ci: run client builds on a Java 25 build agent instead of the controller

The toolchain image becomes a Jenkins inbound agent (jenkins/inbound-agent,
Java 25) labelled dorknet-builder. Jenkins itself stays on the stock image
and runs no builds, which also clears the built-in-node warning.

- Dockerfile: inbound-agent base; restic cache on the agent's own volume
- docker-compose.yml: the agent as a Coolify Docker Compose application,
  reaching Jenkins over WebSocket on the predefined Coolify network
- Jenkinsfile: agent { label 'dorknet-builder' }
- README: Java 25 for both sides (Java 21 support ends Sep 2027, Java 17
  is unsupported), restart policy, node setup and Coolify deployment

ci/jenkins/Dockerfile

@@ -1,7 +1,7 @@
-# DorkNet Jenkins: the stock Jenkins image plus everything the PC and Quest
-# client builds need, so the job (the Jenkinsfile at the repo root) runs right
-# on the controller. Jobs, plugins and settings stay in the jenkins_home
-# volume; only the image changes.
+# DorkNet build agent: a Jenkins inbound agent with everything the PC and
+# Quest client builds need. It runs next to Jenkins on Coolify, connects to
+# the controller over WebSocket, and runs the jobs labelled "dorknet-builder"
+# (the Jenkinsfile at the repo root). Jenkins itself stays on the stock image.
 #
 #   PC      Python + .NET SDK          tools/build_pc.py
 #   Quest   Python/LIEF + JDK + Android NDK, build-tools, apktool
@@ -9,13 +9,13 @@
 #   Builds  restic + rclone            stock builds restored from the restic
 #                                      archive on the FTP (archive-restore.sh)
 #
+# Java 25: Jenkins supports it until Sep 2029 (Java 21 only until Sep 2027).
+# Keep the agent's Java the same major version as the controller's.
+#
 # See ci/jenkins/README.md.
 
-# Match this to the Jenkins image your Dokploy service runs today, so the
-# upgrade keeps the same Jenkins version and Java: e.g.
-#   --build-arg JENKINS_IMAGE=jenkins/jenkins:2.492.3-lts-jdk17
-ARG JENKINS_IMAGE=jenkins/jenkins:lts-jdk17
-FROM ${JENKINS_IMAGE}
+ARG AGENT_IMAGE=jenkins/inbound-agent:latest-jdk25
+FROM ${AGENT_IMAGE}
 
 USER root
 
@@ -73,9 +73,10 @@ RUN wget -q https://github.com/restic/restic/releases/download/v${RESTIC}/restic
 COPY archive-restore.sh /usr/local/bin/archive-restore
 RUN chmod +x /usr/local/bin/archive-restore
 
-# Restored stock builds and the restic cache live in the persistent
-# jenkins_home volume, so each multi-GB build is downloaded once.
-ENV DORKNET_CACHE=/var/jenkins_home/dorknet-cache
+# Restored stock builds and the restic cache. Mount a volume here so each
+# multi-GB stock build is downloaded once, not after every restart.
+ENV DORKNET_CACHE=/home/jenkins/dorknet-cache
+RUN mkdir -p ${DORKNET_CACHE} && chown jenkins:jenkins ${DORKNET_CACHE}
 
 ENV DOTNET_CLI_TELEMETRY_OPTOUT=1 \
     DOTNET_NOLOGO=1

ci/jenkins/README.md

@@ -3,12 +3,13 @@
 The `Jenkinsfile` at the repo root builds the DorkNet clients on your existing
 Jenkins.
 
-It runs right on the Jenkins container, so that container's image needs the
-build toolchain: Python with LIEF, the .NET SDK, the Android NDK and build-tools,
-apktool, restic and rclone. `ci/jenkins/Dockerfile` is the stock
-Jenkins image with that toolchain added. Your jobs, plugins and settings live
-in the `jenkins_home` volume, not in the image, so switching images leaves
-them alone.
+The builds run on a **build agent**, not on Jenkins itself:
+- **The agent:** a container built from `ci/jenkins/Dockerfile`, which is the
+  Jenkins inbound agent plus Python with LIEF, the .NET SDK, the Android NDK
+  and build-tools, apktool, restic and rclone. It runs on Coolify next to
+  Jenkins and connects to it over WebSocket on Docker's internal network. The
+  job runs on it through the `dorknet-builder` label.
+- **Jenkins itself:** stays on the stock image and runs no builds.
 
 | Platform | Output (Jenkins artifacts) | How |
 |---|---|---|
@@ -37,8 +38,8 @@ The job defaults to the builds this branch targets: Steam manifest
 build can be chosen per run. Tick **LIST_SNAPSHOTS** to print the snapshots
 matching a filter without building anything.
 
-A restored snapshot is cached in `jenkins_home/dorknet-cache`, so each stock
-build is downloaded once.
+A restored snapshot is cached on the agent's `dorknet_cache` volume, so each
+stock build is downloaded once.
 
 A Quest build needs a resolved hook table for its versionCode, committed under
 `DorkNet.Quest/targets/`. Only `20230317-2128210.json` exists today. The build
@@ -57,32 +58,61 @@ Resolve a table for another build locally with `build.py build --dump-cs`.
 
 ## Setup
 
-### 1. Switch your Jenkins to this image
+### 1. Jenkins itself
 
-On your Jenkins service in Dokploy:
+Jenkins runs as a Coolify service from a Compose file:
 
-1. **Build from this repo.**
-   - For an Application service: provider GitHub, branch `march-2023-03-21`,
-     build type Dockerfile, Dockerfile path `ci/jenkins/Dockerfile`, build
-     context `ci/jenkins`.
-   - For a Compose service: change its `jenkins` service to `build:` from
-     `ci/jenkins` as in `ci/jenkins/docker-compose.yml`.
-   - Either way, **keep the same volume on `/var/jenkins_home`**.
-2. **Match the Jenkins version.** Set the build argument `JENKINS_IMAGE` to the
-   image the service runs today (e.g. `jenkins/jenkins:2.492.3-lts-jdk17`).
-   The default is `jenkins/jenkins:lts-jdk17`.
-3. **Add the environment:**
+- **Use the Java 25 image**, e.g. `jenkins/jenkins:latest-jdk25`, or
+  `2.587-jdk25` to pin. Jenkins supports Java 25 until September 2029, Java 21
+  only until September 2027, and Java 17 not at all. Keep the agent on the same
+  Java major version; its image defaults to Java 25.
+- **Add `restart: unless-stopped`** to the `jenkins` service. A restart from
+  the Jenkins UI exits the container with code 5 and relies on Docker to
+  start it again. Without a restart policy it stays stopped.
+- **Turn on "Connect to predefined network"** (Advanced) so the agent can
+  reach Jenkins by its container name, `jenkins-<service uuid>`.
+- **Run no builds on it:** **Manage Jenkins → Nodes → Built-In Node →
+  Configure**, set **Number of executors** to `0`.
+
+### 2. The agent node
+
+**Manage Jenkins → Nodes → New Node**, a permanent agent:
+
+| Setting | Value |
+|---|---|
+| Name | `dorknet-builder` |
+| Labels | `dorknet-builder` |
+| Remote root directory | `/home/jenkins/agent` |
+| Launch method | Launch agent by connecting it to the controller, with **Use WebSocket** ticked |
+| Number of executors | 1 |
+
+Save, open the node, and copy its **secret**.
+
+### 3. Deploy the agent on Coolify
+
+1. **Create a Docker Compose application** from this repository: build pack
+   Docker Compose, base directory `/`, compose location
+   `/ci/jenkins/docker-compose.yml`. It needs no domain. Under Advanced, turn
+   on **Connect to predefined network**.
+2. **Set its environment:**
 
    | Variable | Value |
    |---|---|
+   | `JENKINS_URL` | Jenkins' **internal** address, `http://jenkins-<service uuid>:8080/`. Not the public URL, which is behind Cloudflare Access. |
+   | `JENKINS_SECRET` | the node secret from step 2 |
+   | `JENKINS_AGENT_NAME` | optional, default `dorknet-builder` |
    | `ARCHIVE_PC_REPO` | Steam repository folder on the FTP, e.g. `Rec Room Versions/steam-v2` (plain text, not URL-encoded) |
    | `ARCHIVE_QUEST_REPO` | Quest repository folder, e.g. `Rec Room Versions/quest-v2` |
    | `ARCHIVE_FTP_TLS` | `explicit` (default), `implicit` or `none` |
 
-4. **Redeploy.** The first image build downloads the Android NDK (~1.5 GB) and
-   takes a while.
+3. **Deploy.** The first image build downloads the Android NDK (~1.5 GB) and
+   takes a while. The node shows as connected in Jenkins once the agent is up.
 
-### 2. Plugins
+Both Jenkins and the agent join the server's predefined Coolify network, so
+the agent reaches Jenkins by container name. Check the name under the Jenkins
+service's containers before using it.
+
+### 4. Plugins
 
 The job needs these plugins:
 
@@ -96,7 +126,7 @@ The job needs these plugins:
 
 Most are part of the suggested set.
 
-### 3. Credentials
+### 5. Credentials
 
 Add these under **Manage Jenkins → Credentials**, with exactly these IDs:
 
@@ -115,7 +145,7 @@ Add these under **Manage Jenkins → Credentials**, with exactly these IDs:
 different key means every player has to uninstall before installing a CI
 build.
 
-### 4. The job
+### 6. The job
 
 1. Create a **New Item → Pipeline** (e.g. `dorknet-client`).
 2. Under **Pipeline**, choose **Pipeline script from SCM**:
@@ -126,7 +156,7 @@ build.
 4. Run it once with **Build** so Jenkins learns the parameters. Later runs
    offer **Build with Parameters**.
 
-### 5. GitHub webhook
+### 7. GitHub webhook
 
 In the repository's **Settings → Webhooks**:
 
@@ -136,5 +166,5 @@ In the repository's **Settings → Webhooks**:
 
 ### Disk
 
-The restored stock builds are cached in `jenkins_home/dorknet-cache`, several
-GB each. Jenkins keeps the artifacts of the last 3 runs.
+The agent's `dorknet_cache` volume holds the restored stock builds, several GB
+each. Jenkins keeps the artifacts of the last 3 runs, on its own volume.

ci/jenkins/docker-compose.yml

@@ -1,31 +1,31 @@
-# Reference for the Jenkins service on Dokploy, built from this directory's
-# Dockerfile (the stock Jenkins image plus the client build toolchain).
-#
-# Use it on your EXISTING Jenkins service rather than as a second Jenkins.
-# The data volume must be the one Jenkins uses today, or Jenkins starts empty.
-# Point `volumes:` at that volume (and its name under the top-level
-# `volumes:`, marked `external: true`), or keep this service's name and volume
-# if they already match. See ci/jenkins/README.md.
+# DorkNet build agent on Coolify. Deploy as a Docker Compose application from
+# this repository with compose location /ci/jenkins/docker-compose.yml and
+# "Connect to predefined network" on. It needs no domain: it dials out to
+# Jenkins over WebSocket on Docker's internal network. Set the variables in
+# the resource's Environment Variables; see ci/jenkins/README.md.
 services:
-  jenkins:
+  agent:
     build:
       context: .
       dockerfile: Dockerfile
-      args:
-        # The image your Jenkins runs today, so the Jenkins version and Java
-        # stay the same.
-        JENKINS_IMAGE: ${JENKINS_IMAGE:-jenkins/jenkins:lts-jdk17}
     restart: unless-stopped
-    expose:
-      - "8080"
     environment:
+      # Jenkins as seen from inside Docker (e.g. http://<jenkins container
+      # name>:8080), not the public URL, which is behind Cloudflare Access.
+      JENKINS_URL: ${JENKINS_URL:?set JENKINS_URL to Jenkins' internal address}
+      JENKINS_AGENT_NAME: ${JENKINS_AGENT_NAME:-dorknet-builder}
+      JENKINS_SECRET: ${JENKINS_SECRET:?set JENKINS_SECRET to the node secret}
+      JENKINS_WEB_SOCKET: "true"
+      JENKINS_AGENT_WORKDIR: /home/jenkins/agent
       # Where the stock builds live in the archive (restic repository folders
-      # on the FTP), as plain text. Overridable per run.
+      # on the FTP, plain text). Overridable per run.
       ARCHIVE_PC_REPO: ${ARCHIVE_PC_REPO:-}
       ARCHIVE_QUEST_REPO: ${ARCHIVE_QUEST_REPO:-}
       ARCHIVE_FTP_TLS: ${ARCHIVE_FTP_TLS:-explicit}
     volumes:
-      - jenkins_home:/var/jenkins_home
+      - dorknet_cache:/home/jenkins/dorknet-cache
+      - agent_work:/home/jenkins/agent
 
 volumes:
-  jenkins_home:
+  dorknet_cache:
+  agent_work: