fix(infra): use SPIRE_DATA_PATH bind mounts and clean GHCR_REG without defaults

infra/setup.ts

@@ -13,6 +13,7 @@ export interface AuthSetupConfig {
   domainName: string;
   dbPassword: string;
   dbDataPath: string;
+  spireDataPath: string;
   appSecret: string;
 }
 
@@ -22,6 +23,7 @@ const DEFAULT_AUTH_CONFIG: AuthSetupConfig = {
   domainName: "auth.system.local",
   dbPassword: "",
   dbDataPath: "/volume1/docker/auth-yes/db",
+  spireDataPath: "/volume1/docker/auth-yes/spire",
   appSecret: "",
 };
 
@@ -39,6 +41,7 @@ export async function readEnv(): Promise<Partial<AuthSetupConfig>> {
       if (key === "SYSTEM_DOMAIN") config.domainName = val;
       if (key === "POSTGRES_PASSWORD") config.dbPassword = val;
       if (key === "DB_DATA_PATH") config.dbDataPath = val;
+      if (key === "SPIRE_DATA_PATH") config.spireDataPath = val;
       if (key === "APP_SECRET") config.appSecret = val;
     }
     return config;
@@ -69,6 +72,9 @@ POSTGRES_DB=authdb
 POSTGRES_PASSWORD=${config.dbPassword}
 DB_DATA_PATH=${config.dbDataPath}
 
+# --- SPIRE Configuration ---
+SPIRE_DATA_PATH=${config.spireDataPath || "/volume1/docker/auth-yes/spire"}
+
 # --- Valkey Configuration ---
 VALKEY_HOST=auth-valkey
 VALKEY_PORT=6379
@@ -140,18 +146,18 @@ export function generateSpireDockerCompose(): string {
 
 services:
   spire-server:
-    image: \${GHCR_REG:-ghcr.atyg.org}/spiffe/spire-server:1.9.3
+    image: \${GHCR_REG}/spiffe/spire-server:1.9.3
     container_name: spire-server
     hostname: spire-server
     networks:
       - auth-internal-net
     volumes:
       - spire-server-data:/opt/spire/data
-      - ./spire/server/conf/server.conf:/opt/spire/conf/server.conf:ro
+      - spire-server-conf:/opt/spire/conf:ro
     command: ["-config", "/opt/spire/conf/server.conf"]
 
   spire-agent:
-    image: \${GHCR_REG:-ghcr.atyg.org}/spiffe/spire-agent:1.9.3
+    image: \${GHCR_REG}/spiffe/spire-agent:1.9.3
     container_name: spire-agent
     hostname: spire-agent
     pid: host
@@ -160,7 +166,7 @@ services:
     volumes:
       - spire-socket:/var/run/spire
       - spire-agent-data:/opt/spire/data
-      - ./spire/agent/conf/agent.conf:/opt/spire/conf/agent.conf:ro
+      - spire-agent-conf:/opt/spire/conf:ro
       - /var/run/docker.sock:/var/run/docker.sock:ro
     command: ["-config", "/opt/spire/conf/agent.conf"]
     depends_on:
@@ -168,9 +174,29 @@ services:
 
 volumes:
   spire-server-data:
-    name: spire-server-data
+    driver: local
+    driver_opts:
+      type: none
+      device: \${SPIRE_DATA_PATH}/server/data
+      o: bind
+  spire-server-conf:
+    driver: local
+    driver_opts:
+      type: none
+      device: \${SPIRE_DATA_PATH}/server/conf
+      o: bind
   spire-agent-data:
-    name: spire-agent-data
+    driver: local
+    driver_opts:
+      type: none
+      device: \${SPIRE_DATA_PATH}/agent/data
+      o: bind
+  spire-agent-conf:
+    driver: local
+    driver_opts:
+      type: none
+      device: \${SPIRE_DATA_PATH}/agent/conf
+      o: bind
   spire-socket:
     name: spire-socket
 
@@ -313,6 +339,11 @@ export async function handleAuthSetup(
     default: currentConfig.dbDataPath,
   });
 
+  const spireDataPath = await Input.prompt({
+    message: "Enter the SPIRE Path on the Host:",
+    default: currentConfig.spireDataPath,
+  });
+
   const appSecret = await Secret.prompt({
     message: "Enter the App Secret for the IDP:",
     default: currentConfig.appSecret,
@@ -338,6 +369,7 @@ export async function handleAuthSetup(
     domainName,
     dbPassword,
     dbDataPath,
+    spireDataPath,
     appSecret,
   };
 
@@ -542,6 +574,7 @@ if (import.meta.main) {
     .option("--ghcr-registry <ghcrReg:string>", "GHCR Mirror Registry URL")
     .option("--domain <domain:string>", "Auth Domain Name")
     .option("--db-path <path:string>", "Database Path on the Host")
+    .option("--spire-path <path:string>", "SPIRE Path on the Host")
     .action(async (options) => {
       const loadedEnv = await readEnv();
       const currentConfig: AuthSetupConfig = {
@@ -586,6 +619,8 @@ if (import.meta.main) {
           domainName: options.domain,
           dbPassword,
           dbDataPath: options.dbPath,
+          spireDataPath: options.spirePath || currentConfig.spireDataPath ||
+            "/volume1/docker/auth-yes/spire",
           appSecret,
         };
         await generateAuthSetupFiles(newConfig);
@@ -594,6 +629,7 @@ if (import.meta.main) {
         if (options.ghcrRegistry) currentConfig.ghcrReg = options.ghcrRegistry;
         if (options.domain) currentConfig.domainName = options.domain;
         if (options.dbPath) currentConfig.dbDataPath = options.dbPath;
+        if (options.spirePath) currentConfig.spireDataPath = options.spirePath;
         await handleAuthSetup(currentConfig);
       }
     })