comparing cadb308693d84a4e1880b57c342fda51657d978d and spindle on keea.dog/knot-spindle

+1

.gitignore

···

       0

···

       1
       +
       .DS_Store

+33 -26

Dockerfile

···

       1
       -
       from golang:1.24-alpine as builder

     

       2
       -
       env KNOT_REPO_SCAN_PATH=/home/git/repositories

     

       3
       -
       env CGO_ENABLED=1

     

       4
        
       

     

       5
       -
       workdir /app

     

       6
       -
       run apk add git gcc musl-dev

     

       7
       -
       run git clone https://tangled.sh/@tangled.sh/core .

     

       8
       -
       run go build -o /usr/bin/knot -ldflags '-s -w -extldflags "-static"' ./cmd/knot

     

       9
        
       

     

       10
       -
       from alpine:edge

     

       11
       -
       expose 5555

     

       12
       -
       expose 22

     

       0
        
       
     

       13
        
       

     

       14
       -
       label org.opencontainers.image.title='knot'

     

       15
       -
       label org.opencontainers.image.description='data server for tangled'

     

       16
       -
       label org.opencontainers.image.source='https://tangled.sh/@tangled.sh/knot-docker'

     

       17
       -
       label org.opencontainers.image.url='https://tangled.sh'

     

       18
       -
       label org.opencontainers.image.vendor='tangled.sh'

     

       19
       -
       label org.opencontainers.image.licenses='MIT'

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       20
        
       

     

       21
       -
       copy rootfs .

     

       22
       -
       run chmod -R 755 /etc/s6-overlay

     

       23
       -
       run apk add shadow s6-overlay execline openssl openssh git curl

     

       24
       -
       run useradd -s /bin/nologin -d /home/git git && openssl rand -hex 16 | passwd --stdin git

     

       25
       -
       run mkdir -p /home/git/repositories && chown -R git:git /home/git/repositories

     

       26
       -
       copy --from=builder /usr/bin/knot /usr/bin

     

       27
       -
       run mkdir /app && chown -R git:git /app

     

       28
        
       

     

       29
       -
       healthcheck --interval=60s --timeout=30s --start-period=5s --retries=3 \

     

       30
       -
         cmd curl -f http://localhost:5555 || exit 1

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       31
        
       

     

       32
       -
       entrypoint ["/init"]

     

       0
        
       
     

       33
        
       

     

       0

···

       1
       +
       FROM golang:1.24-alpine AS builder

     

       2
       +
       ENV CGO_ENABLED=1

     

       0
        
       
     

       3
        
       

     

       4
       +
       ARG TAG='v1.10.0-alpha'

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       5
        
       

     

       6
       +
       WORKDIR /app

     

       7
       +
       RUN apk add git gcc musl-dev

     

       8
       +
       RUN git clone -b ${TAG} https://tangled.org/@tangled.org/core .

     

       9
       +
       RUN go build -o /usr/bin/spindle -ldflags '-s -w -extldflags "-static"' ./cmd/spindle

     

       10
        
       

     

       11
       +
       FROM alpine:edge

     

       12
       +
       

     

       13
       +
       ARG PORT=6555

     

       14
       +
       EXPOSE $PORT

     

       15
       +
       

     

       16
       +
       LABEL org.opencontainers.image.title='spindle'

     

       17
       +
       LABEL org.opencontainers.image.description='CI runner for tangled'

     

       18
       +
       LABEL org.opencontainers.image.source='https://tangled.org/@keea.dog/spindle-docker'

     

       19
       +
       LABEL org.opencontainers.image.url='https://tangled.org'

     

       20
       +
       LABEL org.opencontainers.image.vendor='tangled.org'

     

       21
       +
       LABEL org.opencontainers.image.licenses='MIT'

     

       22
        
       

     

       23
       +
       ARG UID=1000

     

       24
       +
       ARG GID=1000

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       25
        
       

     

       26
       +
       COPY rootfs .

     

       27
       +
       RUN chmod 755 /etc

     

       28
       +
       RUN chmod -R 755 /etc/s6-overlay

     

       29
       +
       RUN apk add shadow s6-overlay execline openssl curl

     

       30
       +
       RUN groupadd -g $GID -f spindle

     

       31
       +
       RUN useradd -u $UID -g $GID -d /home/spindle spindle

     

       32
       +
       RUN openssl rand -hex 16 | passwd --stdin spindle

     

       33
       +
       RUN mkdir -p /home/spindle/repositories && chown -R spindle:spindle /home/spindle

     

       34
       +
       COPY --from=builder /usr/bin/spindle /usr/bin

     

       35
       +
       RUN mkdir /app && chown -R spindle:spindle /app

     

       36
        
       

     

       37
       +
       HEALTHCHECK --interval=60s --timeout=30s --start-period=5s --retries=3 \

     

       38
       +
           CMD curl -f http://localhost:${PORT} || exit 1

     

       39
        
       

     

       40
       +
       ENTRYPOINT ["/init"]

+20 -17

docker-compose.yml

···

       1
        
       services:

     

       2
       -
         knot:

     

       3
       -
           build: .

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       4
        
           environment:

     

       5
       -
             KNOT_SERVER_HOSTNAME: ${KNOT_SERVER_HOSTNAME}

     

       6
       -
             KNOT_SERVER_SECRET: ${KNOT_SERVER_SECRET}

     

       7
       -
             KNOT_SERVER_DB_PATH: /app/knotserver.db

     

       8
       -
             KNOT_REPO_SCAN_PATH: /home/git/repositories

     

       9
       -
             KNOT_SERVER_INTERNAL_LISTEN_ADDR: localhost:5444

     

       0
        
       
     

       10
        
           volumes:

     

       11
       -
             - ./keys:/etc/ssh/keys

     

       12
       -
             - ./repositories:/home/git/repositories

     

       13
        
             - ./server:/app

     

       14
        
           ports:

     

       15
       -
             - 5555:5555

     

       16
       -
             - 2222:22

     

       17
        
           restart: always

     

       18
        
         frontend:

     

       19
        
           image: caddy:alpine

     

       20
        
           command: >

     

       21
        
             caddy

     

       22
        
             reverse-proxy

     

       23
       -
             --from ${KNOT_SERVER_HOSTNAME}

     

       24
       -
             --to knot:5555

     

       25
        
           depends_on:

     

       26
       -
             - knot

     

       27
        
           ports:

     

       28
       -
             - ${KNOT_SERVER_PORT:-443}:443

     

       29
       -
             - ${KNOT_SERVER_PORT:-443}:443/udp

     

       30
        
           volumes:

     

       31
       -
             - caddy_data:/data

     

       32
        
           restart: always

     

       33
        
           profiles: ["caddy"]

···

       1
        
       services:

     

       2
       +
         spindle:

     

       3
       +
           build:

     

       4
       +
             context: .

     

       5
       +
             args:

     

       6
       +
               UID: 1000

     

       7
       +
               GID: 1000

     

       8
       +
               PORT: ${INTERNAL_PORT:-6555}

     

       9
        
           environment:

     

       10
       +
             SPINDLE_SERVER_HOSTNAME: ${SPINDLE_SERVER_HOSTNAME}

     

       11
       +
             SPINDLE_SERVER_OWNER: ${SPINDLE_SERVER_OWNER}

     

       12
       +
             SPINDLE_SERVER_DB_PATH: /app/spindle.db

     

       13
       +
             SPINDLE_SERVER_LISTEN_ADDR: localhost:6555

     

       14
       +
             SPINDLE_PIPELINES_LOG_DIR: /var/log/spindle

     

       15
       +
             PORT: ${INTERNAL_PORT:-6555}

     

       16
        
           volumes:

     

       0
        
       
     

       0
        
       
     

       17
        
             - ./server:/app

     

       18
        
           ports:

     

       19
       +
             - "${INTERNAL_PORT:-6555}:${INTERNAL_PORT:-6555}"

     

       0
        
       
     

       20
        
           restart: always

     

       21
        
         frontend:

     

       22
        
           image: caddy:alpine

     

       23
        
           command: >

     

       24
        
             caddy

     

       25
        
             reverse-proxy

     

       26
       +
             --from ${SPINDLE_SERVER_HOSTNAME}

     

       27
       +
             --to spindle:6555

     

       28
        
           depends_on:

     

       29
       +
             - spindle

     

       30
        
           ports:

     

       31
       +
             - ${SPINDLE_SERVER_PORT:-443}:443

     

       32
       +
             - ${SPINDLE_SERVER_PORT:-443}:443/udp

     

       33
        
           volumes:

     

       34
       +
             - ./caddy_data:/data

     

       35
        
           restart: always

     

       36
        
           profiles: ["caddy"]

+22

license.txt

···

       1
       +
       MIT License

     

       2
       +
       

     

       3
       +
       Copyright (c) 2025 Tangled Team

     

       4
       +
       

     

       5
       +
       Permission is hereby granted, free of charge, to any person obtaining a copy

     

       6
       +
       of this software and associated documentation files (the "Software"), to deal

     

       7
       +
       in the Software without restriction, including without limitation the rights

     

       8
       +
       to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

     

       9
       +
       copies of the Software, and to permit persons to whom the Software is

     

       10
       +
       furnished to do so, subject to the following conditions:

     

       11
       +
       

     

       12
       +
       The above copyright notice and this permission notice shall be included in all

     

       13
       +
       copies or substantial portions of the Software.

     

       14
       +
       

     

       15
       +
       THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

     

       16
       +
       IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

     

       17
       +
       FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

     

       18
       +
       AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

     

       19
       +
       LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

     

       20
       +
       OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

     

       21
       +
       SOFTWARE.

     

       22
       +

+71 -3

readme.md

···

       1
       -
       # knot-docker

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2
        
       

     

       3
       -
       This is a community maintained Docker setup for hosting your own knot

     

       4
       -
       server.

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       1
       +
       # Knot Docker

     

       2
       +
       

     

       3
       +
       > **IMPORTANT**

     

       4
       +
       > This is a community maintained repository, support is not guaranteed.

     

       5
       +
       

     

       6
       +
       Docker container and compose setup to run a [Tangled](https://tangled.org) knot

     

       7
       +
       and host your own repository data.

     

       8
       +
       

     

       9
       +
       ## Pre-built Images

     

       10
       +
       

     

       11
       +
       There is a [repository](https://hub.docker.com/r/tngl/knot) of pre-built images

     

       12
       +
       for tags starting at `v1.8.0-alpha` if you prefer.

     

       13
       +
       

     

       14
       +
       ```

     

       15
       +
       docker pull tngl/knot:v1.10.0-alpha

     

       16
       +
       ```

     

       17
       +
       

     

       18
       +
       Note that these are *not* official images, you use them at your own risk.

     

       19
       +
       

     

       20
       +
       ## Building The Image

     

       21
       +
       

     

       22
       +
       By default the `Dockerfile` will build the latest tag, but you can change it

     

       23
       +
       with the `TAG` build argument.

     

       24
        
       

     

       25
       +
       ```sh

     

       26
       +
       docker build -t knot:latest --build-arg TAG=master .

     

       27
       +
       ```

     

       28
       +
       

     

       29
       +
       The command above for example will build the latest commit on the `master`

     

       30
       +
       branch.

     

       31
       +
       

     

       32
       +
       By default it will also create a `git` user with user and group ID 1000:1000,

     

       33
       +
       but you can change it with the `UID` and `GID` build arguments.

     

       34
       +
       

     

       35
       +
       ```sh

     

       36
       +
       docker build -t knot:latest --build-arg UID=$(id -u) GID=$(id -g)

     

       37
       +
       ```

     

       38
       +
       

     

       39
       +
       The command above for example will create a user with the host user's UID and GID.

     

       40
       +
       This is useful if you are bind mounting the repositories and app folder on the host,

     

       41
       +
       as in the provided `docker-compose.yml` file.

     

       42
       +
       

     

       43
       +
       <hr style="margin-bottom: 20px; margin-top: 10px" />

     

       44
       +
       

     

       45
       +
       When using compose, these can be specified as build arguments which will be

     

       46
       +
       passed to the builder.

     

       47
       +
       

     

       48
       +
       ```yaml

     

       49
       +
       build:

     

       50
       +
         context: .

     

       51
       +
         args:

     

       52
       +
           TAG: master

     

       53
       +
           UID: 1000

     

       54
       +
           GID: 1000

     

       55
       +
       ```

     

       56
       +
       

     

       57
       +
       This will for example tell docker to build it using the `master` branch like

     

       58
       +
       the command.

     

       59
       +
       

     

       60
       +
       ## Setting Up The Image

     

       61
       +
       

     

       62
       +
       The simplest way to set up your own knot is to use the provided compose file

     

       63
       +
       and run the following:

     

       64
       +
       

     

       65
       +
       ```sh

     

       66
       +
       export KNOT_SERVER_HOSTNAME=example.com

     

       67
       +
       export KNOT_SERVER_OWNER=did:plc:yourdidgoeshere

     

       68
       +
       export KNOT_SERVER_PORT=443

     

       69
       +
       docker compose up -d

     

       70
       +
       ```

     

       71
       +
       

     

       72
       +
       This will setup everything for you including a reverse proxy.

-1

rootfs/etc/s6-overlay/s6-rc.d/create-sshd-host-keys/type

···

       1
       -
       oneshot

···

       0

-1

rootfs/etc/s6-overlay/s6-rc.d/create-sshd-host-keys/up

···

       1
       -
       /etc/s6-overlay/scripts/create-sshd-host-keys

···

       0

rootfs/etc/s6-overlay/s6-rc.d/knotserver/dependencies.d/base

This is a binary file and will not be displayed.

-3

rootfs/etc/s6-overlay/s6-rc.d/knotserver/run

···

       1
       -
       #!/command/with-contenv ash

     

       2
       -
       

     

       3
       -
       exec s6-setuidgid git /usr/bin/knot server

-1

rootfs/etc/s6-overlay/s6-rc.d/knotserver/type

···

       1
       -
       longrun

···

       0

rootfs/etc/s6-overlay/s6-rc.d/spindleserver/dependencies.d/base

This is a binary file and will not be displayed.

+3

rootfs/etc/s6-overlay/s6-rc.d/spindleserver/run

···

       1
       +
       #!/command/with-contenv ash

     

       2
       +
       

     

       3
       +
       exec s6-setuidgid spindle /usr/bin/spindle server

+1

rootfs/etc/s6-overlay/s6-rc.d/spindleserver/type

···

       0

···

       1
       +
       longrun

rootfs/etc/s6-overlay/s6-rc.d/sshd/dependencies.d/base

This is a binary file and will not be displayed.

rootfs/etc/s6-overlay/s6-rc.d/sshd/dependencies.d/create-sshd-host-keys

This is a binary file and will not be displayed.

-3

rootfs/etc/s6-overlay/s6-rc.d/sshd/run

···

       1
       -
       #!/usr/bin/execlineb -P

     

       2
       -
       

     

       3
       -
       /usr/sbin/sshd -e -D

-1

rootfs/etc/s6-overlay/s6-rc.d/sshd/type

···

       1
       -
       longrun

···

       0

rootfs/etc/s6-overlay/s6-rc.d/user/contents.d/knotserver

This is a binary file and will not be displayed.

rootfs/etc/s6-overlay/s6-rc.d/user/contents.d/spindleserver

This is a binary file and will not be displayed.

rootfs/etc/s6-overlay/s6-rc.d/user/contents.d/sshd

This is a binary file and will not be displayed.

-21

rootfs/etc/s6-overlay/scripts/create-sshd-host-keys

···

       1
       -
       #!/usr/bin/execlineb -P

     

       2
       -
       

     

       3
       -
       foreground {

     

       4
       -
         if -n { test -d /etc/ssh/keys }

     

       5
       -
         mkdir /etc/ssh/keys

     

       6
       -
       }

     

       7
       -
       

     

       8
       -
       foreground {

     

       9
       -
         if -n { test -f /etc/ssh/keys/ssh_host_rsa_key }

     

       10
       -
         ssh-keygen -t rsa -f /etc/ssh/keys/ssh_host_rsa_key -q -N ""

     

       11
       -
       }

     

       12
       -
       

     

       13
       -
       foreground {

     

       14
       -
         if -n { test -f /etc/ssh/keys/ssh_host_ecdsa_key }

     

       15
       -
         ssh-keygen -t rsa -f /etc/ssh/keys/ssh_host_ecdsa_key -q -N ""

     

       16
       -
       }

     

       17
       -
       

     

       18
       -
       foreground {

     

       19
       -
         if -n { test -f /etc/ssh/keys/ssh_host_ed25519_key }

     

       20
       -
         ssh-keygen -t rsa -f /etc/ssh/keys/ssh_host_ed25519_key -q -N ""

     

       21
       -
       }

-8

rootfs/etc/s6-overlay/scripts/keys-wrapper

···

       1
       -
       #!/bin/sh

     

       2
       -
       

     

       3
       -
       # Execute the knot keys command with proper shell context

     

       4
       -
       exec /bin/sh -c '/usr/bin/knot keys -output authorized-keys \

     

       5
       -
           -internal-api "http://${KNOT_SERVER_INTERNAL_LISTEN_ADDR:-localhost:5444}" \

     

       6
       -
           -git-dir "${KNOT_REPO_SCAN_PATH:-/home/git/repositories}" \

     

       7
       -
           -log-path "/tmp/knotguard.log"'

     

       8
       -

-9

rootfs/etc/ssh/sshd_config.d/tangled_sshd.conf

···

       1
       -
       HostKey /etc/ssh/keys/ssh_host_rsa_key

     

       2
       -
       HostKey /etc/ssh/keys/ssh_host_ecdsa_key

     

       3
       -
       HostKey /etc/ssh/keys/ssh_host_ed25519_key

     

       4
       -
       

     

       5
       -
       PasswordAuthentication no

     

       6
       -
       

     

       7
       -
       Match User git

     

       8
       -
         AuthorizedKeysCommand /etc/s6-overlay/scripts/keys-wrapper

     

       9
       -
         AuthorizedKeysCommandUser nobody

Compare changes