3c044d42df
Several concurrent workstreams committed together as a checkpoint: - Ariadne mobile resolver — BchFetcher/Bns/MainActivity resolution logic, AndroidManifest + build.ps1 - Theseus password manager — settings.html/chrome.html/settings-preload.js UI + main.js wiring + package.json resource; Argus password-vault.js, record-picker.js (+ tests) and resolver-web.d.ts - Hephaestus — new BCH-wallet OIDC auth-proxy + Forgejo docker-compose and restic/S3 scripts (secrets referenced via env only; Hephaestus/.env is gitignored) - Argus public-gateway.mjs updates - Docs — root README, Email README/RUNBOOK, VPS access runbooks (Checkers/Deviant), site/hermes, WebsiteDev registry + faster-blocks, Failures/ AAAA-mangle writeup, Decentralized Storage map, coordination notes - .gitignore — exclude /.keys/ and Hephaestus/.env
90 lines
3.5 KiB
YAML
90 lines
3.5 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
POSTGRES_DB: ${POSTGRES_DB}
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
auth-proxy:
|
|
build: ./auth-proxy
|
|
restart: unless-stopped
|
|
environment:
|
|
ISSUER: ${AUTH_PROXY_ISSUER}
|
|
CLIENT_ID: ${AUTH_PROXY_CLIENT_ID}
|
|
CLIENT_SECRET: ${AUTH_PROXY_CLIENT_SECRET}
|
|
CHALLENGE_DOMAIN: ${AUTH_PROXY_CHALLENGE_DOMAIN}
|
|
FORGEJO_REDIRECT_URI: ${FORGEJO_ROOT_URL}user/oauth2/hephaestus-wallet/callback
|
|
ports:
|
|
- "4000:4000"
|
|
volumes:
|
|
- auth-proxy-keys:/data
|
|
|
|
forgejo:
|
|
image: codeberg.org/forgejo/forgejo:10
|
|
restart: unless-stopped
|
|
environment:
|
|
USER_UID: "1000"
|
|
USER_GID: "1000"
|
|
FORGEJO__database__DB_TYPE: postgres
|
|
FORGEJO__database__HOST: postgres:5432
|
|
FORGEJO__database__NAME: ${POSTGRES_DB}
|
|
FORGEJO__database__USER: ${POSTGRES_USER}
|
|
FORGEJO__database__PASSWD: ${POSTGRES_PASSWORD}
|
|
FORGEJO__server__DOMAIN: ${FORGEJO_DOMAIN}
|
|
FORGEJO__server__ROOT_URL: ${FORGEJO_ROOT_URL}
|
|
FORGEJO__security__SECRET_KEY: ${FORGEJO_SECRET_KEY}
|
|
FORGEJO__security__INTERNAL_TOKEN: ${FORGEJO_INTERNAL_TOKEN}
|
|
FORGEJO__oauth2__JWT_SECRET: ${FORGEJO_OAUTH_JWT_SECRET}
|
|
# --- sia.storage S3 backends ---
|
|
FORGEJO__storage.lfs__STORAGE_TYPE: minio
|
|
FORGEJO__storage.lfs__MINIO_ENDPOINT: ${SIA_STORAGE_ENDPOINT}
|
|
FORGEJO__storage.lfs__MINIO_ACCESS_KEY_ID: ${SIA_STORAGE_ACCESS_KEY}
|
|
FORGEJO__storage.lfs__MINIO_SECRET_ACCESS_KEY: ${SIA_STORAGE_SECRET_KEY}
|
|
FORGEJO__storage.lfs__MINIO_BUCKET: ${SIA_STORAGE_BUCKET}
|
|
FORGEJO__storage.lfs__MINIO_LOCATION: us-east-1
|
|
FORGEJO__storage.lfs__MINIO_USE_SSL: "true"
|
|
FORGEJO__storage.lfs__MINIO_BASE_PATH: lfs/
|
|
FORGEJO__storage.attachments__STORAGE_TYPE: minio
|
|
FORGEJO__storage.attachments__MINIO_BASE_PATH: attachments/
|
|
FORGEJO__storage.packages__STORAGE_TYPE: minio
|
|
FORGEJO__storage.packages__MINIO_BASE_PATH: packages/
|
|
FORGEJO__storage.repo-archive__STORAGE_TYPE: minio
|
|
FORGEJO__storage.repo-archive__MINIO_BASE_PATH: archives/
|
|
# (attachments/packages/archives inherit endpoint+creds+bucket from [storage] via shared minio settings below)
|
|
FORGEJO__storage__MINIO_ENDPOINT: ${SIA_STORAGE_ENDPOINT}
|
|
FORGEJO__storage__MINIO_ACCESS_KEY_ID: ${SIA_STORAGE_ACCESS_KEY}
|
|
FORGEJO__storage__MINIO_SECRET_ACCESS_KEY: ${SIA_STORAGE_SECRET_KEY}
|
|
FORGEJO__storage__MINIO_BUCKET: ${SIA_STORAGE_BUCKET}
|
|
FORGEJO__storage__MINIO_USE_SSL: "true"
|
|
# --- Quota (free tier: 500 MB per user across repos+LFS+attachments+packages) ---
|
|
FORGEJO__quota__ENABLED: "true"
|
|
FORGEJO__quota__DEFAULT_GROUPS: free
|
|
# --- Registration: disabled (users bootstrap by wallet OIDC login) ---
|
|
FORGEJO__service__DISABLE_REGISTRATION: "true"
|
|
FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: "true"
|
|
FORGEJO__service__SHOW_REGISTRATION_BUTTON: "false"
|
|
FORGEJO__service__ENABLE_INTERNAL_SIGNIN: "false"
|
|
ports:
|
|
- "3000:3000"
|
|
- "2222:22"
|
|
volumes:
|
|
- forgejo-data:/data
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
auth-proxy:
|
|
condition: service_started
|
|
|
|
volumes:
|
|
postgres-data:
|
|
forgejo-data:
|
|
auth-proxy-keys:
|