The act_runner container's startup wait checked only for the dind TLS cert
FILE (/certs/client/ca.pem), but dockerd writes the certs before it begins
accepting TLS connections on :2376. A runner that proceeds on the file alone
still hard-exits with "cannot ping the docker daemon at tcp://localhost:2376",
a startup race observed crashlooping the pod during node bounces / slow
containerd starts (11 restarts in ~8 min on a fresh pod post-bounce).
Add a second bounded wait (nc -z 127.0.0.1 2376, 60s cap, mirroring the
existing cert-file loop) so the runner starts only once the daemon actually
accepts a connection. Self-healing, minimal, reversible. `nc` is present in
the gitea/act_runner:0.2.11 image (verified).
apps/wave-1/gitea-actions.yaml is a hand-authored EXTRA_UNIT raw manifest
(render.py only places it into a wave, never regenerates its bytes), so this
edit is at its source of truth; the canonical render does not emit the file
and render==golden is unaffected (gate green).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Replaces the single `apps` Flux Kustomization with dependency-ordered waves
(apps-wave-0..2) so a crashlooping workload isolates to its wave + downstream
instead of stalling the entire app tier. Parallel within a wave, ordered across.
- catalog/render.py: compute waves by longest dependency-path depth over the
ServiceDefinition `dependencies:` edges (a `<svc>-db` is a leaf, so its
consumer lands strictly higher — the "DB below consumer" rule falls out of
longest-path, no special case). `--emit-waves` generates the per-wave
kustomizations + Flux CRs; `--wave-layout` places renders into the right dir.
wave 0: pihole gitea jackett plex qbittorrent nextcloud-db semaphore-db
wave 1: sonarr radarr nextcloud semaphore gitea-actions
wave 2: seerr
- apps/*.yaml -> apps/wave-{0,1,2}/ (byte-identical moves; SOPS files intact).
- clusters/base: apps.yaml removed; apps-wave-{0,1,2}.yaml added (dependsOn
chain: platform-config -> wave-0 -> wave-1 -> wave-2, prune+wait each).
- clusters/dev: one SOPS decryption patch per wave (load-bearing).
- DESIGN-waves.md: wave table, topology, cutover runbook.
Cutover: preceded by disabling prune on `apps` (1bfb0db) so removing that
object here does not GC its resources; the wave Kustomizations SSA-adopt the
byte-identical manifests in place (no restart, no PVC churn).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
jakman85andClaude Opus 4.8