ziran-pds — self-hosted spaces-alpha PDS #

A supramundane service wrapping ghcr.io/bluesky-social/atproto:pds-spaces-alpha (the reference PDS built from the permissioned-data branch — same env contract as the standard PDS distribution). Purpose: durable test accounts for the Spaces sync layer (docs/SYNC-SPACES.md) and real cross-PDS testing against the hosted alpha at spaces-alpha.bsky.network. Alpha software: no backups, schema may change destructively, the data volume is disposable.

One-time setup #

1. DNS (Robin): pds.ziran.space A → the sm host, plus wildcard *.pds.ziran.space A → same host (account handles are subdomains).

2. TLS for handle subdomains: the Caddy front answers for arbitrary <handle>.pds.ziran.space hosts via the wildcards field in service.json — sm generates a second site block with tls { on_demand } (per-subdomain certs minted as SNI arrives, approved by the front's global on_demand_tls ask endpoint, which is already wired in the stock front Caddyfile).

3. Secrets — on the server, create .env next to the deployed compose (never committed):

   cat > .env <<EOF
   PDS_JWT_SECRET=$(openssl rand --hex 16)
   PDS_ADMIN_PASSWORD=$(openssl rand --hex 16)
   PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32)
   EOF
   

4. Deploy with sm as usual (rsyncs this dir, docker compose up --build, drops the Caddy snippet on the front).

Accounts #

Invite codes via the admin API (no pdsadmin needed):

curl -s -X POST https://pds.ziran.space/xrpc/com.atproto.server.createInviteCode \
  -u "admin:$PDS_ADMIN_PASSWORD" -H 'content-type: application/json' \
  -d '{"useCount": 1}'

Then com.atproto.server.createAccount with {email, handle, password, inviteCode} — handles look like alice.pds.ziran.space. Password sessions (com.atproto.server.createSession) are enough for all space endpoints (verified: they take AuthScope.Access), so test accounts need no OAuth.

Health #

curl https://pds.ziran.space/xrpc/_health → {"version": ...}. Logs: ssh root@$SUPRAMUNDANE docker logs ziran-pds.