IPCR Forge: public front door (docker pull without IPCR)

ipcr-public: a second ipcrd behind Caddy at ipcr-<domain>, plain HTTP, no pinning, off the admin and CI networks. With PUBLIC_POLICY it serves only this forge's publisher name, its verified ENS/DNS name and its published image roots; everything else is 404, pushes 405. So docker pull ipcr-<domain>/ipns/metadec.eth/ipcr-hello:1.0.0 works on any machine with plain Docker. Switch in the admin page (config.json "public"), mirrored into published.json for the pages, which show the public pull lines while it is on. ipcr 1.5.0, bridge 0.4.0. Verified from a second machine (docs/forge.md).
2026-10-05 12:06:45 +00:00
parent c961d74e0e
commit 241462cb76
5 changed files with 166 additions and 10 deletions
@@ -35,7 +35,7 @@ services:
  # with the stock `rad` CLI against the node's own home. Serves the forge's page on :8080.
  # Its install step (forge-setup, below) mints its Gitea token and registers the webhook.
  ipcr-forge:
-    image: ghcr.io/yundera/ipcr-forge-bridge:0.3.0
+    image: ghcr.io/yundera/ipcr-forge-bridge:0.4.0
    container_name: ipcr-forge
    user: $PUID:$PGID
    read_only: true
@@ -281,7 +281,7 @@ services:
  # push that name only; IPCR logs in as the importer (state/staging-auth, which it generates).
  # Same image as the bridge (`ipcr-forge-bridge gate`, bridge/gate.go). See rationale.md.
  forge-gate:
-    image: ghcr.io/yundera/ipcr-forge-bridge:0.3.0
+    image: ghcr.io/yundera/ipcr-forge-bridge:0.4.0
    container_name: forge-gate
    user: $PUID:$PGID
    read_only: true
@@ -475,7 +475,7 @@ services:
  # ipcrd: TLS front door on 127.0.0.1:4767. Passes /ipfs/<cid> through to the stock nerdctl
  # registry below, resolves /ipns/<name>:<tag> itself, and pins every image it serves.
  ipcr-gateway:
-    image: ghcr.io/yundera/ipcr:1.4.0
+    image: ghcr.io/yundera/ipcr:1.5.0
    container_name: ipcr-gateway
    # Root for one reason: it writes its CA into the host's Docker trust store (the narrow
    # bind below), which is root-owned. See rationale.md.
@@ -555,10 +555,63 @@ services:
        limits:
          memory: 128M

+  # ── Public front door ───────────────────────────────────────────────────────
+  # Forge only: the same ipcrd, a second process, serving the registry API to anyone at
+  # ipcr-<domain>, read-only, for this forge's own images only (gateway/public.go): its publisher
+  # name, its verified ENS/DNS name, its published image roots. Everything else is 404, so nobody
+  # can make this node fetch other IPFS content. `docker pull ipcr-<domain>/ipns/<name>/<repo>:<tag>`
+  # then works on any machine, without IPCR. A pull here pins nothing. The admin pages switch it
+  # off (config.json "public": false). Not on the admin or CI networks. See rationale.md.
+  ipcr-public:
+    image: ghcr.io/yundera/ipcr:1.5.0
+    container_name: ipcr-public
+    user: $PUID:$PGID
+    read_only: true
+    cap_drop: [ALL]
+    security_opt: ["no-new-privileges:true"]
+    restart: unless-stopped
+    command: ["gateway"]
+    environment:
+      TZ: $TZ
+      # Plain HTTP: Caddy terminates TLS (no TLS_DIR, no CA to export).
+      LISTEN: ":4770"
+      AUTO_PIN: "false"
+      PUBLIC_POLICY: /data/state
+    volumes:
+      # published.json and config.json, written by ipcr-gateway. Read-only.
+      - ${DATA_ROOT:-/DATA}/AppData/$AppID/ipcr/state:/data/state:ro
+    depends_on:
+      - ipcr-registry
+    healthcheck:
+      test: ["CMD", "ipcrd", "health", "http://127.0.0.1:4770/v2/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    expose:
+      - 4770
+    labels:
+      caddy_0: ipcr-${APP_DOMAIN}
+      caddy_0.import: gateway_tls
+      caddy_0.reverse_proxy: "{{upstreams 4770}}"
+      caddy_1: ipcr-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1.import: gateway_tls
+      caddy_1.reverse_proxy: "{{upstreams 4770}}"
+      caddy_2: ipcr-${APP_PUBLIC_IP_DASH}.sslip.io
+      caddy_2.reverse_proxy: "{{upstreams 4770}}"
+    networks:
+      - pcs
+      - ipcr-internal
+    cpu_shares: 30
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+
  # ── Stock nerdctl IPFS registry ─────────────────────────────────────────────
  # `nerdctl ipfs registry serve`, unmodified: translates the registry API into IPFS reads.
  ipcr-registry:
-    image: ghcr.io/yundera/ipcr:1.4.0
+    image: ghcr.io/yundera/ipcr:1.5.0
    container_name: ipcr-registry
    # Root because nerdctl run as any other uid assumes rootless mode and refuses to start
    # without a rootless containerd — which `ipfs registry serve` never uses. The service has
@@ -725,6 +778,7 @@ x-casaos:
        | --- | --- |
        | `https://gitea-$APP_DOMAIN` | Gitea (opens from the tile). Sign in as `gitea_admin` with your default app password |
        | `https://ipcr-forge-$APP_DOMAIN` | The forge's page (public) |
+        | `ipcr-$APP_DOMAIN` | `docker pull` this forge's images from anywhere, without IPCR (read-only) |
        | `https://radicle-$APP_DOMAIN` | Radicle explorer (public) |
        | `https://radicle-api-$APP_DOMAIN` | Radicle API and read-only git (public) |
        | `ipcr.localhost:4767` | IPCR registry, this server's Docker only |
@@ -760,6 +814,7 @@ x-casaos:
        | --- | --- |
        | `https://gitea-$APP_DOMAIN` | Gitea (s'ouvre depuis la tuile). Connexion : `gitea_admin` et votre mot de passe d'applications par défaut |
        | `https://ipcr-forge-$APP_DOMAIN` | La page de la forge (publique) |
+        | `ipcr-$APP_DOMAIN` | `docker pull` des images de cette forge depuis n'importe où, sans IPCR (lecture seule) |
        | `https://radicle-$APP_DOMAIN` | Explorateur Radicle (public) |
        | `https://radicle-api-$APP_DOMAIN` | API Radicle et git en lecture seule (public) |
        | `ipcr.localhost:4767` | Registre IPCR, pour le Docker de ce serveur uniquement |
@@ -919,7 +974,7 @@ x-compose-app:
    # the example repository (in that organisation). Idempotent, so on every start: it repairs the webhook.
    # The admin password is used here only, never stored.
    - name: forge-setup
-      image: ghcr.io/yundera/ipcr-forge-bridge:0.3.0
+      image: ghcr.io/yundera/ipcr-forge-bridge:0.4.0
      user: $PUID:$PGID
      phase: post_up
      network: $APP_NET
@@ -48,6 +48,8 @@ with. See docs/forge.md.
    bridge.
 15. **The root organisation** (`IPCR_ROOT_ORG`): setup creates it if missing, and its repositories
    are also published at the root of the forge's name.
+16. **A public, unauthenticated, read-only registry route** (`ipcr-<domain>` → `ipcr-public`), so this
+    forge's images can be pulled without IPCR.

 ## Why it is necessary

@@ -132,6 +134,11 @@ already mounts read-only.
 repositories may use them. A Gitea organisation makes "who may publish there" a matter of team
 membership, managed in Gitea.

+**16. The public front door.** The IPFS address only works on machines running IPCR. People trying
+an image elsewhere (a laptop, a CI on another platform) need a registry that plain Docker can pull
+from. Public IPFS gateways cannot do it, since they have no registry API. A login would defeat the
+purpose: the images are public on IPFS anyway.
+
 ## Security mitigations in place

 **The bridge**
@@ -182,6 +189,18 @@ membership, managed in Gitea.
  and its secret at once. "Reissue" rotates a token.
 - **Gate container:** `$PUID`, no capabilities, read-only root filesystem, 64 MB.

+**The public front door**
+- **This forge's images only.** It answers only for the publisher's own IPNS name, its verified
+  ENS/DNS name, and the root CIDs of published images. Anything else is 404 before any resolution,
+  so strangers cannot use it to fetch or serve other IPFS content.
+- **Read-only and storage-neutral.** GET and HEAD only, and `AUTO_PIN=false`: a pull never pins.
+- **Isolated.**
+  - It is a separate process (`ipcr-public`) on `pcs` and `ipcr-internal` only, not on the admin
+    or CI networks.
+  - It runs as `$PUID` with no capabilities and a read-only root filesystem, capped at 256 MB.
+  - It reads the main gateway's state read-only.
+- **Can be switched off** in the admin pages (`config.json` `"public": false`).
+
 **The page**
 - **The public page cannot change anything.** The bridge serves it read-only: the embedded page,
  IPCR's `published.json` (mounted read-only) and the bridge's repository list.