local-infra: local, sandboxed atmosphere infra #684

+3 -12

local-infra/Caddyfile

··· 6 name "LocalTangledCA" 7 } 8 } 0 9 } 10 11 plc.tngl.boltless.dev { ··· 35 reverse_proxy http://jetstream:6008 36 } 37 38 - knot.tngl.boltless.dev { 39 - tls { 40 - issuer internal { 41 - ca localtangled 42 - } 43 - } 44 reverse_proxy http://host.docker.internal:6000 45 } 46 47 - spindle.tngl.boltless.dev { 48 - tls { 49 - issuer internal { 50 - ca localtangled 51 - } 52 - } 53 reverse_proxy http://host.docker.internal:6555 54 }

··· 6 name "LocalTangledCA" 7 } 8 } 9 + auto_https disable_redirects 10 } 11 12 plc.tngl.boltless.dev { ··· 36 reverse_proxy http://jetstream:6008 37 } 38 39 + http://knot.tngl.boltless.dev { 0 0 0 0 0 40 reverse_proxy http://host.docker.internal:6000 41 } 42 43 + http://spindle.tngl.boltless.dev { 0 0 0 0 0 44 reverse_proxy http://host.docker.internal:6555 45 }

+8 -4

local-infra/docker-compose.yml

··· 14 - "443:443/udp" 15 volumes: 16 - ./Caddyfile:/etc/caddy/Caddyfile 0 17 - caddy_data:/data 18 - caddy_config:/config 19 ··· 23 platform: linux/amd64 24 container_name: plc 25 restart: unless-stopped 26 - ports: 27 - - "4000:8080" 28 depends_on: 29 - plc_db 30 environment: ··· 51 container_name: pds 52 image: ghcr.io/bluesky-social/pds:0.4 53 restart: unless-stopped 54 - ports: 55 - - "4001:3000" 56 volumes: 57 - pds:/pds 58 env_file: 59 - ./pds.env 60 0 0 0 0 0 0 0 61 jetstream: 62 container_name: jetstream 63 image: ghcr.io/bluesky-social/jetstream:sha-0ab10bd

··· 14 - "443:443/udp" 15 volumes: 16 - ./Caddyfile:/etc/caddy/Caddyfile 17 + - ./cert/localtangled:/data/pki/authorities/localtangled 18 - caddy_data:/data 19 - caddy_config:/config 20 ··· 24 platform: linux/amd64 25 container_name: plc 26 restart: unless-stopped 0 0 27 depends_on: 28 - plc_db 29 environment: ··· 50 container_name: pds 51 image: ghcr.io/bluesky-social/pds:0.4 52 restart: unless-stopped 0 0 53 volumes: 54 - pds:/pds 55 env_file: 56 - ./pds.env 57 58 + # I can change the knot-docker and spindle-docker images, 59 + # which means I can inject the cert to those containers 60 + # 61 + # so define *.tngl.boltless.dev as extra_hosts & inject certs to those two containers 62 + # extra_hosts: 63 + # plc.tngl.boltless.dev:host.docker.internal 64 + 65 jetstream: 66 container_name: jetstream 67 image: ghcr.io/bluesky-social/jetstream:sha-0ab10bd

+1 -1

local-infra/pds.env

··· 10 PDS_DATA_DIRECTORY=/pds 11 PDS_BLOBSTORE_DISK_LOCATION=/pds/blocks 12 13 - # PDS_DID_PLC_URL=http://plc:8080 14 PDS_HOSTNAME=pds.tngl.boltless.dev 15 16 # PDS_REPORT_SERVICE_DID=did:plc:ar7c4by46qjdydhdevvrndac

··· 10 PDS_DATA_DIRECTORY=/pds 11 PDS_BLOBSTORE_DISK_LOCATION=/pds/blocks 12 13 + PDS_DID_PLC_URL=http://plc:8080 14 PDS_HOSTNAME=pds.tngl.boltless.dev 15 16 # PDS_REPORT_SERVICE_DID=did:plc:ar7c4by46qjdydhdevvrndac

+1 -6

local-infra/readme.md

··· 3 docker compose up -d 4 ``` 5 6 - copy the self-signed certificate to host machine 7 - ``` 8 - docker cp caddy:/data/pki/authorities/localtangled/root.crt localtangled.crt 9 - ``` 10 - 11 trust the cert (macOS) 12 ``` 13 - sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ./localtangled.crt 14 ```

··· 3 docker compose up -d 4 ``` 5 0 0 0 0 0 6 trust the cert (macOS) 7 ``` 8 + sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ./local-infra/cert/localtangled/root.crt 9 ```

local-infra/scripts/create-test-account.sh

This file has not been changed.

+12

local-infra/cert/localtangled/intermediate.crt

··· 0 0 0 0 0 0 0 0 0 0 0 0

··· 1 + -----BEGIN CERTIFICATE----- 2 + MIIBuTCCAWCgAwIBAgIRALKb0dndMd7jlCHAzm0G+N4wCgYIKoZIzj0EAwIwKTEn 3 + MCUGA1UEAxMeTG9jYWxUYW5nbGVkQ0EgLSAyMDI1IEVDQyBSb290MB4XDTI1MTAy 4 + MTA3NDAwNloXDTI1MTAyODA3NDAwNlowLDEqMCgGA1UEAxMhTG9jYWxUYW5nbGVk 5 + Q0EgLSBFQ0MgSW50ZXJtZWRpYXRlMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE 6 + bX+zyr9rLxF3E8oCZwJluCKX/xmU4waabkjaTGbI5K0cemiAAmZRJ2lVhgh+KfXD 7 + PpTmt+YE6FUF4xAWADOUuaNmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQI 8 + MAYBAf8CAQAwHQYDVR0OBBYEFIoGsfx3Qg/9qG7tm7CZ1pHYl3prMB8GA1UdIwQY 9 + MBaAFCkl8dPP2IAMTPru6WEHLP1hySEQMAoGCCqGSM49BAMCA0cAMEQCIFc3gOEl 10 + aUR/OWbQuWvYwoTZs81ERj73ZeQWy4a3i4ooAiAB7Mnih/7kEvLyfkjLRgRXrtlq 11 + kVmXVyWHIncR6Bsktw== 12 + -----END CERTIFICATE-----

+5

local-infra/cert/localtangled/intermediate.key

··· 0 0 0 0 0

··· 1 + -----BEGIN EC PRIVATE KEY----- 2 + MHcCAQEEIB1EH4KZGLcfO0neWDuV3oWMXPEze8JTsyKFoQuYApFSoAoGCCqGSM49 3 + AwEHoUQDQgAEbX+zyr9rLxF3E8oCZwJluCKX/xmU4waabkjaTGbI5K0cemiAAmZR 4 + J2lVhgh+KfXDPpTmt+YE6FUF4xAWADOUuQ== 5 + -----END EC PRIVATE KEY-----

+11

local-infra/cert/localtangled/root.crt

··· 0 0 0 0 0 0 0 0 0 0 0

··· 1 + -----BEGIN CERTIFICATE----- 2 + MIIBlTCCATygAwIBAgIRAMDTcwNxYDMgtUNC5LkCeEQwCgYIKoZIzj0EAwIwKTEn 3 + MCUGA1UEAxMeTG9jYWxUYW5nbGVkQ0EgLSAyMDI1IEVDQyBSb290MB4XDTI1MTAx 4 + NzE2MTE0NVoXDTM1MDgyNjE2MTE0NVowKTEnMCUGA1UEAxMeTG9jYWxUYW5nbGVk 5 + Q0EgLSAyMDI1IEVDQyBSb290MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7rFM 6 + 4oNfT0UMqMuc3L60TCLeTd58WFSUYnKl7R1HOHDWeWZhhoNdWguXJSHhFPiWmQ5E 7 + +fiI7KvDAVQGHzfUAqNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB 8 + Af8CAQEwHQYDVR0OBBYEFCkl8dPP2IAMTPru6WEHLP1hySEQMAoGCCqGSM49BAMC 9 + A0cAMEQCIFjSGjvie1gO/JuNtP2HqeUHQNEh82K1fXdks54up3KEAiBWQDaOYeZ2 10 + zVTiKe8ZQHpH3glXsIS0USsxeKaohMp0zA== 11 + -----END CERTIFICATE-----

+5

local-infra/cert/localtangled/root.key

··· 0 0 0 0 0

··· 1 + -----BEGIN EC PRIVATE KEY----- 2 + MHcCAQEEIBqEj1iG3q+OLBgHjWQ3UkvKjq4sy5ej47syIYWn/Ql/oAoGCCqGSM49 3 + AwEHoUQDQgAE7rFM4oNfT0UMqMuc3L60TCLeTd58WFSUYnKl7R1HOHDWeWZhhoNd 4 + WguXJSHhFPiWmQ5E+fiI7KvDAVQGHzfUAg== 5 + -----END EC PRIVATE KEY-----

+5

nix/vm.nix

··· 77 }; 78 # This is fine because any and all ports that are forwarded to host are explicitly marked above, we don't need a separate guest firewall 79 networking.firewall.enable = false; 0 0 0 0 0 80 time.timeZone = "Europe/London"; 81 services.getty.autologinUser = "root"; 82 environment.systemPackages = with pkgs; [curl vim git sqlite litecli];

··· 77 }; 78 # This is fine because any and all ports that are forwarded to host are explicitly marked above, we don't need a separate guest firewall 79 networking.firewall.enable = false; 80 + services.dnsmasq.enable = true; 81 + services.dnsmasq.settings.address = "/tngl.boltless.dev/10.0.2.2"; 82 + security.pki.certificates = [ 83 + (builtins.readFile ../local-infra/cert/localtangled/root.crt) 84 + ]; 85 time.timeZone = "Europe/London"; 86 services.getty.autologinUser = "root"; 87 environment.systemPackages = with pkgs; [curl vim git sqlite litecli];