From cb9c2513a4786d13bc499ce217f28bca877011c3 Mon Sep 17 00:00:00 2001 From: Mathias Date: Mon, 27 Jul 2026 22:09:52 +0200 Subject: [PATCH] fix(cd): use in-cluster DNS for git.d-ma.be SSH, not 127.0.0.1:30022 act_runner moved from koala's bare host network into a k3s pod (2026-07-26); loopback inside that pod's own network namespace never reaches the host, so the git.d-ma.be SSH override (used to push the infra repo update) failed with "Connection refused". Verified TCP+SSH-handshake reachability to gitea-ssh-nodeport.gitea.svc.cluster.local:22 from inside the actual runner pod before committing this. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01Roq1ajWKR5f1hG5Df9wC6A --- .gitea/workflows/cd.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml index f825516..5f3a59a 100644 --- a/.gitea/workflows/cd.yml +++ b/.gitea/workflows/cd.yml @@ -48,7 +48,11 @@ jobs: mkdir -p ~/.ssh echo "${{ secrets.INFRA_DEPLOY_KEY }}" > ~/.ssh/infra_deploy_key chmod 600 ~/.ssh/infra_deploy_key - printf 'Host git.d-ma.be\n HostName 127.0.0.1\n Port 30022\n StrictHostKeyChecking no\n' >> ~/.ssh/config + # In-cluster DNS to gitea's SSH NodePort service, not 127.0.0.1:30022 + # (that only worked when act_runner ran on koala's bare host network; + # from inside the containerized runner's own pod netns, loopback + # never reaches the host — "Connection refused", found 2026-07-27). + printf 'Host git.d-ma.be\n HostName gitea-ssh-nodeport.gitea.svc.cluster.local\n Port 22\n StrictHostKeyChecking no\n' >> ~/.ssh/config GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \ git clone "${INFRA_REPO}" /tmp/infra-update