mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 4.7
eb45f0ffaf
Extend the local cache stack with three independent capabilities: 1. Inner-`dockerd` build coverage for HTTP-only package mirrors. `roles/sys-svc-compose/files/compose.py` (the runner's `compose` wrapper) auto-generates a transient `compose.cache.override.yml` per app when `INFINITO_PACKAGE_CACHE_FRONTEND_IP` is exported. The override pins `build.extra_hosts` for `deb.debian.org`, `archive.ubuntu.com`, and `security.ubuntu.com` to the frontend. `pull.py` now delegates to the wrapper so build/pull operations see the same `-f` set the wrapper auto-detects. nginx in the frontend gains a port-80 listener with path rewrites for those hostnames, and `package.sh` registers two new Nexus proxies (`apt-debian-security`, `apt-ubuntu-security`) for the security suites whose upstream URL prefix differs from the main archive. Alpine is intentionally excluded from the inner-build extra_hosts: 3.18+ defaults to HTTPS, and inner-`dockerd` build containers do not import the frontend CA. Routing apk through the frontend would trip TLS verification. 2. General cache freshness env-var. `scripts/meta/env/cache/package.sh` exports `INFINITO_PACKAGE_CACHE_MAX_AGE_MIN` (default `129600`, i.e. 90 days). The bootstrap helper consumes it for every Nexus proxy's `contentMaxAge`, `metadataMaxAge`, and `negativeCache.timeToLive`, replacing the previous 1440-minute literal. Lower the value when chasing fast-moving upstreams. 3. SPOT cache documentation at `docs/contributing/environment/cache.md`. `compose.yml.md`, `variables.md`, the per-service READMEs, and `requirements/012-...` now link to it instead of restating the stack's behaviour. Net documentation lines drop substantially while the cache page becomes the single user-facing reference. Also: code-comment cleanup per `docs/contributing/documentation.md` guidelines across all touched .py / .sh / .yml files. Multi-paragraph docstrings, banner separators, and restate-the-obvious comments are removed; one-line WHY comments remain where the rationale is not already visible in the code. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
33 lines
1014 B
Bash
Executable File
33 lines
1014 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install the frontend CA into the runner's trust store. Idempotent.
|
|
# See docs/contributing/environment/cache.md.
|
|
set -eu
|
|
|
|
CA_SRC="/opt/package-frontend-ca.crt"
|
|
|
|
if command -v update-ca-certificates >/dev/null 2>&1; then
|
|
CA_DST="/usr/local/share/ca-certificates/infinito-package-frontend.crt"
|
|
CA_REBUILD=(update-ca-certificates)
|
|
elif command -v update-ca-trust >/dev/null 2>&1; then
|
|
CA_DST="/etc/ca-certificates/trust-source/anchors/infinito-package-frontend.crt"
|
|
CA_REBUILD=(update-ca-trust extract)
|
|
else
|
|
echo "[package-frontend-ca] no supported CA trust tool" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Empty CA_SRC = cache profile inactive.
|
|
if [ ! -s "${CA_SRC}" ]; then
|
|
echo "[package-frontend-ca] ${CA_SRC} empty/absent; cache profile inactive; skipping" >&2
|
|
exit 0
|
|
fi
|
|
|
|
if cmp -s "${CA_SRC}" "${CA_DST}" 2>/dev/null; then
|
|
exit 0
|
|
fi
|
|
|
|
install -d -m 0755 "$(dirname "${CA_DST}")"
|
|
install -m 0644 "${CA_SRC}" "${CA_DST}"
|
|
"${CA_REBUILD[@]}" >/dev/null 2>&1
|
|
echo "[package-frontend-ca] installed ${CA_DST}" >&2
|