From 78ec407c164d1e141dfc0d7c995055773dda0033 Mon Sep 17 00:00:00 2001 From: Seongmin Lee Date: Wed, 13 May 2026 19:38:15 +0900 Subject: [PATCH] wip: appview,spindle: more explicit TLS handling Signed-off-by: Seongmin Lee --- appview/pipelines/pipelines.go | 12 ++++++------ appview/state/knotstream.go | 2 +- appview/state/spindlestream.go | 2 +- spindle/config/config.go | 27 ++++++++++++++------------- spindle/engines/nixery/engine.go | 9 +++++++-- spindle/models/clone.go | 14 ++++++++++---- spindle/server.go | 2 +- 7 files changed, 40 insertions(+), 28 deletions(-) diff --git a/appview/pipelines/pipelines.go b/appview/pipelines/pipelines.go index 9690f143..1bdb5da7 100644 --- a/appview/pipelines/pipelines.go +++ b/appview/pipelines/pipelines.go @@ -7,7 +7,7 @@ import ( "fmt" "log/slog" "net/http" - "strings" + "path" "time" "tangled.org/core/api/tangled" @@ -218,11 +218,11 @@ func (p *Pipelines) Logs(w http.ResponseWriter, r *http.Request) { } scheme := "wss" - if p.config.Core.Dev { - scheme = "ws" - } + // if p.config.Core.Dev { + // scheme = "ws" + // } - url := scheme + "://" + strings.Join([]string{spindle, "logs", knot, rkey, workflow}, "/") + url := scheme + "://" + path.Join(spindle, "logs", knot, rkey, workflow) l = l.With("url", url) clientConn, err := upgrader.Upgrade(w, r, nil) @@ -392,7 +392,7 @@ func (p *Pipelines) Cancel(w http.ResponseWriter, r *http.Request) { r, oauth.WithService(f.Spindle), oauth.WithLxm(tangled.PipelineCancelPipelineNSID), - oauth.WithDev(p.config.Core.Dev), + oauth.WithDev(false), oauth.WithTimeout(time.Second*30), // workflow cleanup usually takes time ) diff --git a/appview/state/knotstream.go b/appview/state/knotstream.go index 49877e3e..fbea2be4 100644 --- a/appview/state/knotstream.go +++ b/appview/state/knotstream.go @@ -62,7 +62,7 @@ func Knotstream(ctx context.Context, c *config.Config, d *db.DB, enforcer *rbac. WorkerCount: c.Knotstream.WorkerCount, QueueSize: c.Knotstream.QueueSize, Logger: logger, - Dev: c.Core.Dev, + Dev: false, CursorStore: &cursorStore, } diff --git a/appview/state/spindlestream.go b/appview/state/spindlestream.go index 041c53f0..f3827565 100644 --- a/appview/state/spindlestream.go +++ b/appview/state/spindlestream.go @@ -53,7 +53,7 @@ func Spindlestream(ctx context.Context, c *config.Config, d *db.DB, enforcer *rb WorkerCount: c.Spindlestream.WorkerCount, QueueSize: c.Spindlestream.QueueSize, Logger: logger, - Dev: c.Core.Dev, + Dev: false, CursorStore: &cursorStore, } diff --git a/spindle/config/config.go b/spindle/config/config.go index ba17151b..794ce864 100644 --- a/spindle/config/config.go +++ b/spindle/config/config.go @@ -9,19 +9,20 @@ import ( ) type Server struct { - ListenAddr string `env:"LISTEN_ADDR, default=0.0.0.0:6555"` - DBPath string `env:"DB_PATH, default=spindle.db"` - Hostname string `env:"HOSTNAME, required"` - JetstreamEndpoint string `env:"JETSTREAM_ENDPOINT, default=wss://jetstream1.us-west.bsky.network/subscribe"` - Tap Tap `env:",prefix=TAP_"` - PlcUrl string `env:"PLC_URL, default=https://plc.directory"` - Dev bool `env:"DEV, default=false"` - Owner string `env:"OWNER, required"` - Secrets Secrets `env:",prefix=SECRETS_"` - LogDir string `env:"LOG_DIR, default=/var/log/spindle"` - QueueSize int `env:"QUEUE_SIZE, default=100"` - MaxJobCount int `env:"MAX_JOB_COUNT, default=2"` // max number of pipelines that run at a time - MaxConcurrentWorkflows int `env:"MAX_CONCURRENT_WORKFLOWS, default=8"` // max number of workflow containers running at once (memory cap) + ListenAddr string `env:"LISTEN_ADDR, default=0.0.0.0:6555"` + DBPath string `env:"DB_PATH, default=spindle.db"` + Hostname string `env:"HOSTNAME, required"` + JetstreamEndpoint string `env:"JETSTREAM_ENDPOINT, default=wss://jetstream1.us-west.bsky.network/subscribe"` + Tap Tap `env:",prefix=TAP_"` + PlcUrl string `env:"PLC_URL, default=https://plc.directory"` + Dev bool `env:"DEV, default=false"` + DevExtraHosts []string `env:"DEV_EXTRA_HOSTS"` + Owner string `env:"OWNER, required"` + Secrets Secrets `env:",prefix=SECRETS_"` + LogDir string `env:"LOG_DIR, default=/var/log/spindle"` + QueueSize int `env:"QUEUE_SIZE, default=100"` + MaxJobCount int `env:"MAX_JOB_COUNT, default=2"` // max number of pipelines that run at a time + MaxConcurrentWorkflows int `env:"MAX_CONCURRENT_WORKFLOWS, default=8"` // max number of workflow containers running at once (memory cap) } type Tap struct { diff --git a/spindle/engines/nixery/engine.go b/spindle/engines/nixery/engine.go index 0862bfb4..20f23877 100644 --- a/spindle/engines/nixery/engine.go +++ b/spindle/engines/nixery/engine.go @@ -219,13 +219,18 @@ func (e *Engine) SetupWorkflow(ctx context.Context, wid models.WorkflowId, wf *m for scanner.Scan() { line := scanner.Text() wfLogger.DataWriter(setupStepIdx, "stdout").Write([]byte(line)) - l.Info("image pull progress", "stdout", line) + // l.Info("image pull progress", "stdout", line) } /// -------------------------CONTAINER CREATION------------------------------------- l.Info("creating container") wfLogger.DataWriter(setupStepIdx, "stdout").Write([]byte("creating container...")) + extraHosts := []string{"host.docker.internal:host-gateway"} + for _, h := range e.cfg.Server.DevExtraHosts { + extraHosts = append(extraHosts, h+":host-gateway") + } + resp, err := e.docker.ContainerCreate(ctx, &container.Config{ Image: addl.image, Cmd: []string{"cat"}, @@ -256,7 +261,7 @@ func (e *Engine) SetupWorkflow(ctx context.Context, wid models.WorkflowId, wf *m CapDrop: []string{"ALL"}, CapAdd: []string{"CAP_DAC_OVERRIDE", "CAP_CHOWN", "CAP_FOWNER", "CAP_SETUID", "CAP_SETGID"}, SecurityOpt: []string{"no-new-privileges"}, - ExtraHosts: []string{"host.docker.internal:host-gateway"}, + ExtraHosts: extraHosts, Resources: container.Resources{ Memory: e.cfg.NixeryPipelines.MaxJobMemoryMB * 1024 * 1024, }, diff --git a/spindle/models/clone.go b/spindle/models/clone.go index d3a17574..ad7e3955 100644 --- a/spindle/models/clone.go +++ b/spindle/models/clone.go @@ -63,13 +63,20 @@ func BuildCloneStep(twf tangled.Pipeline_Workflow, tr tangled.Pipeline_TriggerMe } fetchArgs := buildFetchArgs(cloneOpts, commitSHA) + // In dev mode we point at Caddy via host-gateway with a self-signed cert, + // so skip the TLS check for the fetch call. + fetchCmd := "git fetch" + if dev { + fetchCmd = "git -c http.sslVerify=false fetch" + } + return CloneStep{ kind: StepKindSystem, name: "Clone repository into workspace", commands: []string{ "git init", fmt.Sprintf("git remote add origin %s", repoURL), - fmt.Sprintf("git fetch %s", strings.Join(fetchArgs, " ")), + fmt.Sprintf("%s %s", fetchCmd, strings.Join(fetchArgs, " ")), "git checkout FETCH_HEAD", }, } @@ -104,15 +111,14 @@ func extractCommitSHA(tr tangled.Pipeline_TriggerMetadata) (string, error) { // BuildRepoURL constructs the repository URL from repo metadata. func BuildRepoURL(repo *tangled.Pipeline_TriggerRepo, devMode bool) string { scheme := "https://" - if devMode { - scheme = "http://" - } // Get host from knot host := repo.Knot + // TODO(boltless): replace this with hostutil once docker-compose devenv become stable // In dev mode, replace localhost with host.docker.internal for Docker networking if devMode && strings.Contains(host, "localhost") { + scheme = "http://" host = strings.ReplaceAll(host, "localhost", "host.docker.internal") } diff --git a/spindle/server.go b/spindle/server.go index 4fd7d2f7..4df488d9 100644 --- a/spindle/server.go +++ b/spindle/server.go @@ -171,7 +171,7 @@ func New(ctx context.Context, cfg *config.Config, engines map[string]models.Engi // job in the above registered queue. ccfg := eventconsumer.NewConsumerConfig() ccfg.Logger = log.SubLogger(logger, "eventconsumer") - ccfg.Dev = cfg.Server.Dev + ccfg.Dev = false ccfg.ProcessFunc = spindle.processPipeline ccfg.CursorStore = cursorStore knownKnots, err := d.Knots() -- 2.51.2