# The runner that cuts quarry's releases (ci/release.yml, RFC 0020): the
# only one polling quarry.job, the task type every workflow job of quarry
# has, so a release job reaches no other. quarry-runner.service on
# hetzner-big-eu is started with --tasks quarry.test,quarry.fmt,quarry.build,quarry.race
# (checked 2026-10-02), so it never takes quarry.job, and it runs jobs as
# itself, so it could not keep a run token to a job; this one runs each
# job as qrel1 (--job-users), which is what lets it receive the token
# that publishes, and takes trunk's check-ins only (--branch trunk), never
# a branch's or a landing's merge. --checkout zit gives the job a real
# checkout, from which release.sh reads the check-in and its tags.
# ci/release.yml points ZIT_RELEASE_DIR at /home/dmestas/zit-release:
# /home/dmestas is 0751 and zit-release 0755 there, so qrel1 reads the
# pinned zit's tarballs by path without listing the home directory.
# linux-arm64 is built only with RELEASE_ARM64=1 (scripts/release.sh); the
# cross toolchain below is needed only then.
#
# Not installed by deploy.sh. Once, as root (docs/running.md, "Cutting a
# release"):
# useradd --system --user-group --no-create-home --shell /usr/sbin/nologin qrel1
# useradd --system --user-group --create-home --home-dir /srv/ci-quarry-release \
# --shell /usr/sbin/nologin ci-quarry-release
# usermod -aG qrel1 ci-quarry-release
# chmod 0711 /srv/ci-quarry-release
# echo 'ci-quarry-release ALL=(qrel1) NOPASSWD: ALL' >/etc/sudoers.d/quarry-release-job-users # visudo -c
# apt-get install gcc-aarch64-linux-gnu g++-aarch64-linux-gnu # only for RELEASE_ARM64=1
# printf 'QUARRY_RUNNER_TOKEN=%s\n' <a new worker token for quarry> >/etc/quarry-runner-release.env
# chmod 0600 /etc/quarry-runner-release.env
# install -m 0644 scripts/systemd/quarry-runner-release.service /etc/systemd/system/
# systemctl daemon-reload && systemctl enable --now quarry-runner-release
[Unit]
Description=quarry release runner (quarry.job, as qrel1, trunk only)
After=network-online.target quarry.service
Wants=network-online.target
[Service]
User=ci-quarry-release
Group=ci-quarry-release
WorkingDirectory=/srv/ci-quarry-release
EnvironmentFile=/etc/quarry-runner-release.env
Environment=HOME=/srv/ci-quarry-release
Environment=PATH=/usr/local/go/bin:/srv/quarry/bin:/usr/local/bin:/usr/bin:/bin
ExecStart=/srv/quarry/bin/quarry runner --work /srv/ci-quarry-release/runner --checkout zit --zit /srv/quarry/bin/zit --max-tasks 1 --job-users qrel1 --branch trunk --tasks quarry.job http://127.0.0.1:8950/r/quarry
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target