| M | Dockerfile | 18 | +++++++++++++++++- |
| M | README.md | 4 | +++- |
| M | server/ | 5 | +++-- |
| M | test/ | 8 | ++++---- |
| M | test/ | 2 | +- |
| M | test/ | 2 | +- |
| M | test/ | 8 | +------- |
@@ -17,21 +17,37 @@ RUN CGO_ENABLED=0 GOBIN=/out go install github.com/rclone/rclone@v1.75.2
1717 FROM golang:1.27.2 AS litestream1818 RUN CGO_ENABLED=0 GOBIN=/out go install github.com/benbjohnson/litestream/cmd/litestream@v0.5.171919 20+# Caddy serves pages, sites and HTTPS clones. Debian's is 2.6, from 2022, and21+# the edge runs 2.11 (Alpine's, deploy/edge), so build a pinned release of22+# the same line, checked the same way. Built as Caddy's own releases are23+# (trimmed paths, no symbol table: a third smaller); a build of Caddy's own24+# module can't read its version, so caddy version is told it (CustomVersion).25+FROM golang:1.27.2 AS caddy26+RUN v=v2.11.7 && CGO_ENABLED=0 GOBIN=/out go install -trimpath \27+ -ldflags "-s -w -X github.com/caddyserver/caddy/v2.CustomVersion=$v" \28+ github.com/caddyserver/caddy/v2/cmd/caddy@$v29+2030 # Node runs the TypeScript sources directly (type stripping). 24 is the LTS2131 # whose WebCrypto has ML-DSA (24.7 and later), so passkeys can be2232 # post-quantum; the forge itself needs 22.18 or later.2333 FROM node:24-trixie-slim2434 35+# Caddy gets the system user Debian's package would make, in the git group36+# to read pages and repos. media-types is /etc/mime.types, the content37+# types Caddy sends for files beyond the few Go knows itself.2538 RUN apt-get update \26- && apt-get install -y --no-install-recommends git openssh-server caddy ca-certificates tini fcgiwrap restic \39+ && apt-get install -y --no-install-recommends git openssh-server ca-certificates tini fcgiwrap restic media-types \2740 && rm -rf /var/lib/apt/lists/* \2841 && adduser --system --group --shell /bin/sh --home /srv/git git \42+ && adduser --system --group --shell /usr/sbin/nologin --home /var/lib/caddy --gecos 'Caddy web server' caddy \2943 && usermod -aG git caddy \44+ && mkdir -p /etc/caddy \3045 && rm -f /etc/ssh/ssh_host_*3146 3247 COPY --from=tailcat /out/tailcat /usr/local/bin/tailcat3348 COPY --from=rclone /out/rclone /usr/local/bin/rclone3449 COPY --from=litestream /out/litestream /usr/local/bin/litestream50+COPY --from=caddy /out/caddy /usr/local/bin/caddy3551 COPY server/container/sshd.conf /etc/ssh/sshd_config.d/forge.conf3652 3753 WORKDIR /opt/forge@@ -775,7 +775,9 @@ The forge is one container (`Dockerfile`, on Node 24 LTS): sshd for git,
775775 Caddy for pages, sites, and HTTPS clones (with fcgiwrap for `git776776 http-backend`), the events, private and pages servers, litestream, and777777 tailcat. `server/container/start.sh` starts them all. All state is in778-`/srv/git`, a volume.778+`/srv/git`, a volume. Caddy, rclone, litestream and tailcat are pinned779+releases the Dockerfile builds from source; the rest comes from Debian.780+Caddy is on the edge's line, 2.11, where Debian has 2.6.779781 780782 ### Home machine behind a public edge (how src.rest runs)781783 @@ -101,9 +101,10 @@ if [ -n "${FORGE_OWNER:-}" ] && [ -n "${FORGE_OWNER_KEY:-}" ] && ! grep -q "^$FO
101101 fi102102 as_git $forge keys sync103103 104-# TLS is terminated in front of us; Caddy serves plain HTTP on 8080.104+# TLS is terminated in front of us; Caddy serves plain HTTP on 8080. The105+# config is written anew on every boot, so Caddy keeps no copy of it.105106 {106- printf '{\n\tauto_https off\n\thttp_port 8080\n\tadmin off\n}\n\n'107+ printf '{\n\tauto_https off\n\thttp_port 8080\n\tadmin off\n\tpersist_config off\n}\n\n'107108 as_git $forge server caddyfile :8080 "$pages" "${pages:+http://$pages}"108109 } >/etc/caddy/Caddyfile109110 @@ -1,9 +1,9 @@
11 22 # Run the scenarios in the forge's container, as root, the way the forge3-# runs there: Debian's sh (dash), its git, Caddy, restic and litestream, a4-# git user to hand restores to, and no curl. This checkout's code runs with5-# the image's node_modules and DuckDB extensions, so only a change to the6-# Dockerfile or the packages needs a new image.3+# runs there: Debian's sh (dash) and git, the image's Caddy, restic and4+# litestream, a git user to hand restores to, and no curl. This checkout's5+# code runs with the image's node_modules and DuckDB extensions, so only a6+# change to the Dockerfile or the packages needs a new image.77 #88 # docker build -t forge:test . the image, once99 # sh test/container.sh every scenario@@ -29,7 +29,7 @@ ok caddy adapt --config "$T/Caddyfile" --adapter caddyfile
2929 cport=$(free_port)3030 private_server3131 {32- printf '{\n\tadmin off\n\tauto_https off\n}\n\n'32+ printf '{\n\tadmin off\n\tauto_https off\n\tpersist_config off\n}\n\n'3333 FORGE_PRIVATE_PORT=$PRIV_PORT "$FORGE" server caddyfile "http://127.0.0.1:$cport"3434 } >"$T/Caddyfile.run"3535 XDG_DATA_HOME=$T/xdg XDG_CONFIG_HOME=$T/xdg caddy run --config "$T/Caddyfile.run" --adapter caddyfile >"$T/caddy.log" 2>&1 &@@ -36,7 +36,7 @@ private_server
3636 node "$T_HOME/test/git-cgi.ts" "$gport" >"$T/cgi.log" 2>&1 &3737 T_PIDS="$T_PIDS $!"3838 {39- printf '{\n\tadmin off\n\tauto_https off\n}\n\n'39+ printf '{\n\tadmin off\n\tauto_https off\n\tpersist_config off\n}\n\n'4040 PATH="$T/bin:$PATH" FORGE_PRIVATE_PORT=$PRIV_PORT "$FORGE" server caddyfile "http://127.0.0.1:$cport"4141 } | awk -v up="127.0.0.1:$gport" '4242 /reverse_proxy unix\/\/run\/fcgiwrap\.socket/ { sub(/unix\/\/run\/fcgiwrap\.socket/, up); print; next }@@ -14,11 +14,5 @@ has "$e" 'not path_regexp \^/\[\^/\]\+/\[\^/\]\+/releases/download/\.$'
1414 has "$e" 'header @download Content-Disposition attachment'1515 if command -v caddy >/dev/null 2>&1; then1616 ok caddy adapt --config "$T/Caddyfile" --adapter caddyfile17- # The edge's Caddy is Alpine's (deploy/edge/Dockerfile), and newer than18- # Debian's 2.6 in the forge's container, which doesn't know the edge's19- # persist_config.20- case $(caddy version) in21- v2.[0-6].* | 2.[0-6].*) note "caddy $(caddy version | cut -d' ' -f1) is older than the edge's: skipped adapting deploy/edge/Caddyfile" ;;22- *) FORGE_DOMAIN=src.test FORGE_MIRROR_URL=https://mirror.test ok caddy adapt --config "$e" --adapter caddyfile ;;23- esac17+ FORGE_DOMAIN=src.test FORGE_MIRROR_URL=https://mirror.test ok caddy adapt --config "$e" --adapter caddyfile2418 fi