From f526d92fd5a9655f121ed50e281a2629ec5c3b97 Mon Sep 17 00:00:00 2001
From: Seongmin Lee <git@boltless.me>
Date: Wed, 13 May 2026 19:38:15 +0900
Subject: [PATCH] contrib: include spindle

Signed-off-by: Seongmin Lee <git@boltless.me>
---
 contrib/Caddyfile                |  6 +++++
 contrib/readme.md                |  4 +---
 contrib/scripts/init-accounts.sh |  1 +
 contrib/spindle.Dockerfile       | 37 ++++++++++++++++++++++++++++
 docker-compose.yml               | 41 ++++++++++++++++++++++++++++++++
 5 files changed, 86 insertions(+), 3 deletions(-)
 create mode 100644 contrib/spindle.Dockerfile

diff --git a/contrib/Caddyfile b/contrib/Caddyfile
index efc10874..492634db 100644
--- a/contrib/Caddyfile
+++ b/contrib/Caddyfile
@@ -37,6 +37,12 @@ knot.tngl.boltless.dev {
     reverse_proxy knot:5555
 }
 
+# spindle
+spindle.tngl.boltless.dev {
+    tls internal
+    reverse_proxy spindle:6555
+}
+
 # knotmirror
 mirror.tngl.boltless.dev {
     tls internal
diff --git a/contrib/readme.md b/contrib/readme.md
index 203a6194..329a8865 100644
--- a/contrib/readme.md
+++ b/contrib/readme.md
@@ -14,13 +14,11 @@ To make that work:
 - atproto_pds (<https://pds.tngl.boltless.dev>)
 - jetstream (<https://jetstream.tngl.boltless.dev>)
 - knot (<https://knot.tngl.boltless.dev>)
+- spindle (<https://spindle.tngl.boltless.dev>)
 - knotmirror (<https://knotmirror.tngl.boltless.dev>)
 - appview (<https://tngl.boltless.dev>) (live reloading)
 - caddy reverse proxy
 
-> [!NOTE]
-> Spindle is not included yet.
-
 ## Setup
 
 1. Generate the dev CA from the repo root:
diff --git a/contrib/scripts/init-accounts.sh b/contrib/scripts/init-accounts.sh
index e866c0dc..d4460bd6 100644
--- a/contrib/scripts/init-accounts.sh
+++ b/contrib/scripts/init-accounts.sh
@@ -187,5 +187,6 @@ printf '[env] wrote label-defaults, label-gfi\n' >&2
 JWT=$(login "$OWNER_DID")
 
 put_record "$JWT" "$OWNER_DID" "sh.tangled.knot" $KNOT_HOSTNAME "{\"createdAt\": \"${CREATED_AT}\"}"
+put_record "$JWT" "$OWNER_DID" "sh.tangled.spindle" $SPINDLE_HOSTNAME "{\"createdAt\": \"${CREATED_AT}\"}"
 
 printf 'done.\n' >&2
diff --git a/contrib/spindle.Dockerfile b/contrib/spindle.Dockerfile
new file mode 100644
index 00000000..1eac7022
--- /dev/null
+++ b/contrib/spindle.Dockerfile
@@ -0,0 +1,37 @@
+# Development only. Not for production use.
+
+FROM golang:1.25-alpine AS build
+
+RUN apk add --no-cache git build-base sqlite-dev
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=1 go build -tags libsqlite3 -o /spindle ./cmd/spindle
+
+FROM alpine:3.22
+
+RUN apk add --no-cache git tini ca-certificates sqlite-libs
+
+# Trust dev CA in the system bundle so git/curl/openssl all accept caddy certs.
+COPY contrib/certs/root.crt /usr/local/share/ca-certificates/caddy.crt
+RUN update-ca-certificates
+
+COPY --from=build /spindle /usr/local/bin/spindle
+
+COPY <<'EOF' /usr/local/bin/spindle-entrypoint.sh
+#!/bin/sh
+set -eu
+[ -z "${SPINDLE_SERVER_OWNER:-}" ] && [ -r /shared/owner-did ] && \
+    export SPINDLE_SERVER_OWNER="$(cat /shared/owner-did)"
+: "${SPINDLE_SERVER_OWNER:?set via env or /shared/owner-did}"
+
+exec /usr/local/bin/spindle
+EOF
+RUN chmod +x /usr/local/bin/spindle-entrypoint.sh
+
+EXPOSE 6555
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["/usr/local/bin/spindle-entrypoint.sh"]
diff --git a/docker-compose.yml b/docker-compose.yml
index 911daee8..799460dd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -50,6 +50,7 @@ services:
       PDS_URL: http://pds:3000
       OWNER_USER: alice
       KNOT_HOSTNAME: knot.tngl.boltless.dev
+      SPINDLE_HOSTNAME: spindle.tngl.boltless.dev
     volumes:
       - ./contrib/scripts/init-accounts.sh:/init.sh:ro
       - init-state:/shared
@@ -131,6 +132,44 @@ services:
         condition: service_completed_successfully
     networks: [tngl]
 
+  spindle:
+    build:
+      context: .
+      dockerfile: contrib/spindle.Dockerfile
+    restart: unless-stopped
+    environment:
+      SPINDLE_SERVER_HOSTNAME: spindle.tngl.boltless.dev
+      SPINDLE_SERVER_LISTEN_ADDR: 0.0.0.0:6555
+      SPINDLE_SERVER_PLC_URL: https://plc.tngl.boltless.dev
+      SPINDLE_SERVER_JETSTREAM_ENDPOINT: wss://jetstream.tngl.boltless.dev/subscribe
+      SPINDLE_SERVER_TAP_RELAY_URL: https://pds.tngl.boltless.dev
+      SPINDLE_SERVER_DB_PATH: /var/lib/spindle/spindle.db
+      SPINDLE_SERVER_TAP_DB_PATH: /var/lib/spindle/tap.db
+      SPINDLE_SERVER_DEV: "true"
+      # Hostnames CI containers must reach via host-gateway (host's Caddy).
+      # TLS verify off in dev mode (clone.go skips check for fetch).
+      SPINDLE_SERVER_DEV_EXTRA_HOSTS: knot.tngl.boltless.dev,mirror.tngl.boltless.dev
+    volumes:
+      - spindle-data:/var/lib/spindle
+      - spindle-logs:/var/log/spindle
+      - init-state:/shared:ro
+      - ./contrib/certs/root.crt:/etc/ssl/certs/caddy.crt:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:6555/"]
+      interval: 2s
+      timeout: 2s
+      retries: 60
+      start_period: 30s
+    depends_on:
+      plc:
+        condition: service_started
+      jetstream:
+        condition: service_started
+      init-accounts:
+        condition: service_completed_successfully
+    networks: [tngl]
+
   knotmirror-tap:
     image: ghcr.io/bluesky-social/indigo/tap:sha-4f47add43060c27e8a37d9d76482ecddf001fcd8 # 0.1.10
     restart: unless-stopped
@@ -266,6 +305,8 @@ volumes:
   jetstream-data:
   knot-data:
   knot-ssh-keys:
+  spindle-data:
+  spindle-logs:
   knotmirror-data:
   init-state:
   go-cache:
-- 
2.51.2