From f40edf5d0a2c259a87b61861ef4bfa3c94b98444 Mon Sep 17 00:00:00 2001 From: oppiliappan Date: Fri, 4 Sep 2026 12:17:33 +0100 Subject: [PATCH] localinfra: setup tranquil PDS on dev env Signed-off-by: oppiliappan --- docker-compose.yml | 43 ++++++++++++++++++++++++++++- localinfra/Caddyfile | 6 ++++ localinfra/bobbin.Dockerfile | 3 ++ localinfra/postgres-init.sql | 1 + localinfra/scripts/init-accounts.sh | 31 +++++++++++++++++++++ localinfra/tranquil.Dockerfile | 35 +++++++++++++++++++++++ 6 files changed, 118 insertions(+), 1 deletion(-) create mode 100644 localinfra/tranquil.Dockerfile diff --git a/docker-compose.yml b/docker-compose.yml index 8f2bc68fe..1b446dfe5 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -42,6 +42,40 @@ services: condition: service_started networks: [tngl] + tranquil: + build: + context: . + dockerfile: localinfra/tranquil.Dockerfile + restart: unless-stopped + environment: + PDS_HOSTNAME: tranquil.tngl.boltless.dev + DATABASE_URL: postgres://tnglr:tnglr@postgres:5432/tranquil + PLC_DIRECTORY_URL: http://plc:8080 + JWT_SECRET: ed7fb58467a19ac446743b9dafc89983face3a73f6ed2abe5fef29a12357c94d + DPOP_SECRET: bae499d35b7410afa1babc52020687281210a1bf2b8ee70e24c212fe136ce5ea + MASTER_KEY: f69f8047bb0418fff099092b380527a63885ca7ea16216b0f5894a040bc0fafa + TRANQUIL_PDS_ALLOW_INSECURE_SECRETS: "true" + INVITE_CODE_REQUIRED: "false" + ALLOW_HTTP_PROXY: "true" + ALLOW_PRIVATE_FETCH: "true" + DISABLE_RATE_LIMITING: "true" + # no comms service configured here, so accounts could never verify otherwise + DISABLE_ACCOUNT_VERIFICATION_GATE: "true" + volumes: + - tranquil-data:/var/lib/tranquil-pds + healthcheck: + test: ["CMD", "wget", "-qO-", "http://localhost:3000/xrpc/_health"] + interval: 2s + timeout: 2s + retries: 30 + start_period: 5s + depends_on: + plc: + condition: service_started + postgres: + condition: service_healthy + networks: [tngl] + init-accounts: build: context: localinfra @@ -53,6 +87,8 @@ services: OWNER_USER: alice KNOT_HOSTNAME: knot2.tngl.boltless.dev SPINDLE_HOSTNAME: spindle.tngl.boltless.dev + TRANQUIL_URL: http://tranquil:3000 + TRANQUIL_HOSTNAME: tranquil.tngl.boltless.dev volumes: - ./localinfra/scripts:/scripts:ro - init-state:/shared @@ -60,6 +96,8 @@ services: depends_on: pds: condition: service_healthy + tranquil: + condition: service_healthy networks: [tngl] init-data: @@ -491,7 +529,7 @@ services: environment: HYDRANT_API_BIND: 0.0.0.0:3000 HYDRANT_DATABASE_PATH: /data/hydrant.db - HYDRANT_RELAY_HOSTS: pds::wss://pds.tngl.boltless.dev + HYDRANT_RELAY_HOSTS: pds::wss://pds.tngl.boltless.dev,pds::wss://tranquil.tngl.boltless.dev HYDRANT_CRAWLER_URLS: list_repos::https://pds.tngl.boltless.dev HYDRANT_PLC_URL: https://plc.tngl.boltless.dev HYDRANT_FILTER_COLLECTIONS: sh.tangled.*,org.tangled.* @@ -679,6 +717,8 @@ services: - camo.tngl.boltless.dev - avatar.tngl.boltless.dev - deliberi.tngl.boltless.dev + - tranquil.tngl.boltless.dev + - troy.tranquil.tngl.boltless.dev prometheus: image: prom/prometheus:v2.54.1 @@ -760,6 +800,7 @@ volumes: hydrant-data: bobbin-cargo: bobbin-target: + tranquil-data: web-node-modules: web-svelte-kit: camo-node-modules: diff --git a/localinfra/Caddyfile b/localinfra/Caddyfile index 56ec092c2..9b62b564d 100644 --- a/localinfra/Caddyfile +++ b/localinfra/Caddyfile @@ -46,6 +46,12 @@ plc.tngl.boltless.dev { reverse_proxy pds:3000 } +# tranquil-pds (separate from the reference pds above) +*.tranquil.tngl.boltless.dev, tranquil.tngl.boltless.dev { + tls internal + reverse_proxy tranquil:3000 +} + # jetstream jetstream.tngl.boltless.dev { tls internal diff --git a/localinfra/bobbin.Dockerfile b/localinfra/bobbin.Dockerfile index fde109904..5875c87b9 100644 --- a/localinfra/bobbin.Dockerfile +++ b/localinfra/bobbin.Dockerfile @@ -6,6 +6,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ && rm -rf /var/lib/apt/lists/* ENV RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold" +# the workspace sets `lto = "fat"` for release builds; mold cannot link LTO +# bitcode (undefined `anon.*.llvm.*` symbols), so opt out for this dev image. +ENV CARGO_PROFILE_RELEASE_LTO=off ENV CARGO_HOME=/cargo ENV CARGO_TARGET_DIR=/target diff --git a/localinfra/postgres-init.sql b/localinfra/postgres-init.sql index a2ed41d91..bd6c0ed8c 100644 --- a/localinfra/postgres-init.sql +++ b/localinfra/postgres-init.sql @@ -1,3 +1,4 @@ CREATE DATABASE plc; CREATE DATABASE mirror; CREATE DATABASE mirror_tap; +CREATE DATABASE tranquil; diff --git a/localinfra/scripts/init-accounts.sh b/localinfra/scripts/init-accounts.sh index c6713f8ab..cadc49615 100644 --- a/localinfra/scripts/init-accounts.sh +++ b/localinfra/scripts/init-accounts.sh @@ -14,6 +14,7 @@ SYSTEM_USER="${SYSTEM_USER:-alice}" SHARED_DIR="${SHARED_DIR:-/shared}" VERIFIED_EMAILS_FILE="${SHARED_DIR}/verified-emails.jsonl" VERIFIED_EMAILS_TMP="${VERIFIED_EMAILS_FILE}.tmp" +TRANQUIL_PASSWORD="${TRANQUIL_PASSWORD:-Tangled-Dev9}" # --- helpers --- @@ -45,6 +46,31 @@ ensure_account() { printf '%s\n' "$did" } +# ensure_tranquil_account USERNAME → DID on stdout. same as ensure_account, +# but against tranquil's own URL/hostname, password, and no invite code. +ensure_tranquil_account() { + username="$1" + handle="${username}.${TRANQUIL_HOSTNAME}" + email="${username}@${TRANQUIL_HOSTNAME}" + + did=$(curl -fsS "${TRANQUIL_URL}/xrpc/com.atproto.identity.resolveHandle?handle=${handle}" \ + | jq -er '.did' 2>/dev/null) || did="" + if [ -n "$did" ]; then + printf '[skip] %s = %s\n' "$handle" "$did" >&2 + printf '%s\n' "$did" + return 0 + fi + + result=$(curl -fsS \ + -H "Content-Type: application/json" \ + -d "{\"email\":\"${email}\",\"handle\":\"${handle}\",\"password\":\"${TRANQUIL_PASSWORD}\"}" \ + "${TRANQUIL_URL}/xrpc/com.atproto.server.createAccount") + + did=$(printf '%s\n' "$result" | jq -er '.did') + printf '[create] %s = %s (password: %s)\n' "$handle" "$did" "$TRANQUIL_PASSWORD" >&2 + printf '%s\n' "$did" +} + # ensure accounts mkdir -p "$SHARED_DIR" : > "$VERIFIED_EMAILS_TMP" @@ -151,4 +177,9 @@ printf '[env] wrote label-defaults, label-gfi\n' >&2 put_record "at://$OWNER_DID/sh.tangled.knot/$KNOT_HOSTNAME" "{\"createdAt\": \"${CREATED_AT}\"}" >/dev/null put_record "at://$OWNER_DID/sh.tangled.spindle/$SPINDLE_HOSTNAME" "{\"createdAt\": \"${CREATED_AT}\"}" >/dev/null +# tranquil-pds: basic account for org/delegation testing +if [ -n "${TRANQUIL_URL:-}" ]; then + ensure_tranquil_account troy >/dev/null +fi + printf 'done.\n' >&2 diff --git a/localinfra/tranquil.Dockerfile b/localinfra/tranquil.Dockerfile new file mode 100644 index 000000000..c8a37ed89 --- /dev/null +++ b/localinfra/tranquil.Dockerfile @@ -0,0 +1,35 @@ +# syntax=docker/dockerfile:1 +# tranquil-pds isn't vendored here, so each stage fetches it via `ADD `. +# debian-slim final stage (not distroless) so `wget` works for the healthcheck. +ARG TRANQUIL_REF=main + +FROM node:24-trixie-slim AS frontend +ARG TRANQUIL_REF +RUN corepack enable && corepack prepare pnpm@latest --activate +ADD https://tangled.org/tranquil.farm/tranquil-pds.git#${TRANQUIL_REF} /app +WORKDIR /app/frontend +RUN pnpm install --frozen-lockfile +RUN pnpm build + +FROM rust:1.96-slim-trixie AS builder +ARG TRANQUIL_REF +RUN apt-get update && apt-get install -y --no-install-recommends \ + ca-certificates pkg-config libssl-dev mold clang protobuf-compiler \ + && rm -rf /var/lib/apt/lists/* +ENV RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold" +ADD https://tangled.org/tranquil.farm/tranquil-pds.git#${TRANQUIL_REF} /app +WORKDIR /app +RUN SQLX_OFFLINE=true cargo build -p tranquil-server + +FROM debian:trixie-slim +RUN apt-get update && apt-get install -y --no-install-recommends \ + ca-certificates wget \ + && rm -rf /var/lib/apt/lists/* +COPY --from=builder /app/target/debug/tranquil-server /usr/local/bin/tranquil-pds +COPY --from=frontend /app/frontend/dist /var/lib/tranquil-pds/frontend +RUN mkdir -p /var/lib/tranquil-pds/blobs /var/lib/tranquil-pds/store +WORKDIR /var/lib/tranquil-pds +ENV SERVER_HOST=[::] +ENV SERVER_PORT=3000 +EXPOSE 3000 +ENTRYPOINT ["/usr/local/bin/tranquil-pds"] -- 2.51.2