mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 4.7
eb45f0ffaf
Extend the local cache stack with three independent capabilities: 1. Inner-`dockerd` build coverage for HTTP-only package mirrors. `roles/sys-svc-compose/files/compose.py` (the runner's `compose` wrapper) auto-generates a transient `compose.cache.override.yml` per app when `INFINITO_PACKAGE_CACHE_FRONTEND_IP` is exported. The override pins `build.extra_hosts` for `deb.debian.org`, `archive.ubuntu.com`, and `security.ubuntu.com` to the frontend. `pull.py` now delegates to the wrapper so build/pull operations see the same `-f` set the wrapper auto-detects. nginx in the frontend gains a port-80 listener with path rewrites for those hostnames, and `package.sh` registers two new Nexus proxies (`apt-debian-security`, `apt-ubuntu-security`) for the security suites whose upstream URL prefix differs from the main archive. Alpine is intentionally excluded from the inner-build extra_hosts: 3.18+ defaults to HTTPS, and inner-`dockerd` build containers do not import the frontend CA. Routing apk through the frontend would trip TLS verification. 2. General cache freshness env-var. `scripts/meta/env/cache/package.sh` exports `INFINITO_PACKAGE_CACHE_MAX_AGE_MIN` (default `129600`, i.e. 90 days). The bootstrap helper consumes it for every Nexus proxy's `contentMaxAge`, `metadataMaxAge`, and `negativeCache.timeToLive`, replacing the previous 1440-minute literal. Lower the value when chasing fast-moving upstreams. 3. SPOT cache documentation at `docs/contributing/environment/cache.md`. `compose.yml.md`, `variables.md`, the per-service READMEs, and `requirements/012-...` now link to it instead of restating the stack's behaviour. Net documentation lines drop substantially while the cache page becomes the single user-facing reference. Also: code-comment cleanup per `docs/contributing/documentation.md` guidelines across all touched .py / .sh / .yml files. Multi-paragraph docstrings, banner separators, and restate-the-obvious comments are removed; one-line WHY comments remain where the rationale is not already visible in the code. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
121 lines
3.1 KiB
YAML
121 lines
3.1 KiB
YAML
x-ci-defaults: &ci_defaults
|
|
dns:
|
|
- ${DNS_IP}
|
|
dns_opt:
|
|
- ndots:1
|
|
|
|
# Bare CI/runtime stack. Cache layers in via compose/cache.override.yml.
|
|
|
|
services:
|
|
coredns:
|
|
image: coredns/coredns:1.14.3
|
|
container_name: infinito-coredns
|
|
profiles: ["ci"]
|
|
command: ["-conf", "/Corefile"]
|
|
volumes:
|
|
- ./compose/coredns/Corefile:/Corefile:ro
|
|
networks:
|
|
default:
|
|
ipv4_address: ${DNS_IP}
|
|
|
|
infinito:
|
|
networks:
|
|
default:
|
|
ipv4_address: ${IP4}
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
network: host
|
|
args:
|
|
NIX_CONFIG: ${NIX_CONFIG}
|
|
image: "${INFINITO_IMAGE}"
|
|
pull_policy: "${INFINITO_PULL_POLICY:-never}"
|
|
depends_on:
|
|
coredns:
|
|
condition: service_started
|
|
|
|
command:
|
|
- /sbin/init
|
|
- systemd.log_target=console
|
|
- systemd.log_level=debug
|
|
- systemd.journald.forward_to_console=1
|
|
- systemd.journald.max_level_console=debug
|
|
|
|
stop_signal: SIGRTMIN+3
|
|
|
|
# systemd needs the host cgroup namespace.
|
|
privileged: true
|
|
cgroup: host
|
|
tmpfs:
|
|
- /run
|
|
- /run/lock
|
|
|
|
tty: true
|
|
stdin_open: true
|
|
|
|
container_name: ${INFINITO_CONTAINER:?Source scripts/meta/env/defaults.sh before running docker compose}
|
|
restart: "no"
|
|
profiles: ["ci"]
|
|
# Defaults of 0 map to "unlimited" in dockerd.
|
|
mem_limit: ${INFINITO_MEM_LIMIT:-0}
|
|
memswap_limit: ${INFINITO_MEMSWAP_LIMIT:-0}
|
|
cpus: ${INFINITO_CPUS:-0}
|
|
<<: *ci_defaults
|
|
volumes:
|
|
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
|
- .:/opt/src/infinito
|
|
- ${INFINITO_DOCKER_VOLUME:-docker}:${INFINITO_DOCKER_MOUNT:-/var/lib/docker}
|
|
- infinito:/var/lib/infinito/
|
|
- letsencrypt:/etc/letsencrypt/
|
|
|
|
environment:
|
|
DNS_IP: ${DNS_IP}
|
|
DOMAIN: ${DOMAIN}
|
|
IP4: ${IP4}
|
|
INFINITO_COMPILE: "${INFINITO_COMPILE:-1}"
|
|
INFINITO_SRC_DIR: /opt/src/infinito
|
|
PYTHONHTTPSVERIFY: "1"
|
|
GIT_SSL_NO_VERIFY: "0"
|
|
|
|
ports:
|
|
- "${BIND_IP:-127.0.0.1}:25:25"
|
|
- "${BIND_IP:-127.0.0.1}:110:110"
|
|
- "${BIND_IP:-127.0.0.1}:143:143"
|
|
- "${BIND_IP:-127.0.0.1}:465:465"
|
|
- "${BIND_IP:-127.0.0.1}:587:587"
|
|
- "${BIND_IP:-127.0.0.1}:993:993"
|
|
- "${BIND_IP:-127.0.0.1}:995:995"
|
|
- "${BIND_IP:-127.0.0.1}:4190:4190"
|
|
|
|
- "${BIND_IP:-127.0.0.1}:80:80"
|
|
- "${BIND_IP:-127.0.0.1}:443:443"
|
|
- "${BIND_IP:-127.0.0.1}:8448:8448"
|
|
|
|
- "${BIND_IP:-127.0.0.1}:3478-3480:3478-3480/udp"
|
|
- "${BIND_IP:-127.0.0.1}:3478-3480:3478-3480"
|
|
|
|
- "${BIND_IP:-127.0.0.1}:1935:1935"
|
|
|
|
- "${BIND_IP:-127.0.0.1}:2201:2201"
|
|
- "${BIND_IP:-127.0.0.1}:2202:2202"
|
|
- "${BIND_IP:-127.0.0.1}:2203:22"
|
|
- "${BIND_IP:-127.0.0.1}:33552:33552"
|
|
|
|
- "${BIND_IP:-127.0.0.1}:48081-48083:48081-48083"
|
|
- "${BIND_IP:-127.0.0.1}:48087:48087"
|
|
|
|
volumes:
|
|
docker:
|
|
infinito:
|
|
letsencrypt:
|
|
|
|
networks:
|
|
default:
|
|
driver: bridge
|
|
driver_opts:
|
|
com.docker.network.driver.mtu: "${INFINITO_OUTER_NETWORK_MTU:-1500}"
|
|
ipam:
|
|
config:
|
|
- subnet: ${SUBNET:-172.30.0.0/24}
|
|
gateway: ${GATEWAY:-172.30.0.1}
|