Infrastructure map
Infrastructure map
Operator inventory for the VPS fleet and its GitHub Actions runners. This is
an entry point; use the linked runbooks for procedures. The two VPS hosts are
distinct. The home GPU runtime and Modal workers are described in the
worker deployment guide.
Hosts
| Host | Role and services | Network access | Configuration source | Last verified |
|---|---|---|---|---|
Application VPS (ovhcloud, prod.vps.brioso.internal and beta.vps.brioso.internal are two logical inventories on one machine) |
Public prod and beta web slots, Caddy, PocketBase admin, Litestream, Phoenix, Drizzle Gateway, MCP SQLite, local Garage backed Turbo cache, and CI runners | Public web traffic through Cloudflare; admin and operations over Brioso Tailscale tag:server; CI SSH and cache access from tag:ci |
pyinfra v2 inventory, deploy guide, tailnet policy mirror | 2026-10-10 for runner registrations; service layout checked against repository code |
Garage VPS (vps-e311841e, Tailscale name brioso-vps-ovh.tail7d3568.ts.net, 100.95.227.60) |
Production catalogue Garage at /srv/garage; scale-to-zero ephemeral GitHub Actions runners (up to 4) on /srv/ci |
Garage S3 binds loopback 127.0.0.1:3900 and is forwarded over the Brioso tailnet; SSH is tailnet access; no public inbound Garage or SSH port |
Garage runbook, Garage unit, OVH runner setup, OVH runner plan | 2026-10-10, SSH confirmed ghrunner and the 20 GiB mount, Garage active, plus GitHub runner online |
The application VPS’s garage-cache is a separate local Turbo cache store.
It is not the production catalogue on the Garage VPS. The application VPS
configuration is managed by pyinfra; the Garage VPS and its CI runner are
currently documented through the linked runbooks and dated operations notes.
Linux accounts
Access describes the intended path and sudo boundary, not a list of SSH keys.
Named OVH administrator accounts were checked on 2026-10-10; application
service accounts below come from provisioning code, so inspect the host before
relying on their live status.
| Host | Account | Purpose and access | Sudo boundary | Provisioning source |
|---|---|---|---|---|
| Application | debian |
pyinfra SSH account for CI and operators over the tailnet | Passwordless general sudo for pyinfra | v2 inventory and host cloud init |
| Application | deploy |
Legacy CI deploy SSH account | Passwordless only for reviewed deploy scripts | users.py, sudoers |
| Application | diag |
Tailnet SSH for diagnostics and journal reads | Reviewed web slot status and restart commands only | v2 diag state, access runbook |
| Application | web-services |
Web, PocketBase, Litestream, Drizzle Gateway, Phoenix, MCP SQLite, and Turbo cache service processes; service account, not operator SSH | No general sudo | users.py, service units |
| Application | garage-cache |
Local Turbo cache Garage process; no login shell | None | users.py, cache provisioning |
| Application | ghrunner |
Rootless Podman runner fleet; user systemd services | Container jobs run as root inside their container; no host sudo grant documented | runner definitions |
| Garage | ubuntu |
Existing recovery and host administration via VPS specific SSH key | Host administration sudo | OVH runner plan, admin observation |
| Garage | brioso-admin-carlos |
Named administrator, account local SSH key | Passwordless general sudo | dated access check |
| Garage | brioso-admin-quino |
Named administrator, account local SSH key | Passwordless general sudo | dated access check |
| Garage | garage |
Catalogue Garage service; no login shell | None | Garage install guide, service unit |
| Garage | ghrunner |
Rootless Podman runner service; jobs run inside disposable containers | Container root is bounded by the container; no host sudo grant documented | OVH runner setup |
GitHub Actions routing and capacity
The repo variable RUNNER_TARGET was self-hosted-tailnet when checked on
2026-10-10. Jobs using ${{ vars.RUNNER_TARGET || 'ubuntu-latest' }} share the
self-hosted-tailnet runner label. CI,
artifact builds, and
deploys use that variable;
runner budget,
VPS health, and
pyinfra drift are pinned to
the self hosted label. See the runner policy for the
budget watchdog and recovery procedure.
GitHub’s repository runner API reported these registrations online on
2026-10-10, before the move to the scale-to-zero orchestrator on the Garage
VPS (BRI-433). The old ovhcloud-ghrunner-* runners and brioso-vps-ovh-1
are retired. Runners are now registered on demand, so an empty list is normal
when idle; use ci-fleet-status on the host for live state.
| Host | Registered runner names | Slots |
|---|---|---|
| Garage VPS (CI host, BRI-433) | brioso-vps-1 to brioso-vps-4, created per job (scale to zero, none online when idle) |
up to 4 |
On the Garage VPS, the runner image, disposable job files, and Bun cache use
one shared 20 GiB /srv/ci filesystem. This is total CI capacity, not a
20 GiB allowance for each job. The job container is limited to 5 GiB RAM
and 4 CPUs. A provisional 5 GiB filesystem filled during bun install;
after the filesystem was enlarged, a completed smoke build measured 8.4
GiB disk use. These are the 2026-10-10 capacity observations, not sizing
guarantees for future jobs. The OVH runner plan
keeps the trial history.