From 585aeeba0541a50fc19ee204c9875093c59c6f12 Mon Sep 17 00:00:00 2001 From: hoelee Date: Fri, 16 Oct 2026 21:32:59 +0800 Subject: [PATCH] ci(deploy): clone over the LAN and bound every step Measured on 2026-10-16: the same archive comes down at ~16 KB/s through git.hoelee.com (Cloudflare -> tunnel -> back to this host) and ~17 MB/s from http://192.168.1.6:3000. The shallow clone had grown to ~13 MB with the image work and one run sat in the middle of index-pack for 13+ minutes with the job hung. The runner is on the same host as Gitea, so it has no reason to leave the LAN; Gitea has no 443 there, so this hop is plain HTTP on the private network and the token stays inside it. Also bounds the deploy: timeout-minutes 15 on the job and -m 30 on the purge call, so a stalled Cloudflare API cannot hold a deploy open. --- .gitea/workflows/deploy.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 7296ad6..b59cf03 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -7,11 +7,19 @@ on: jobs: build: runs-on: ubuntu-latest + # The runner lives on the same host as Gitea: a hang used to sit here for hours. + timeout-minutes: 15 steps: - name: Checkout run: | git config --global --add safe.directory '*' - git clone --depth 1 "https://hoelee:${{ secrets.PAT }}@git.hoelee.com/hoelee/hoelee-blog.git" . + # Clone over the LAN, not through the public hostname. Measured 2026-10-16: + # git.hoelee.com goes out to Cloudflare and back through the tunnel at + # ~16 KB/s (13 min for a shallow clone, once hung for 13+ min mid-pack), + # while http://192.168.1.6:3000 serves the same archive at ~17 MB/s. + # Gitea has no 443 on the LAN, so this hop is plain HTTP on the private + # network — the token never leaves the LAN. + git clone --depth 1 "http://hoelee:${{ secrets.PAT }}@192.168.1.6:3000/hoelee/hoelee-blog.git" . git checkout $GITHUB_SHA 2>/dev/null || true - name: Install dependencies @@ -38,10 +46,11 @@ jobs: exit 0 fi echo "Purging zone ${CF_ZONE_ID} ..." - curl -sS -X POST "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/purge_cache" \ + # -m 30: a hung purge API must never hold the deploy open. + curl -sS -m 30 -X POST "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/purge_cache" \ -H "Authorization: Bearer ${CF_TOKEN}" \ -H "Content-Type: application/json" \ - --data '{"purge_everything":true}' | head -c 400 + --data '{"purge_everything":true}' | head -c 400 || echo "purge call failed (deploy already done)" echo env: CF_TOKEN: ${{ secrets.CF_TOKEN }}