mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 04:36:40 +00:00
kevinveenbirkenbachandClaude Opus 4.7
b34131ca1d
Brings up the package-cache compose service alongside the existing
registry-cache, gated by the same `cache` profile. Bootstrap helper
(scripts/docker/cache/package.sh) auto-rotates the admin password from
the well-known default, accepts the Sonatype CE EULA (3.71+ blocks
artifact downloads with HTTP 403 until /v1/system/eula is POSTed —
disclaimer must be sent verbatim with its unicode quotes), enables
anonymous read, creates one default blobstore, and registers the MVP
proxy set: apt-debian, apt-ubuntu, pypi-proxy, npm-proxy, helm-bitnami,
raw-githubusercontent. The runner gets pip.conf / .npmrc /
sources.list snippets bind-mounted in (each defaulting to /dev/null
when the cache profile is inactive) so the deploy is byte-identical
with cache off.
Cache plumbing:
- scripts/meta/env/cache/{registry,package}.sh: per-cache env defaults,
hostname-derived admin password seed (uses `hostname` command, not
$HOSTNAME shell var, so the value is identical across interactive
shells, non-interactive subshells, and Python subprocesses).
- scripts/docker/cache/{registry-ca,package}.sh: container-side
bootstrap helpers, both moved under scripts/docker/cache/.
- scripts/system/cache/clean.sh + `make cache-clean`: wipes both
/var/cache/infinito/core/cache/{registry,package} dirs and stops
the cache containers.
- cli/deploy/development/compose.py: Profile gate exports the three
new INFINITO_PACKAGE_CACHE_* client-snippet paths and runs the
bootstrap helper after the package-cache reports healthy.
Compose service uses sonatype/nexus3:3.91.1-ubi pinned, runs as
root (UBI image refuses to chown a fresh bind-mount), and forces
NEXUS_SECURITY_RANDOMPASSWORD=false so the bootstrap can log in with
admin/admin123 before rotating; the random-password mode otherwise
auto-completes onboarding silently and leaves no readable secret on
disk for an automated bootstrap to pick up.
Tests: tests/unit/cli/deploy/development/test_compose.py grows two
new assertions (cache services listed in `up` args when local; build
tests pin CI=true to retain ci-only assertions).
Closes req-012.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
46 lines
2.0 KiB
Bash
Executable File
46 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# shellcheck shell=bash
|
|
#
|
|
# Resolve registry-cache defaults outside compose.yml so the YAML stays
|
|
# free of magic numbers and so the cache size can adapt to the host's
|
|
# free disk space at source time. compose.yml consumes the three
|
|
# variables exported here strictly via `${VAR:?...}`; sourcing this
|
|
# file (transitively via scripts/meta/env/all.sh) is mandatory before
|
|
# any `docker compose ...` invocation that touches the `cache` profile.
|
|
|
|
set -euo pipefail
|
|
|
|
: "${INFINITO_REGISTRY_CACHE_HOST_PATH:=/var/cache/infinito/core/cache/registry/mirror}"
|
|
: "${INFINITO_REGISTRY_CACHE_CA_HOST_PATH:=/var/cache/infinito/core/cache/registry/ca}"
|
|
export INFINITO_REGISTRY_CACHE_HOST_PATH
|
|
export INFINITO_REGISTRY_CACHE_CA_HOST_PATH
|
|
|
|
# Default CACHE_MAX_SIZE to half the free disk space at the cache path
|
|
# (or its closest existing ancestor, since the path itself is created
|
|
# on first start by docker compose `bind: { create_host_path: true }`).
|
|
# The proxy treats this as a soft cap with LRU eviction, so reserving
|
|
# the OTHER half for the rest of the system keeps the host usable when
|
|
# the cache fills. Override by exporting INFINITO_REGISTRY_CACHE_MAX_SIZE
|
|
# explicitly before sourcing this file.
|
|
if [[ -z "${INFINITO_REGISTRY_CACHE_MAX_SIZE:-}" ]]; then
|
|
_rc_path="${INFINITO_REGISTRY_CACHE_HOST_PATH}"
|
|
while [[ ! -d "${_rc_path}" && "${_rc_path}" != "/" && "${_rc_path}" != "." ]]; do
|
|
_rc_path="$(dirname "${_rc_path}")"
|
|
done
|
|
# df --output=avail -B1G prints "Avail" header + integer-GB rows.
|
|
_rc_avail_gb="$(df --output=avail -B1G "${_rc_path}" 2>/dev/null | awk 'NR==2 {print $1+0}')"
|
|
if [[ -z "${_rc_avail_gb}" || "${_rc_avail_gb}" -le 0 ]]; then
|
|
# df failed or zero free space; fall back to a conservative cap
|
|
# so the proxy still has a bounded budget instead of unbounded
|
|
# growth into a possibly tiny tmpfs.
|
|
_rc_avail_gb=2
|
|
fi
|
|
_rc_half_gb=$((_rc_avail_gb / 2))
|
|
if [[ "${_rc_half_gb}" -lt 1 ]]; then
|
|
_rc_half_gb=1
|
|
fi
|
|
INFINITO_REGISTRY_CACHE_MAX_SIZE="${_rc_half_gb}g"
|
|
unset _rc_path _rc_avail_gb _rc_half_gb
|
|
fi
|
|
export INFINITO_REGISTRY_CACHE_MAX_SIZE
|