build-capable substrate.

What runs

Codeberg (forge: source of truth + job queue)
   │  long-poll (daemon-initiated, outbound only)
   ▼
forgejo-runner ──► egress-proxy + FQDN allowlist ──► codeberg.org · apps.nextcloud.com
(in con-ci, isolated)                                api.anthropic.com · ghcr.io …

• Two runner types, by label:
  • con-ci — host backend: light checks (lint/Semgrep/Trivy), ops, and building OCI images (rootless buildah).
  • con-ci-oci — rootless container backend: jobs that run inside a container: image, and Hydra personas. (arriving via the runner-container-backend work.)
• Hardened: non-root, default-deny egress through an FQDN allowlist proxy, namespace isolation (east-west deny) + ResourceQuota/LimitRange, secrets SOPS+age-encrypted in git.

Using it (per repo)

1. Enable Actions on the Codeberg repo (Settings → Units → Actions). This is the allowlist — a repo without Actions can't use the runners.
2. In .forgejo/workflows/*.yaml, set runs-on: con-ci (host) or runs-on: con-ci-oci (container). Generic labels (docker, ubuntu-latest) are not served — jobs on them sit queued forever.
3. Recommended — add the label guardrail so a wrong label fails at commit time: the forgejo-runs-on pre-commit hook (see docs/onboarding.md).

Setup / operate

• GitOps: Kubernetes manifests live in manifests/ (base + components + overlays/con-prod) and are synced by ArgoCD (Application talos). No application code in this repo.
• All kubectl/argocd examples use an explicit --kubeconfig <path> (no aliases) for the audit trail.
• Enrolling runners/repos, ArgoCD bootstrap and the SOPS runbook are in docs/onboarding.md.

Docs

• docs/components/ — a short page per component (runner, runner-oci, egress, isolation, secrets, gitops-delivery, runner-build, ci-flows) for maintainers.
• docs/onboarding.md — enrollment, ArgoCD, SOPS, label rules.
• docs/risk-acceptance-ci-on-prod.md — running CI on the production cluster: residual risk + mitigations.

Licence

EUPL-1.2 — Conduction standard.