ctao/portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

deploy: join gitea netns instead of bridge (machine kernel lacks ip_tables for rootless netavark); pin image digests; push-to-create repo

Browse Source
This commit is contained in:
ctao
2026-07-28 14:07:44 +02:00
parent ed7a9c01e7
commit 80d886c0cb
6 changed files with 28 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/README.md
+5 -5
View File
@@ -24,7 +24,7 @@ Uninstall restores the machine exactly (see bottom). No secrets in any file.
1. **[W]** `mkdir -p ~/ctao-portal-demo/{gitea-data,gitea-config,releases,state,bin,config} ~/.config/containers/systemd ~/.config/systemd/user`
2. **[W]** Copy files from this dir (scp from the Mac):
- `ctao-demo-gitea.container`, `ctao-demo-web.container`, `ctao-demo.network` → `~/.config/containers/systemd/`
- `ctao-demo-gitea.container`, `ctao-demo-web.container` → `~/.config/containers/systemd/`
- `ctao-portal-build.service`, `ctao-portal-build.timer` → `~/.config/systemd/user/`
- `build.sh` → `~/ctao-portal-demo/bin/` (`chmod +x`)
- `nginx.conf` → `~/ctao-portal-demo/config/`
@@ -72,10 +72,8 @@ Uninstall restores the machine exactly (see bottom). No secrets in any file.
systemctl --user disable --now ctao-portal-build.timer
systemctl --user stop ctao-demo-web ctao-demo-gitea
rm ~/.config/containers/systemd/ctao-demo-*.container \
~/.config/containers/systemd/ctao-demo.network \
~/.config/systemd/user/ctao-portal-build.{service,timer}
systemctl --user daemon-reload
podman network rm ctao-demo 2>/dev/null || true
podman rmi localhost/ctao-portal-build:1 docker.io/gitea/gitea:1.27-rootless docker.io/library/nginx:stable-alpine
rm -rf ~/ctao-portal-demo
```
@@ -90,7 +88,9 @@ rm -rf ~/ctao-portal-demo
the build container is capped at 1 GB via `podman run --memory`. Watch the
first `npm ci` + build in the journal — if it OOMs inside its cgroup
(contained, just retries), raise the cap.
- Build isolation: build containers run on the `ctao-demo` bridge (see
`ctao-demo.network`) — repo/npm code cannot reach host loopback services.
- Build isolation: build containers join the Gitea container's network
namespace (`--network=container:ctao-demo-gitea`) — repo/npm code sees
Gitea on localhost:3000 but cannot reach host loopback services. (Rootless
netavark bridges don't work here: no `ip_tables` kernel module, no sudo.)
- Secrets inventory: Gitea admin password (typed interactively, lives only
in Gitea's DB) — that's the complete list. Build/poll/serve use none.