deploy: build on push to main and land the binary on the mining hosts #12

grenade · 2026-09-03T10:29:16Z

grenade commented

2026-09-03 10:29:16 +00:00

Implements #8 (single-binary form). After this merges, the miner on benjy and quadbrat follows main of this repo; lair/quantus#4 retires the release-pinned deploy-miner there.

What changed

.gitea/workflows/deploy.yaml

build on cuda-13.0: Fedora 43 like the hosts (the rust runner's binaries fail on them with GLIBC_2.43 not found) and the runner with nvcc for #3. MINER_BUILD_SHA is the pushed commit, so --version identifies the deploy.
deploy on fedora-43, matrix of benjy and quadbrat (beast present, commented out per the policy in #1): sudoers preflight against deploy/infra-setup.sh, credentials copied from the node host, miner.env rendered with the node's mesh IP resolved on the miner host, checksum-gated push of binary and unit, scoped firewalld rule for the exporter, restart only on change. All of that is lair/quantus's step moved verbatim.
validate: unit active, --version carries this commit (informational in validate mode), miner_gpu_devices equals the matrix row, miner_hashes_total advances within 120 s (a poll, since the miner reconnects after restart).
rollback: when validate fails on a run that restarted, the previous binary (kept as .prev before the push) is restored and the miner restarted.
Triggers: push to main except markdown and the other two workflows; workflow_dispatch with mode: deploy | validate.

deploy/: the unit, sysusers, firewalld service and env template from lair/quantus asset/, unchanged. infra-setup.sh is the miner role of lair/quantus's script plus two cp grants for the rollback. Applied to benjy and quadbrat on 2026-09-03 and verified. README.md carries the traps from lair/quantus's CLAUDE.md that apply to the miner.

Validation

bash -n and YAML parse clean.
A validate-mode dispatch of this workflow from this branch runs against the hosts as currently deployed by lair/quantus (see the Actions tab). Build, reachability, preflight and validate must pass; the version check is informational in that mode because the hosts still run lair/quantus's v4.0.2 build.
The first deploy-mode run is the merge of this PR. It will replace the binary on both hosts (the build differs from origin's by build.rs) and restart them, which is the point: from then on the baseline is a deployment this repo made.

Cut-over

Merge this, watch the run on main, then lair/quantus#4 step 2: remove fetch's miner half and deploy-miner there. Never both in deploy mode.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CBgs2nSi4H2mdh8kD8vMX5

Implements #8 (single-binary form). After this merges, the miner on benjy and quadbrat follows `main` of this repo; lair/quantus#4 retires the release-pinned `deploy-miner` there. ## What changed **`.gitea/workflows/deploy.yaml`** - `build` on `cuda-13.0`: Fedora 43 like the hosts (the `rust` runner's binaries fail on them with `GLIBC_2.43 not found`) and the runner with nvcc for #3. `MINER_BUILD_SHA` is the pushed commit, so `--version` identifies the deploy. - `deploy` on `fedora-43`, matrix of benjy and quadbrat (beast present, commented out per the policy in #1): sudoers preflight against `deploy/infra-setup.sh`, credentials copied from the node host, `miner.env` rendered with the node's mesh IP resolved on the miner host, checksum-gated push of binary and unit, scoped firewalld rule for the exporter, restart only on change. All of that is lair/quantus's step moved verbatim. - `validate`: unit active, `--version` carries this commit (informational in validate mode), `miner_gpu_devices` equals the matrix row, `miner_hashes_total` advances within 120 s (a poll, since the miner reconnects after restart). - `rollback`: when validate fails on a run that restarted, the previous binary (kept as `.prev` before the push) is restored and the miner restarted. - Triggers: push to `main` except markdown and the other two workflows; `workflow_dispatch` with `mode: deploy | validate`. **`deploy/`**: the unit, sysusers, firewalld service and env template from lair/quantus `asset/`, unchanged. `infra-setup.sh` is the miner role of lair/quantus's script plus two `cp` grants for the rollback. Applied to benjy and quadbrat on 2026-09-03 and verified. `README.md` carries the traps from lair/quantus's `CLAUDE.md` that apply to the miner. ## Validation - `bash -n` and YAML parse clean. - A `validate`-mode dispatch of this workflow from this branch runs against the hosts as currently deployed by lair/quantus (see the Actions tab). Build, reachability, preflight and validate must pass; the version check is informational in that mode because the hosts still run lair/quantus's v4.0.2 build. - The first `deploy`-mode run is the merge of this PR. It will replace the binary on both hosts (the build differs from origin's by `build.rs`) and restart them, which is the point: from then on the baseline is a deployment this repo made. ## Cut-over Merge this, watch the run on `main`, then lair/quantus#4 step 2: remove `fetch`'s miner half and `deploy-miner` there. Never both in deploy mode. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CBgs2nSi4H2mdh8kD8vMX5

grenade added 1 commit 2026-09-03 10:29:17 +00:00

deploy: build on push to main and land the binary on the mining hosts

ci / fmt (pull_request) Successful in 24s

Details

ci / clippy (pull_request) Successful in 1m38s

Details

ci / doc (pull_request) Successful in 2m0s

Details

ci / test (pull_request) Successful in 7m47s

Details

b9e1d21ec9

quantus/miner#8. The miner is now deployed from this repo, not from
lair/quantus's release-pinned workflow (lair/quantus#4 retires that half).

- .gitea/workflows/deploy.yaml: build on cuda-13.0 (Fedora 43 like the
  hosts, and the runner with nvcc for #3) with the commit embedded, then per
  host in the matrix: sudoers preflight against deploy/infra-setup.sh,
  credentials copied from the node, miner.env rendered with the node's mesh
  IP resolved on the miner host, checksum-gated push of binary and unit,
  scoped firewalld rule for the exporter, restart only on change. Validate
  asserts the unit is active, --version carries this commit, the miner sees
  the matrix's device count, and miner_hashes_total advances within 120 s.
  If validate fails after a restart, the previous binary is restored.
- deploy/: the unit, sysusers, firewalld service and env template moved
  verbatim from lair/quantus asset/, plus infra-setup.sh with the miner role
  (and two new cp grants for the rollback). Applied to benjy and quadbrat.
- Matrix: benjy and quadbrat; beast present but commented out per the
  operating policy in #1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CBgs2nSi4H2mdh8kD8vMX5

grenade referenced this issue from a commit

2026-09-03 10:30:41 +00:00

retire deploy-miner: the miner now deploys from quantus/miner

grenade referenced this pull request from lair/quantus

2026-09-03 10:30:55 +00:00

retire deploy-miner: the miner now deploys from quantus/miner #6

grenade merged commit 95b6420793 into main

2026-09-03 10:33:18 +00:00

grenade deleted branch deploy/on-main

2026-09-03 10:33:18 +00:00

grenade referenced this issue from a commit

2026-09-03 10:33:19 +00:00