kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
fix/dev-python/python-upper-bound
computer-playbook/compose/cache.override.yml
T
kevinveenbirkenbachandClaude Opus 5 1d79bf2d58 fix(cache): give the package-cache a static address on the bridge 
The frontend proxies to the package-cache by name, and nginx resolves a
literal proxy_pass hostname once while parsing the config and keeps it for the
worker's lifetime; the resolver only re-resolves targets that contain a
variable. The package-cache was the one cache service without a pinned
address, so recreating it left the frontend dialling a dead one, answering 502
to everything and reporting unhealthy.

That surfaces far from its cause: pip.conf deliberately keeps the real index
URL and extra_hosts points pypi.org at the frontend, so a pip install reports
no versions at all and looks like a network fault.

Pins it the way the registry-cache and the frontend are already pinned, and
carries the address into the runner slots.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-10 18:00:56 +02:00

151 lines
7.6 KiB
YAML
Raw Permalink Blame History

---
# Layered on compose.yml by the dev tooling when the cache stack is
# active. See docs/contributing/environment/cache.md.
services:
registry-cache:
image: rpardini/docker-registry-proxy:0.6.5
container_name: infinito-registry-cache
environment:
ENABLE_MANIFEST_CACHE: "true"
AUTH_REGISTRIES: ""
CACHE_MAX_SIZE: "${INFINITO_CACHE_REGISTRY_MAX_SIZE:?Run 'make dotenv' to generate the .env single source of truth}"
DISABLE_IPV6: "true"
volumes:
- type: bind
source: ${INFINITO_CACHE_REGISTRY_HOST_PATH:?Run 'make dotenv' to generate the .env single source of truth}
target: /docker_mirror_cache
bind:
create_host_path: true
- type: bind
source: ${INFINITO_CACHE_REGISTRY_CA_HOST_PATH:?Run 'make dotenv' to generate the .env single source of truth}
target: /ca
bind:
create_host_path: true
healthcheck:
test:
- CMD-SHELL
- "wget -qO- http://127.0.0.1:3128/ca.crt >/dev/null 2>&1"
interval: 5s
timeout: 3s
retries: 30
start_period: 30s
networks:
default:
ipv4_address: ${INFINITO_CACHE_REGISTRY_IP:?Run 'make dotenv' to generate the .env single source of truth}
restart: unless-stopped
package-cache:
image: sonatype/nexus3:3.91.1-ubi
container_name: infinito-package-cache
# Exception: fresh bind-mount is root:root and Nexus aborts unless run as root.
user: "0:0"
environment:
INSTALL4J_ADD_VM_PARAMS: "-Xms${INFINITO_CACHE_PACKAGE_HEAP:?Run 'make dotenv' to generate the .env single source of truth} -Xmx${INFINITO_CACHE_PACKAGE_HEAP:?Run
'make dotenv' to generate the .env single source of truth} -XX:MaxDirectMemorySize=${INFINITO_CACHE_PACKAGE_DIRECT_MEM:?Run 'make dotenv' to generate the
.env single source of truth}"
# Exception: random-password mode leaves no readable secret for the bootstrap.
NEXUS_SECURITY_RANDOMPASSWORD: "false"
volumes:
- type: bind
source: ${INFINITO_CACHE_PACKAGE_HOST_PATH:?Run 'make dotenv' to generate the .env single source of truth}
target: /nexus-data
bind:
create_host_path: true
ports:
- "${INFINITO_BIND_IP:?Run 'make dotenv' to generate the .env single source of truth}:${INFINITO_CACHE_PACKAGE_PORT:?Run 'make dotenv' to generate the .env
single source of truth}:8081"
healthcheck:
test:
- CMD-SHELL
- "curl -fsS http://127.0.0.1:8081/service/rest/v1/status >/dev/null"
interval: 5s
timeout: 3s
retries: 60
start_period: 120s
networks:
default:
ipv4_address: ${INFINITO_CACHE_PACKAGE_IP:?Run 'make dotenv' to generate the .env single source of truth}
restart: unless-stopped
package-cache-frontend:
image: nginx:1.27-alpine
container_name: infinito-package-cache-frontend
depends_on:
package-cache:
condition: service_healthy
volumes:
- type: bind
source: ${INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR:?Run 'make dotenv' to generate the .env single source of truth}
target: /etc/nginx/ca
read_only: true
bind:
create_host_path: true
- type: bind
source: ${INFINITO_CACHE_PACKAGE_FRONTEND_CERTS_DIR:?Run 'make dotenv' to generate the .env single source of truth}
target: /etc/nginx/certs
read_only: true
bind:
create_host_path: true
- ./compose/package-cache-frontend/upstreams.conf:/etc/nginx/conf.d/upstreams.conf:ro
networks:
default:
ipv4_address: ${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}
healthcheck:
test:
- CMD-SHELL
- "wget -qO- --no-check-certificate https://127.0.0.1/ --header 'Host: pypi.org' >/dev/null 2>&1 || exit 0"
interval: 5s
timeout: 3s
retries: 30
start_period: 10s
restart: unless-stopped
infinito:
depends_on:
registry-cache:
condition: service_healthy
required: false
package-cache:
condition: service_healthy
required: false
package-cache-frontend:
condition: service_healthy
required: false
environment:
INFINITO_CACHE_PACKAGE_FRONTEND_IP: ${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}
extra_hosts:
# Exception: /etc/hosts is used because coredns can't resolve the container names.
- "infinito-registry-cache:${INFINITO_CACHE_REGISTRY_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "deb.debian.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "archive.ubuntu.com:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "security.ubuntu.com:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "pypi.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "files.pythonhosted.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "registry.npmjs.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "rubygems.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "index.rubygems.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "repo.packagist.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "proxy.golang.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "dl-cdn.alpinelinux.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "raw.githubusercontent.com:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
- "codeload.github.com:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
volumes:
- type: bind
source: ${INFINITO_CACHE_REGISTRY_CA_HOST_PATH:?Run 'make dotenv' to generate the .env single source of truth}
target: /opt/registry-cache-ca
read_only: true
bind:
create_host_path: true
- ${INFINITO_CACHE_REGISTRY_PROXY_CONF:?Set by 'cli deploy development up' / 'make compose-up' (driver-injected, not produced by 'make
dotenv')}:/etc/systemd/system/docker.service.d/registry-cache-proxy.conf:ro
- ./scripts/docker/cache/registry-ca.sh:/usr/local/bin/registry-cache-ca.sh:ro
- ${INFINITO_CACHE_PACKAGE_PIP_CONF:?Set by 'cli deploy development up' / 'make compose-up' (driver-injected, not produced by 'make
dotenv')}:/etc/pip.conf:ro
- ${INFINITO_CACHE_PACKAGE_NPMRC:?Set by 'cli deploy development up' / 'make compose-up' (driver-injected, not produced by 'make dotenv')}:/root/.npmrc:ro
- ./compose/package-cache/apt/${INFINITO_DISTRO:?Run 'make dotenv' to generate the .env single source of
truth}.list:/etc/apt/sources.list.d/package-cache.list:ro
- ${INFINITO_CACHE_PACKAGE_FRONTEND_CA_FILE:?Set by 'cli deploy development up' / 'make compose-up' (driver-injected, not produced by 'make
dotenv')}:/opt/package-frontend-ca.crt:ro
- ./scripts/docker/cache/package-frontend/ca.sh:/usr/local/bin/package-frontend-ca.sh:ro
Reference in new issue View Git Blame Copy Permalink