kevinveenbirkenbachandClaude Opus 4.7
b34131ca1d
Brings up the package-cache compose service alongside the existing
registry-cache, gated by the same `cache` profile. Bootstrap helper
(scripts/docker/cache/package.sh) auto-rotates the admin password from
the well-known default, accepts the Sonatype CE EULA (3.71+ blocks
artifact downloads with HTTP 403 until /v1/system/eula is POSTed —
disclaimer must be sent verbatim with its unicode quotes), enables
anonymous read, creates one default blobstore, and registers the MVP
proxy set: apt-debian, apt-ubuntu, pypi-proxy, npm-proxy, helm-bitnami,
raw-githubusercontent. The runner gets pip.conf / .npmrc /
sources.list snippets bind-mounted in (each defaulting to /dev/null
when the cache profile is inactive) so the deploy is byte-identical
with cache off.
Cache plumbing:
- scripts/meta/env/cache/{registry,package}.sh: per-cache env defaults,
hostname-derived admin password seed (uses `hostname` command, not
$HOSTNAME shell var, so the value is identical across interactive
shells, non-interactive subshells, and Python subprocesses).
- scripts/docker/cache/{registry-ca,package}.sh: container-side
bootstrap helpers, both moved under scripts/docker/cache/.
- scripts/system/cache/clean.sh + `make cache-clean`: wipes both
/var/cache/infinito/core/cache/{registry,package} dirs and stops
the cache containers.
- cli/deploy/development/compose.py: Profile gate exports the three
new INFINITO_PACKAGE_CACHE_* client-snippet paths and runs the
bootstrap helper after the package-cache reports healthy.
Compose service uses sonatype/nexus3:3.91.1-ubi pinned, runs as
root (UBI image refuses to chown a fresh bind-mount), and forces
NEXUS_SECURITY_RANDOMPASSWORD=false so the bootstrap can log in with
admin/admin123 before rotating; the random-password mode otherwise
auto-completes onboarding silently and leaves no readable secret on
disk for an automated bootstrap to pick up.
Tests: tests/unit/cli/deploy/development/test_compose.py grows two
new assertions (cache services listed in `up` args when local; build
tests pin CI=true to retain ci-only assertions).
Closes req-012.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Environment Layer 🌍
This directory contains the shared environment bootstrap layer for Infinito.Nexus scripts. ✨
Its purpose is to keep runtime configuration centralized, deterministic, and easy to reuse across local runs, CI, and container-based execution. 🧭
The design follows simple composition principles so environment state can be loaded safely and consistently without duplicating logic in many places. 🧱
Use the directory-level entrypoint for sourcing this environment context in scripts and automation. ✅
Modules 📦
The directory has two kinds of env modules:
-
Always-on modules are composed by
all.shand SHOULD be sourced by anything that needs the standard project environment (Python interpreter, distro defaults, runtime context, inventory paths, GitHub markers):python.sh,runtime.sh,defaults.sh,inventory.sh,github.sh. -
On-demand modules MUST NOT be composed into
all.shbecause they encode an intent that only makes sense in a specific call path. The deploy-only marker is the canonical example:ci.shexportsINFINITO_MAKE_DEPLOY=1soMODE_CI(defined ingroup_vars/all/01_modes.yml) flips totruefor the duration of a make-driven deploy. It is sourced by every deploy entry-point underscripts/tests/deploy/local/deploy/. Sourcing it fromall.shwould set the marker for unrelatedmake test*ormake build*recipes too, which is exactly what requirement 006 forbids.