Simone
60cee5418e
Restyles every template with a hand-written dark Gitea-style theme (web/static/app.css, ~270 lines: badges, buttons, cards, focus rings, prefers-reduced-motion) and completes the htmx polling wiring for all four dashboard cards. Adds the repeatable setup-web-linux.sh installer (idempotent: pip install '[web]' non-editable, render ci-web.service, template [web]/[web.oidc] into config.toml, prompt for keyring secrets, print Gitea OIDC registration steps, enable/restart the unit) plus deploy/systemd/ci-web.service and docs/WEB-UI.md.
39 lines
1.5 KiB
Desktop File
39 lines
1.5 KiB
Desktop File
[Unit]
|
|
Description=Local CI/CD — web dashboard (ci web serve)
|
|
Documentation=file:///opt/ci/local-ci-cd-system/docs/WEB-UI.md
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=ci-runner
|
|
Group=ci-runner
|
|
WorkingDirectory=/opt/ci/local-ci-cd-system
|
|
# CI_CONFIG (and any other CI_* override) lives here, one KEY=VALUE per
|
|
# line, no quoting. The "-" prefix means the unit still starts if the file
|
|
# is absent (config.toml is then auto-discovered at /var/lib/ci/config.toml
|
|
# — see config.py's resolution order). Rendered/edited by setup-web-linux.sh
|
|
# — never put secrets in this file, only the config path.
|
|
EnvironmentFile=-/etc/ci/web.env
|
|
# The bind address below is filled in by setup-web-linux.sh at install time
|
|
# (a LAN IP, or left as 127.0.0.1 for loopback-only) — never edit this file
|
|
# by hand on the target host, re-run the installer instead.
|
|
ExecStart=/opt/ci/venv/bin/python -m ci_orchestrator web serve --host __CI_WEB_BIND_HOST__ --port 8800
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
TimeoutStartSec=30s
|
|
|
|
# Hardening. ProtectHome=read-only (NOT "yes"/true): the OIDC/session
|
|
# secrets are read from ci-runner's headless keyring backend
|
|
# (keyrings.alt.file.PlaintextKeyring, ~/.local/share/python_keyring/ —
|
|
# see docs/WEB-UI.md's keyring-headless note); "yes" would hide /home
|
|
# entirely and every login would fail with a keyring lookup error.
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=read-only
|
|
PrivateTmp=true
|
|
ReadWritePaths=/var/lib/ci
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|