ipcr/ipcr-forge
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

IPCR Forge: public front door (docker pull without IPCR)

Browse Source 
ipcr-public: a second ipcrd behind Caddy at ipcr-<domain>, plain HTTP, no
pinning, off the admin and CI networks. With PUBLIC_POLICY it serves only
this forge's publisher name, its verified ENS/DNS name and its published
image roots; everything else is 404, pushes 405. So

  docker pull ipcr-<domain>/ipns/metadec.eth/ipcr-hello:1.0.0

works on any machine with plain Docker. Switch in the admin page
(config.json "public"), mirrored into published.json for the pages, which
show the public pull lines while it is on.

ipcr 1.5.0, bridge 0.4.0. Verified from a second machine (docs/forge.md).
This commit is contained in:
Worph
2026-10-05 12:06:45 +00:00
parent c961d74e0e
commit 241462cb76
5 changed files with 166 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Apps/IPCR-Forge/docker-compose.yml
+60 -5
View File
@@ -35,7 +35,7 @@ services:
# with the stock `rad` CLI against the node's own home. Serves the forge's page on :8080.
# Its install step (forge-setup, below) mints its Gitea token and registers the webhook.
ipcr-forge:
image: ghcr.io/yundera/ipcr-forge-bridge:0.3.0
image: ghcr.io/yundera/ipcr-forge-bridge:0.4.0
container_name: ipcr-forge
user: $PUID:$PGID
read_only: true
@@ -281,7 +281,7 @@ services:
# push that name only; IPCR logs in as the importer (state/staging-auth, which it generates).
# Same image as the bridge (`ipcr-forge-bridge gate`, bridge/gate.go). See rationale.md.
forge-gate:
image: ghcr.io/yundera/ipcr-forge-bridge:0.3.0
image: ghcr.io/yundera/ipcr-forge-bridge:0.4.0
container_name: forge-gate
user: $PUID:$PGID
read_only: true
@@ -475,7 +475,7 @@ services:
# ipcrd: TLS front door on 127.0.0.1:4767. Passes /ipfs/<cid> through to the stock nerdctl
# registry below, resolves /ipns/<name>:<tag> itself, and pins every image it serves.
ipcr-gateway:
image: ghcr.io/yundera/ipcr:1.4.0
image: ghcr.io/yundera/ipcr:1.5.0
container_name: ipcr-gateway
# Root for one reason: it writes its CA into the host's Docker trust store (the narrow
# bind below), which is root-owned. See rationale.md.
@@ -555,10 +555,63 @@ services:
limits:
memory: 128M
# ── Public front door ───────────────────────────────────────────────────────
# Forge only: the same ipcrd, a second process, serving the registry API to anyone at
# ipcr-<domain>, read-only, for this forge's own images only (gateway/public.go): its publisher
# name, its verified ENS/DNS name, its published image roots. Everything else is 404, so nobody
# can make this node fetch other IPFS content. `docker pull ipcr-<domain>/ipns/<name>/<repo>:<tag>`
# then works on any machine, without IPCR. A pull here pins nothing. The admin pages switch it
# off (config.json "public": false). Not on the admin or CI networks. See rationale.md.
ipcr-public:
image: ghcr.io/yundera/ipcr:1.5.0
container_name: ipcr-public
user: $PUID:$PGID
read_only: true
cap_drop: [ALL]
security_opt: ["no-new-privileges:true"]
restart: unless-stopped
command: ["gateway"]
environment:
TZ: $TZ
# Plain HTTP: Caddy terminates TLS (no TLS_DIR, no CA to export).
LISTEN: ":4770"
AUTO_PIN: "false"
PUBLIC_POLICY: /data/state
volumes:
# published.json and config.json, written by ipcr-gateway. Read-only.
- ${DATA_ROOT:-/DATA}/AppData/$AppID/ipcr/state:/data/state:ro
depends_on:
- ipcr-registry
healthcheck:
test: ["CMD", "ipcrd", "health", "http://127.0.0.1:4770/v2/"]
interval: 30s
timeout: 5s
retries: 3
start_period: 10s
expose:
- 4770
labels:
caddy_0: ipcr-${APP_DOMAIN}
caddy_0.import: gateway_tls
caddy_0.reverse_proxy: "{{upstreams 4770}}"
caddy_1: ipcr-${APP_PUBLIC_IP_DASH}.nip.io
caddy_1.import: gateway_tls
caddy_1.reverse_proxy: "{{upstreams 4770}}"
caddy_2: ipcr-${APP_PUBLIC_IP_DASH}.sslip.io
caddy_2.reverse_proxy: "{{upstreams 4770}}"
networks:
- pcs
- ipcr-internal
cpu_shares: 30
deploy:
resources:
limits:
memory: 256M
# ── Stock nerdctl IPFS registry ─────────────────────────────────────────────
# `nerdctl ipfs registry serve`, unmodified: translates the registry API into IPFS reads.
ipcr-registry:
image: ghcr.io/yundera/ipcr:1.4.0
image: ghcr.io/yundera/ipcr:1.5.0
container_name: ipcr-registry
# Root because nerdctl run as any other uid assumes rootless mode and refuses to start
# without a rootless containerd — which `ipfs registry serve` never uses. The service has
@@ -725,6 +778,7 @@ x-casaos:
| --- | --- |
| `https://gitea-$APP_DOMAIN` | Gitea (opens from the tile). Sign in as `gitea_admin` with your default app password |
| `https://ipcr-forge-$APP_DOMAIN` | The forge's page (public) |
| `ipcr-$APP_DOMAIN` | `docker pull` this forge's images from anywhere, without IPCR (read-only) |
| `https://radicle-$APP_DOMAIN` | Radicle explorer (public) |
| `https://radicle-api-$APP_DOMAIN` | Radicle API and read-only git (public) |
| `ipcr.localhost:4767` | IPCR registry, this server's Docker only |
@@ -760,6 +814,7 @@ x-casaos:
| --- | --- |
| `https://gitea-$APP_DOMAIN` | Gitea (s'ouvre depuis la tuile). Connexion : `gitea_admin` et votre mot de passe d'applications par défaut |
| `https://ipcr-forge-$APP_DOMAIN` | La page de la forge (publique) |
| `ipcr-$APP_DOMAIN` | `docker pull` des images de cette forge depuis n'importe où, sans IPCR (lecture seule) |
| `https://radicle-$APP_DOMAIN` | Explorateur Radicle (public) |
| `https://radicle-api-$APP_DOMAIN` | API Radicle et git en lecture seule (public) |
| `ipcr.localhost:4767` | Registre IPCR, pour le Docker de ce serveur uniquement |
@@ -919,7 +974,7 @@ x-compose-app:
# the example repository (in that organisation). Idempotent, so on every start: it repairs the webhook.
# The admin password is used here only, never stored.
- name: forge-setup
image: ghcr.io/yundera/ipcr-forge-bridge:0.3.0
image: ghcr.io/yundera/ipcr-forge-bridge:0.4.0
user: $PUID:$PGID
phase: post_up
network: $APP_NET