From 778c66a871e87af79a9d5d5519d13d30712ceab5 Mon Sep 17 00:00:00 2001
From: Seongmin Lee <git@boltless.me>
Date: Mon, 11 May 2026 08:49:17 +0000
Subject: [PATCH] wip: contrib: add knotmirror

Signed-off-by: Seongmin Lee <git@boltless.me>
---
 contrib/Caddyfile | 5 +++++
 contrib/knotmirror.Dockerfile | 20 ++++++++++++++++++++
 docker-compose.yml | 75 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 3 file(s) changed, 98 insertion(s)(+), 2 deletion(s)(-)

diff --git a/contrib/Caddyfile b/contrib/Caddyfile
--- a/contrib/Caddyfile
+++ b/contrib/Caddyfile
@@ -39,5 +39,10 @@ tls internal
     reverse_proxy knot:5555
 }
 
+mirror.tngl.boltless.dev {
+    tls internal
+    reverse_proxy knotmirror:7000
+}
+
 # future services (uncomment as added):
 # spindle.tngl.boltless.dev    { tls internal; reverse_proxy spindle:6555 }
diff --git a/contrib/knotmirror.Dockerfile b/contrib/knotmirror.Dockerfile
new file mode 100644
--- /dev/null
+++ b/contrib/knotmirror.Dockerfile
@@ -0,0 +1,20 @@
+FROM golang:1.25-alpine AS build
+
+RUN apk add --no-cache git
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -o /knotmirror ./cmd/knotmirror
+
+FROM alpine:3.22
+
+RUN apk add --no-cache git tini ca-certificates
+
+COPY --from=build /knotmirror /usr/local/bin/knotmirror
+
+EXPOSE 7000
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["/usr/local/bin/knotmirror", "serve"]
diff --git a/docker-compose.yml b/docker-compose.yml
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -49,6 +49,8 @@ postgres:
         condition: service_healthy
       plc:
         condition: service_started
+      relay:
+        condition: service_healthy
     networks: [tngl]
 
   init-accounts:
@@ -106,7 +108,13 @@ RELAY_ALLOW_INSECURE_HOSTS: "1"
     volumes:
       - relay-data:/var/lib/relay
       - ./contrib/certs/root.crt:/etc/ssl/certs/caddy.crt:ro
-    depends_on: [pds, plc]
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:2470/xrpc/_health"]
+      interval: 2s
+      timeout: 2s
+      retries: 30
+      start_period: 5s
+    depends_on: [plc]
     networks: [tngl]
 
   # No published image with arm64; build from source via git context.
@@ -141,7 +149,7 @@ KNOT_SERVER_JETSTREAM_ENDPOINT: wss://jetstream.tngl.boltless.dev/subscribe
       KNOT_SERVER_DEV: "false"
       KNOT_REPO_SCAN_PATH: /home/git/repositories
       APPVIEW_ENDPOINT: https://tangled.org
-      KNOT_MIRRORS: ""
+      KNOT_MIRRORS: https://mirror.tngl.boltless.dev
     ports:
       - "2222:22"
     volumes:
@@ -162,10 +170,71 @@ plc:
         condition: service_started
       jetstream:
         condition: service_started
+      knotmirror:
+        condition: service_healthy
       init-accounts:
         condition: service_completed_successfully
     networks: [tngl]
 
+  knotmirror-tap:
+    build:
+      context: https://github.com/bluesky-social/indigo.git#cbaa83aee9dd4aa015fd0c245e1fb3cfbbe32817
+      dockerfile: cmd/tap/Dockerfile
+      args:
+        BUILDKIT_CONTEXT_KEEP_GIT_DIR: "1"
+    restart: unless-stopped
+    environment:
+      TAP_BIND: ":2480"
+      TAP_PLC_URL: https://plc.tngl.boltless.dev
+      TAP_RELAY_URL: https://relay.tngl.boltless.dev
+      TAP_DATABASE_URL: postgres://tnglr:tnglr@postgres:5432/tap?sslmode=disable
+      TAP_COLLECTION_FILTERS: sh.tangled.repo
+      TAP_SIGNAL_COLLECTION: sh.tangled.repo
+      TAP_RESYNC_PARALLELISM: "10"
+      TAP_RETRY_TIMEOUT: 60s
+    volumes:
+      - ./contrib/certs/root.crt:/etc/ssl/certs/caddy.crt:ro
+    depends_on:
+      postgres:
+        condition: service_healthy
+      relay:
+        condition: service_started
+    networks: [tngl]
+
+  knotmirror:
+    build:
+      context: .
+      dockerfile: contrib/knotmirror.Dockerfile
+    restart: unless-stopped
+    environment:
+      MIRROR_LISTEN: 0.0.0.0:7000
+      MIRROR_ADMIN_LISTEN: 0.0.0.0:7200
+      MIRROR_HOSTNAME: mirror.tngl.boltless.dev
+      MIRROR_TAP_URL: http://knotmirror-tap:2480
+      MIRROR_DB_URL: postgres://tnglr:tnglr@postgres:5432/mirror?sslmode=disable
+      MIRROR_PLC_URL: https://plc.tngl.boltless.dev
+      MIRROR_GIT_BASEPATH: /data/repos
+      MIRROR_KNOT_USE_SSL: "true"
+      MIRROR_KNOT_SSRF: "false"
+      MIRROR_RESYNC_PARALLELISM: "4"
+    volumes:
+      - knotmirror-data:/data
+      - ./contrib/certs/root.crt:/etc/ssl/certs/caddy.crt:ro
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:7000/"]
+      interval: 2s
+      timeout: 2s
+      retries: 30
+      start_period: 5s
+    ports:
+      - "7201:7200"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      knotmirror-tap:
+        condition: service_started
+    networks: [tngl]
+
   caddy:
     image: caddy:2-alpine
     restart: unless-stopped
@@ -187,6 +256,7 @@ - relay.tngl.boltless.dev
           - jetstream.tngl.boltless.dev
           - knot.tngl.boltless.dev
           - spindle.tngl.boltless.dev
+          - mirror.tngl.boltless.dev
           - plc.tngl.boltless.dev
 
 volumes:
@@ -196,6 +266,7 @@ pds-data:
   relay-data:
   jetstream-data:
   knot-data:
+  knotmirror-data:
   init-state:
   go-cache:
   go-mod-cache:

--
tangled.sh