initial commit

2026-10-03 16:09:47 +02:00
commit b5224cb512
25 changed files with 1804 additions and 0 deletions
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Replaces the image's own /etc/s6/act_runner/run. Two waits, both of which the
+# stock script gets wrong for this deployment.
+#
+# 1. The nested Docker daemon. Upstream waits for it through s6's readiness
+#    notification. On a cold start with a warm image store dockerd takes longer
+#    than s6-notifyoncheck's window, the notification never arrives, s6 marks
+#    the service permanently failed, and act_runner sits blocked in
+#    `s6-svwait -U` for two to four minutes before s6 gives up and lets it past
+#    anyway. The runner shows "offline" in the forge for that whole time and
+#    picks up no jobs. Asking the daemon directly is the same wait without the
+#    guesswork.
+#
+# 2. The registration token. It is minted by an init step that runs after the
+#    stack is up, so on a first install it does not exist yet when this
+#    container starts — and the stock entrypoint reads the token file exactly
+#    once, before its retry loop, so a token that arrives late is never seen.
+
+while [ ! -d /etc/s6/docker/supervise ]; do
+    sleep 0.1
+done
+
+while ! docker info >/dev/null 2>&1; do
+    sleep 1
+done
+
+while [ ! -s "${GITEA_RUNNER_REGISTRATION_TOKEN_FILE:-/data/token}" ] && [ ! -s /data/.runner ]; do
+    echo "waiting for the runner registration token"
+    sleep 2
+done
+
+exec run.sh
@@ -0,0 +1,40 @@
+# act_runner configuration. Only the settings that differ from upstream's
+# defaults are written out — `act_runner generate-config` prints the full set.
+
+log:
+  level: info
+
+runner:
+  # The file the runner's own registration is kept in, relative to /data.
+  file: .runner
+  # One job at a time. A PCS shares its CPU with everything else installed on
+  # it, and an image build is the least polite thing on the box.
+  capacity: 1
+  timeout: 1h
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  # Overrides the labels stored at registration (.runner). These are upstream
+  # act_runner defaults: Gitea's own job images, which carry node, bash, git
+  # and the docker CLI with buildx, so marketplace actions (actions/checkout,
+  # docker/build-push-action, ...) run as they do on GitHub. The registration
+  # labels pointed at node:22-bookworm, which has no docker CLI.
+  labels:
+    - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+    - "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+    - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+    - "docker:docker://docker:28.5-cli"
+
+cache:
+  # The cache server binds an address inside the runner container, which the
+  # job containers — created by the Docker daemon nested inside that same
+  # container — cannot route to. Left on, every `actions/cache` step fails
+  # noisily instead of being skipped.
+  enabled: false
+
+container:
+  # Jobs run on the runner's own nested daemon, on its default bridge: they
+  # reach the internet, and they reach Gitea the way anything outside would,
+  # through its public address.
+  network: bridge
+  privileged: false
+  force_pull: false
@@ -0,0 +1,19 @@
+#!/bin/sh
+# Run by Kubo's entrypoint before every daemon start (after `ipfs init` on the first one),
+# so a store update that changes these values reaches an installed node.
+set -e
+
+# libp2p swarm on 4768 rather than Kubo's 4001: the Kubo store app already publishes 4001 and
+# two apps cannot publish the same host port. Listening on the published port itself (instead of
+# mapping 4768→4001) keeps the addresses the node announces dialable.
+P=${IPCR_SWARM_PORT:-4768}
+ipfs config --json Addresses.Swarm "[
+  \"/ip4/0.0.0.0/tcp/$P\", \"/ip6/::/tcp/$P\",
+  \"/ip4/0.0.0.0/udp/$P/quic-v1\", \"/ip6/::/udp/$P/quic-v1\",
+  \"/ip4/0.0.0.0/udp/$P/quic-v1/webtransport\", \"/ip6/::/udp/$P/quic-v1/webtransport\",
+  \"/ip4/0.0.0.0/udp/$P/webrtc-direct\", \"/ip6/::/udp/$P/webrtc-direct\"
+]"
+
+# Soft cap on the block store. Pinned images are never collected; with --enable-gc everything
+# else (blocks fetched but not pinned) is swept every Datastore.GCPeriod.
+ipfs config Datastore.StorageMax "${IPFS_STORAGE_MAX:-20GB}"
@@ -0,0 +1,20 @@
+# Serves the Radicle Explorer single-page app.
+#
+# Port 8080, not 80: the installer runs every service as an unprivileged user, and
+# such a process cannot bind a port below 1024. The image's own Caddyfile
+# listens on :80, so this file replaces it.
+:8080 {
+	root * /usr/share/caddy
+
+	# The explorer bundle ships with the public Radicle seeds compiled into it, so
+	# "/" would open on the public network rather than on this server's node. This
+	# sends the entry point to the node page of the API served alongside it. Every
+	# other path is left alone, so the wider network stays browsable.
+	redir / /nodes/radicle-api-${APP_DOMAIN}
+
+	# The explorer is a client-side router: /nodes/..., /repos/... and friends must
+	# resolve to the app shell rather than to a 404.
+	try_files {path} /index.html
+	file_server
+	encode gzip
+}
@@ -0,0 +1,15 @@
+{
+  "preferredSeeds": [
+    "z6MksmpU5b1dS7oaqF2bHXhQi1DWy2hB7Mh9CuN7y1DN6QSz@seed.radicle.dev:8776",
+    "z6MkrLMMsiPWUcNPHcRajuMi9mDfYckSoJyPwwnknocNYPm7@seed.radicle.garden:8776",
+    "z6Mkmqogy2qEM2ummccUthFEaaHvyYmYBYh3dbe9W4ebScxo@ash.radicle.garden:8776"
+  ],
+  "node": {
+    "alias": "radicle-${APP_PUBLIC_IP_DASH}",
+    "listen": ["0.0.0.0:8776"],
+    "externalAddresses": ["radicle-${APP_PUBLIC_IP_DASH}.sslip.io:8776"],
+    "seedingPolicy": {
+      "default": "block"
+    }
+  }
+}