nordisk/dwarves

dwarves — SSH git-source + warehouse submit (guide)

How to use the two capabilities from the design doc.

Install the deploy key

sudo dwarves-server --install --system

This provisions the dwarves system user AND mints its git deploy key at /home/dwarves/.ssh/id_ed25519 (mode 0600, owned by dwarves), then prints the public key:

dwarves-server: ssh deploy key /home/dwarves/.ssh/id_ed25519.pub (generated)

  add this public key as a deploy key on each PRIVATE repo the forge will clone (SSH-only):
    ssh-ed25519 AAAAC3Nz… dwarves@loki

Paste that public key as a deploy key on each private repo the forge builds (Codeberg/Forgejo: repo → Settings → Deploy Keys). The key is preserved across re-installs (idempotent).

Add a repo over SSH

# SSH-only — https/git:// are refused (LAW).
dwarves repo add git@codeberg.org:nordisk/dwarves.git

Output:

dwarves repo add: cloning git@codeberg.org:nordisk/dwarves.git over SSH (deploy key /home/dwarves/.ssh/id_ed25519) …
✓ cloned /home/dwarves/.dwarves/repos/codeberg.org/nordisk/dwarves @ fb0e064abc12
  pipeline `dwarves-ci` — 3 stage(s), 7 step(s)
  build it:  DWARVES_REPO_ROOT=… DWARVES_REAL_RUNNER=1 dwarves run …

Re-running repo add on the same url fetches (fast-forwards) instead of re-cloning. Override the key with $DWARVES_SSH_KEY and the repos root with $DWARVES_REPOS.

Fill the nornir warehouse from a build

Point the forge at a running nornir-server; a real build then submits its build-info to the warehouse automatically:

export NORNIR_SERVER=http://127.0.0.1:7878
export NORNIR_SERVER_TOKEN="$(sudo sed -n 's/^NORNIR_TOKEN=//p' /etc/nornir/nornir.env)"
export NORNIR_WORKSPACE=dwarves          # which served workspace to fill
export DWARVES_REAL_RUNNER=1             # RealRunner (real cargo build)

dwarves run <repo-with-brokkr.toml>

Each build prints dwarves-warehouse: submitted N/N build-info row(s) to <server>. Open nornir viz against the same server and the 🧪 Test tab shows the build's rows (suite = dwarves-build, aspect = build-<kind>, the provenance facts, and a pass/fail step row). With no NORNIR_SERVER set the forge behaves exactly as before (local ledger only) — the warehouse submit is a no-op.