kevinveenbirkenbachandClaude Opus 4.7
b34131ca1d
Brings up the package-cache compose service alongside the existing
registry-cache, gated by the same `cache` profile. Bootstrap helper
(scripts/docker/cache/package.sh) auto-rotates the admin password from
the well-known default, accepts the Sonatype CE EULA (3.71+ blocks
artifact downloads with HTTP 403 until /v1/system/eula is POSTed —
disclaimer must be sent verbatim with its unicode quotes), enables
anonymous read, creates one default blobstore, and registers the MVP
proxy set: apt-debian, apt-ubuntu, pypi-proxy, npm-proxy, helm-bitnami,
raw-githubusercontent. The runner gets pip.conf / .npmrc /
sources.list snippets bind-mounted in (each defaulting to /dev/null
when the cache profile is inactive) so the deploy is byte-identical
with cache off.
Cache plumbing:
- scripts/meta/env/cache/{registry,package}.sh: per-cache env defaults,
hostname-derived admin password seed (uses `hostname` command, not
$HOSTNAME shell var, so the value is identical across interactive
shells, non-interactive subshells, and Python subprocesses).
- scripts/docker/cache/{registry-ca,package}.sh: container-side
bootstrap helpers, both moved under scripts/docker/cache/.
- scripts/system/cache/clean.sh + `make cache-clean`: wipes both
/var/cache/infinito/core/cache/{registry,package} dirs and stops
the cache containers.
- cli/deploy/development/compose.py: Profile gate exports the three
new INFINITO_PACKAGE_CACHE_* client-snippet paths and runs the
bootstrap helper after the package-cache reports healthy.
Compose service uses sonatype/nexus3:3.91.1-ubi pinned, runs as
root (UBI image refuses to chown a fresh bind-mount), and forces
NEXUS_SECURITY_RANDOMPASSWORD=false so the bootstrap can log in with
admin/admin123 before rotating; the random-password mode otherwise
auto-completes onboarding silently and leaves no readable secret on
disk for an automated bootstrap to pick up.
Tests: tests/unit/cli/deploy/development/test_compose.py grows two
new assertions (cache services listed in `up` args when local; build
tests pin CI=true to retain ci-only assertions).
Closes req-012.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Package-Cache Wiring 📦
Static configuration that wires the infinito runner container to the
package-cache pull-through proxy defined in
compose.yml. The proxy
(sonatype/nexus3) caches
package-manager downloads (pypi, npm, apt, helm, raw) so re-deploys and
local fresh-purges do not trigger live upstream traffic. Companion to
the existing registry-cache, which
covers Docker image pulls.
Activation 🎚️
The proxy lives in the shared cache compose profile and is selected
by profile.py:
- Active on developer machines, where the host disk persists between deploys and cross-run dedup pays off.
- Inactive in CI runs (
GITHUB_ACTIONS=true,RUNNING_ON_GITHUB=true, orCI=true); fresh runner disks would not benefit from cross-run dedup and the proxy startup is net loss.
When inactive, infinito.depends_on.package-cache is required: false
so Compose does not pull the proxy in via the dependency, and every
client-config bind-mount in this directory falls back to /dev/null
so the runner deploys identically with the cache off.
Scope 📋
- This directory MUST contain only client-side configuration that
routes a package manager inside
infinitothrough the Nexus proxy. - The bootstrap helper that creates Nexus's blobstore and proxy repos
lives at
package.sh
and is invoked from
up.py once after the stack is
healthy under the
cacheprofile. - Each client-config file is bind-mounted to a fixed path inside the
runner via
compose.yml. The bind source is gated through a per-file${INFINITO_PACKAGE_CACHE_*_CONF:-/dev/null}env var that the Profile class sets only when thecacheprofile is active.
Files 📄
pip.conf: pip configuration. Mounted at/etc/pip.confinside the runner. Routes pip throughpypi-proxy.npmrc: npm configuration. Mounted at/root/.npmrc. Routes npm throughnpm-proxy.apt.list: apt sources list. Mounted at/etc/apt/sources.list.d/package-cache.list. Routes apt throughapt-debian(Debian runners) andapt-ubuntu(Ubuntu runners).
The bootstrap helper also registers a helm-bitnami proxy repo for
future helm-driven roles. No client snippet ships today because no
role pulls helm charts; the proxy registration is zero-cost prep.
For the env-variable contract that governs admin password, heap sizing, blobstore quota, and host paths, see the Package Cache section in compose.yml.md.