rob thijssen
b9e1d21ec9
quantus/miner#8. The miner is now deployed from this repo, not from lair/quantus's release-pinned workflow (lair/quantus#4 retires that half). - .gitea/workflows/deploy.yaml: build on cuda-13.0 (Fedora 43 like the hosts, and the runner with nvcc for #3) with the commit embedded, then per host in the matrix: sudoers preflight against deploy/infra-setup.sh, credentials copied from the node, miner.env rendered with the node's mesh IP resolved on the miner host, checksum-gated push of binary and unit, scoped firewalld rule for the exporter, restart only on change. Validate asserts the unit is active, --version carries this commit, the miner sees the matrix's device count, and miner_hashes_total advances within 120 s. If validate fails after a restart, the previous binary is restored. - deploy/: the unit, sysusers, firewalld service and env template moved verbatim from lair/quantus asset/, plus infra-setup.sh with the miner role (and two new cp grants for the rollback). Applied to benjy and quadbrat. - Matrix: benjy and quadbrat; beast present but commented out per the operating policy in #1. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CBgs2nSi4H2mdh8kD8vMX5
2.5 KiB
2.5 KiB
deploy
Everything the CI deploy of the miner ships or needs (.gitea/workflows/deploy.yaml).
Moved from lair/quantus on 2026-09-03 so that one repo owns the deployed miner;
the fleet's monitoring, GPU power limits and nvidia metrics stay there.
| File | Lands at |
|---|---|
quantus-miner.service |
/etc/systemd/system/quantus-miner.service |
quantus-miner.sysusers.conf |
/etc/sysusers.d/quantus-miner.conf |
quantus-miner-metrics.xml |
/etc/firewalld/services/quantus-miner-metrics.xml |
miner.env.tmpl |
rendered to /etc/quantus-miner/miner.env |
infra-setup.sh |
operator-run once per host; installs the gitea_ci sudoers |
The miner's credentials are generated by the node and copied host-to-host by the deploy on every run. Nothing secret lives here.
Traps, all previously hit
- Adding a file or privileged command means re-running
infra-setup.sh. The deploy preflights the host'ssudo -n -lagainst the script's SUDO block and names the missing paths, instead of failing partway withsudo: a password is required. - Deploys must be no-ops when nothing changed.
push()usesrsync -ic(checksum). The artifact is rebuilt every run so mtimes always differ. Restart only on an itemised content change. --node-addrtakes an IP, not a name. It parses as a RustSocketAddrwith no DNS. The deploy resolves the node on the miner host and renders the literal; the10.xnever enters the repo.- Pipes in validate steps. The shell is
bash -e -o pipefail; a reader that exits early (awk ... exit,grep -q,head) SIGPIPEs the writer, exit 141. Capture into a variable and parse with a here-string. - ssh argument quoting.
run()isssh ... "$@"and the remote shell re-splits; any argument with a space is passed as one pre-quoted string. PrivateDevices=falsein the unit is deliberate: the miner needs/dev/nvidia*.systemctl is-activeis not evidence of mining. A miner that found no adapter, or never got a job, isactive. Validate assertsminer_hashes_totaladvances andminer_gpu_devicesmatches the matrix.- Binaries must be built on
cuda-13.0(Fedora 43, like the hosts). Therustrunner is Fedora 44; its binaries fail withGLIBC_2.43 not found. - A benchmark (
bench.yaml) stops the miner on its host. A deploy landing on the same host during a measurement would find the unit down and start it mid-window. Both are serialised only by not running them together.