hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Wire Forge-native release infrastructure
Some checks failed
Cache: Publish Nix / Publish Nix Cache (push) Waiting to run
Details
Build Rust / Cargo Test (push) Successful in 4m14s
Details
Build Site / Next.js Build (push) Failing after 6s
Details
Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 5s
Details
Lint Governance / BEP Metadata (push) Successful in 0s
Details
Build: Android / Android Rust Core Stub (push) Failing after 23s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-07 05:51:12 -07:00
parent 97c569fb35
commit 002bd382e9
199 changed files with 14268 additions and 185 deletions
Download patch file Download diff file Expand all files Collapse all files

13
services/forgejo-nsc/README.md
View file

@ -152,13 +152,14 @@ generate a Namespace token from the logged-in namespace account, and render the
dispatcher/autoscaler configs into `intake/forgejo_nsc_{dispatcher,autoscaler}.yaml`
plus `intake/forgejo_nsc_token.txt`.
For ongoing operations, use `Scripts/sync-forgejo-nsc-config.sh`:
For ongoing operations, use `Scripts/seal-forgejo-nsc-secrets.sh`:
- `Scripts/sync-forgejo-nsc-config.sh` copies the intake-backed configs and
Namespace token onto `/var/lib/burrow/intake/` on the forge host, reapplies
file ownership for `forgejo-nsc`, and restarts the dispatcher/autoscaler.
- `Scripts/sync-forgejo-nsc-config.sh --rotate-pat` additionally mints a new
Forgejo PAT on the Burrow forge host and refreshes the local intake files.
- `Scripts/seal-forgejo-nsc-secrets.sh --provision` refreshes the local
Namespace token from the logged-in Namespace account, mints a Forgejo PAT,
renders the dispatcher/autoscaler configs, and seals those runtime inputs into
agenix secrets consumed by `burrow-forge`.
- Deploy `burrow-forge` after sealing so the dispatcher and autoscaler consume
the new Namespace credentials.
Run it next to the dispatcher:

4
services/forgejo-nsc/deploy/autoscaler.yaml
View file

@ -25,6 +25,10 @@ instances:
min_idle: 0
ttl: "20m"
machine_type: "8x16"
- labels: ["namespace-profile-macos-large"]
min_idle: 0
ttl: "60m"
machine_type: "macos/arm64:8x16"
- labels: ["namespace-profile-windows-large"]
min_idle: 0
ttl: "45m"

2
services/forgejo-nsc/deploy/dispatcher.yaml
View file

@ -6,7 +6,7 @@ forgejo:
token: "PENDING-FORGEJO-PAT"
default_scope:
level: "repository"
owner: "burrow"
owner: "hackclub"
name: "burrow"
default_labels:
- namespace-profile-linux-medium

139
services/grafana/dashboards/burrow-overview.json Normal file
View file

@ -0,0 +1,139 @@
{
"annotations": {
"list": [
{
"builtIn": 1,
"datasource": {
"type": "grafana",
"uid": "-- Grafana --"
},
"enable": true,
"hide": true,
"iconColor": "rgba(0, 211, 255, 1)",
"name": "Annotations & Alerts",
"target": {
"limit": 100,
"matchAny": false,
"tags": [],
"type": "dashboard"
},
"type": "dashboard"
}
]
},
"editable": true,
"fiscalYearStartMonth": 0,
"graphTooltip": 0,
"id": null,
"links": [],
"liveNow": false,
"panels": [
{
"datasource": {
"type": "grafana",
"uid": "-- Grafana --"
},
"fieldConfig": {
"defaults": {},
"overrides": []
},
"gridPos": {
"h": 6,
"w": 24,
"x": 0,
"y": 0
},
"id": 1,
"options": {
"code": {
"language": "plaintext",
"showLineNumbers": false,
"showMiniMap": false
},
"content": "# Burrow Operations\n\nGrafana is managed by NixOS for service/auth and OpenTofu for API-owned folders and dashboards.\n\nStart here after deploys to add service-specific panels as data sources come online.",
"mode": "markdown"
},
"pluginVersion": "12.3.0",
"title": "Overview",
"type": "text"
},
{
"datasource": {
"type": "grafana",
"uid": "-- Grafana --"
},
"fieldConfig": {
"defaults": {},
"overrides": []
},
"gridPos": {
"h": 6,
"w": 12,
"x": 0,
"y": 6
},
"id": 2,
"options": {
"code": {
"language": "plaintext",
"showLineNumbers": false,
"showMiniMap": false
},
"content": "## Runtime Checks\n\n- `grafana.service` active\n- `https://graphs.burrow.net/login` reachable\n- Authentik generic OAuth login returns to `/login/generic_oauth`\n- OpenTofu dashboard import or apply succeeds",
"mode": "markdown"
},
"pluginVersion": "12.3.0",
"title": "Readiness",
"type": "text"
},
{
"datasource": {
"type": "grafana",
"uid": "-- Grafana --"
},
"fieldConfig": {
"defaults": {},
"overrides": []
},
"gridPos": {
"h": 6,
"w": 12,
"x": 12,
"y": 6
},
"id": 3,
"options": {
"code": {
"language": "plaintext",
"showLineNumbers": false,
"showMiniMap": false
},
"content": "## Ownership\n\nNix owns service startup, SSO, reverse proxy, and secrets.\n\nOpenTofu owns API-created folders and dashboards so visual iteration does not require a host switch.",
"mode": "markdown"
},
"pluginVersion": "12.3.0",
"title": "Control Plane",
"type": "text"
}
],
"refresh": "",
"schemaVersion": 39,
"style": "dark",
"tags": [
"burrow",
"operations"
],
"templating": {
"list": []
},
"time": {
"from": "now-6h",
"to": "now"
},
"timepicker": {},
"timezone": "browser",
"title": "Burrow Overview",
"uid": "burrow-overview",
"version": 1,
"weekStart": ""
}

423
services/grafana/dashboards/headscale.json Normal file
View file

@ -0,0 +1,423 @@
{
"annotations": {
"list": []
},
"editable": true,
"fiscalYearStartMonth": 0,
"graphTooltip": 0,
"id": null,
"links": [],
"panels": [
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"mappings": [
{
"options": {
"0": {
"text": "down"
},
"1": {
"text": "up"
}
},
"type": "value"
}
],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "red",
"value": null
},
{
"color": "green",
"value": 1
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 4,
"w": 6,
"x": 0,
"y": 0
},
"id": 1,
"options": {
"colorMode": "background",
"graphMode": "none",
"justifyMode": "center",
"orientation": "auto",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showPercentChange": false,
"textMode": "value_and_name",
"wideLayout": true
},
"pluginVersion": "11.0.0",
"targets": [
{
"expr": "up{job=\"$job\"}",
"legendFormat": "headscale scrape",
"refId": "A"
}
],
"title": "Scrape",
"type": "stat"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"mappings": [
{
"options": {
"0": {
"text": "inactive"
},
"1": {
"text": "active"
}
},
"type": "value"
}
],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "red",
"value": null
},
{
"color": "green",
"value": 1
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 4,
"w": 6,
"x": 6,
"y": 0
},
"id": 2,
"options": {
"colorMode": "background",
"graphMode": "none",
"justifyMode": "center",
"orientation": "auto",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showPercentChange": false,
"textMode": "value_and_name",
"wideLayout": true
},
"pluginVersion": "11.0.0",
"targets": [
{
"expr": "max(node_systemd_unit_state{name=\"headscale.service\",state=\"active\"}) or vector(0)",
"legendFormat": "headscale service",
"refId": "A"
}
],
"title": "Service",
"type": "stat"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"unit": "short"
},
"overrides": []
},
"gridPos": {
"h": 4,
"w": 6,
"x": 12,
"y": 0
},
"id": 3,
"options": {
"colorMode": "none",
"graphMode": "area",
"justifyMode": "center",
"orientation": "auto",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showPercentChange": false,
"textMode": "value_and_name",
"wideLayout": true
},
"pluginVersion": "11.0.0",
"targets": [
{
"expr": "headscale_nodes_total or headscale_machine_count or headscale_node_count or vector(0)",
"legendFormat": "nodes",
"refId": "A"
}
],
"title": "Tailnet Nodes",
"type": "stat"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"unit": "reqps"
},
"overrides": []
},
"gridPos": {
"h": 4,
"w": 6,
"x": 18,
"y": 0
},
"id": 4,
"options": {
"colorMode": "none",
"graphMode": "area",
"justifyMode": "center",
"orientation": "auto",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showPercentChange": false,
"textMode": "value_and_name",
"wideLayout": true
},
"pluginVersion": "11.0.0",
"targets": [
{
"expr": "sum(rate(headscale_http_requests_total[5m])) or vector(0)",
"legendFormat": "http requests",
"refId": "A"
}
],
"title": "HTTP Rate",
"type": "stat"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"fillOpacity": 12,
"lineInterpolation": "linear",
"lineWidth": 2,
"pointSize": 5,
"showPoints": "never",
"spanNulls": false
},
"unit": "short"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 0,
"y": 4
},
"id": 5,
"options": {
"legend": {
"calcs": [
"lastNotNull"
],
"displayMode": "table",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"targets": [
{
"expr": "headscale_nodes_total or headscale_machine_count or headscale_node_count or vector(0)",
"legendFormat": "nodes",
"refId": "A"
}
],
"title": "Tailnet Node Count",
"type": "timeseries"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"fillOpacity": 12,
"lineInterpolation": "linear",
"lineWidth": 2,
"pointSize": 5,
"showPoints": "never",
"spanNulls": false
},
"unit": "reqps"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 12,
"y": 4
},
"id": 6,
"options": {
"legend": {
"calcs": [
"lastNotNull"
],
"displayMode": "table",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"targets": [
{
"expr": "sum by (code,method) (rate(headscale_http_requests_total[5m])) or vector(0)",
"legendFormat": "{{method}} {{code}}",
"refId": "A"
}
],
"title": "Headscale HTTP Requests",
"type": "timeseries"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"custom": {
"align": "auto",
"cellOptions": {
"type": "auto"
},
"inspect": false
}
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 24,
"x": 0,
"y": 12
},
"id": 7,
"options": {
"cellHeight": "sm",
"footer": {
"countRows": false,
"fields": "",
"reducer": [
"sum"
],
"show": false
},
"showHeader": true
},
"targets": [
{
"expr": "max by (name,state) (node_systemd_unit_state{name=~\"headscale.service|tailscaled.service\",state=~\"active|failed|activating\"})",
"format": "table",
"instant": true,
"refId": "A"
}
],
"title": "Tailnet Service Units",
"type": "table"
}
],
"refresh": "30s",
"schemaVersion": 39,
"tags": [
"burrow",
"headscale",
"tailnet"
],
"templating": {
"list": [
{
"current": {
"selected": false,
"text": "headscale",
"value": "headscale"
},
"hide": 2,
"name": "job",
"query": "headscale",
"type": "constant"
}
]
},
"time": {
"from": "now-6h",
"to": "now"
},
"timepicker": {},
"timezone": "browser",
"title": "Burrow Headscale",
"uid": "burrow-headscale",
"version": 1,
"weekStart": ""
}

477
services/grafana/dashboards/observability.json Normal file
View file

@ -0,0 +1,477 @@
{
"annotations": {
"list": []
},
"editable": true,
"fiscalYearStartMonth": 0,
"graphTooltip": 0,
"id": null,
"links": [],
"panels": [
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"mappings": [
{
"options": {
"0": {
"text": "down"
},
"1": {
"text": "up"
}
},
"type": "value"
}
],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "red",
"value": null
},
{
"color": "green",
"value": 1
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 6,
"w": 8,
"x": 0,
"y": 0
},
"id": 1,
"options": {
"displayMode": "gradient",
"legend": {
"calcs": [],
"displayMode": "list",
"placement": "bottom",
"showLegend": true
},
"minVizHeight": 10,
"minVizWidth": 0,
"namePlacement": "auto",
"orientation": "horizontal",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showUnfilled": true,
"sizing": "auto",
"valueMode": "color"
},
"pluginVersion": "11.0.0",
"targets": [
{
"expr": "up{job=~\"prometheus|grafana|headscale|otel-collector|jaeger|node|systemd|tailscale|garage\"}",
"legendFormat": "{{job}}",
"refId": "A"
}
],
"title": "Scrape Health",
"type": "bargauge"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"mappings": [
{
"options": {
"0": {
"text": "inactive"
},
"1": {
"text": "active"
}
},
"type": "value"
}
],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "red",
"value": null
},
{
"color": "green",
"value": 1
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 6,
"w": 8,
"x": 8,
"y": 0
},
"id": 2,
"options": {
"displayMode": "gradient",
"legend": {
"calcs": [],
"displayMode": "list",
"placement": "bottom",
"showLegend": true
},
"minVizHeight": 10,
"minVizWidth": 0,
"namePlacement": "auto",
"orientation": "horizontal",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showUnfilled": true,
"sizing": "auto",
"valueMode": "color"
},
"pluginVersion": "11.0.0",
"targets": [
{
"expr": "max by (name) (node_systemd_unit_state{name=~\"grafana.service|prometheus.service|opentelemetry-collector.service|podman-burrow-jaeger.service|headscale.service|tailscaled.service|forgejo.service\",state=\"active\"})",
"legendFormat": "{{name}}",
"refId": "A"
}
],
"title": "Service State",
"type": "bargauge"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"unit": "short"
},
"overrides": []
},
"gridPos": {
"h": 6,
"w": 8,
"x": 16,
"y": 0
},
"id": 3,
"options": {
"colorMode": "none",
"graphMode": "area",
"justifyMode": "center",
"orientation": "auto",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showPercentChange": false,
"textMode": "value_and_name",
"wideLayout": true
},
"pluginVersion": "11.0.0",
"targets": [
{
"expr": "sum(otelcol_receiver_accepted_spans) or sum(otelcol_receiver_refused_spans) or vector(0)",
"legendFormat": "collector spans",
"refId": "A"
}
],
"title": "OTLP Spans",
"type": "stat"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"fillOpacity": 12,
"lineInterpolation": "linear",
"lineWidth": 2,
"pointSize": 5,
"showPoints": "never",
"spanNulls": false
},
"unit": "short"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 0,
"y": 6
},
"id": 4,
"options": {
"legend": {
"calcs": [
"lastNotNull"
],
"displayMode": "table",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"targets": [
{
"expr": "sum by (receiver,transport) (rate(otelcol_receiver_accepted_spans[5m])) or vector(0)",
"legendFormat": "{{receiver}} {{transport}}",
"refId": "A"
},
{
"expr": "sum by (exporter) (rate(otelcol_exporter_sent_spans[5m])) or vector(0)",
"legendFormat": "exported {{exporter}}",
"refId": "B"
}
],
"title": "OpenTelemetry Trace Flow",
"type": "timeseries"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"fillOpacity": 12,
"lineInterpolation": "linear",
"lineWidth": 2,
"pointSize": 5,
"showPoints": "never",
"spanNulls": false
},
"unit": "short"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 12,
"y": 6
},
"id": 5,
"options": {
"legend": {
"calcs": [
"lastNotNull"
],
"displayMode": "table",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"targets": [
{
"expr": "sum(rate(jaeger_collector_spans_received_total[5m])) or sum(rate(jaeger_collector_traces_received_total[5m])) or vector(0)",
"legendFormat": "jaeger received",
"refId": "A"
},
{
"expr": "sum(rate(jaeger_query_requests_total[5m])) or vector(0)",
"legendFormat": "jaeger queries",
"refId": "B"
}
],
"title": "Jaeger Activity",
"type": "timeseries"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"fillOpacity": 12,
"lineInterpolation": "linear",
"lineWidth": 2,
"pointSize": 5,
"showPoints": "never",
"spanNulls": false
},
"unit": "percentunit"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 0,
"y": 14
},
"id": 6,
"options": {
"legend": {
"calcs": [
"lastNotNull"
],
"displayMode": "table",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"targets": [
{
"expr": "1 - avg by (instance) (rate(node_cpu_seconds_total{mode=\"idle\"}[5m]))",
"legendFormat": "{{instance}}",
"refId": "A"
}
],
"title": "Host CPU",
"type": "timeseries"
},
{
"datasource": {
"type": "prometheus",
"uid": "prometheus"
},
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"fillOpacity": 12,
"lineInterpolation": "linear",
"lineWidth": 2,
"pointSize": 5,
"showPoints": "never",
"spanNulls": false
},
"unit": "percentunit"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 12,
"y": 14
},
"id": 7,
"options": {
"legend": {
"calcs": [
"lastNotNull"
],
"displayMode": "table",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"targets": [
{
"expr": "1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)",
"legendFormat": "{{instance}}",
"refId": "A"
}
],
"title": "Host Memory",
"type": "timeseries"
},
{
"datasource": {
"type": "jaeger",
"uid": "jaeger"
},
"gridPos": {
"h": 8,
"w": 24,
"x": 0,
"y": 22
},
"id": 8,
"options": {
"showHeader": true
},
"targets": [
{
"datasource": {
"type": "jaeger",
"uid": "jaeger"
},
"limit": 20,
"operation": "",
"queryType": "search",
"refId": "A",
"service": "burrow"
}
],
"title": "Recent Burrow Traces",
"type": "traces"
}
],
"refresh": "30s",
"schemaVersion": 39,
"tags": [
"burrow",
"observability",
"opentelemetry",
"jaeger"
],
"templating": {
"list": []
},
"time": {
"from": "now-6h",
"to": "now"
},
"timepicker": {},
"timezone": "browser",
"title": "Burrow Observability",
"uid": "burrow-observability",
"version": 1,
"weekStart": ""
}

25
services/mcp-hub/README.md Normal file
View file

@ -0,0 +1,25 @@
# Burrow MCP Hub Extraction
This directory is the in-repo extraction plan for a dedicated MCP hub repository.
Target repository:
```text
compatible.systems/burrow/mcp-hub
```
The hub should expose Burrow-operated tools for:
- Authentik users, groups, OIDC, SAML, SCIM, and WIF applications
- OpenBao mounts, policies, AppRole, and secret-read workflows
- Google KMS key catalog, public-key export, and signing readiness
- Forgejo workflow dispatch, runner identity, and Namespace runner status
- Grafana dashboard and alert checks
- Jitsi meeting readiness and service health
- mail and webmail readiness after the Stalwart phase starts
- release signing, store upload readiness, and distribution metadata checks
- agent identity inventory derived from `contributors.nix`
The hub must keep identity and authorization explicit. Agent identities should be
named, attributable, and backed by Authentik/WIF or OpenBao AppRole rather than
static shared tokens.