From e179ecd419f1bde85b7f8276a989e72c29baa5c8 Mon Sep 17 00:00:00 2001 From: Tyler Gillispie Date: Sat, 22 Aug 2026 11:10:22 -0700 Subject: [PATCH] feat(setup): configure GHCR_REG defaulting to ghcr.atyg.org for SPIRE compose --- deno.json | 3 +++ deno.lock | 50 +++++++++++++++++++++++++++++++++++++++++ infra/setup.ts | 20 ++++++++++++++--- sdk/gen/auth_connect.ts | 4 ++-- sdk/gen/auth_pb.ts | 6 ++--- 5 files changed, 75 insertions(+), 8 deletions(-) diff --git a/deno.json b/deno.json index 35e2505..36d1d47 100644 --- a/deno.json +++ b/deno.json @@ -13,6 +13,9 @@ "setup": "deno run -A infra/setup.ts" }, "lint": { + "exclude": [ + "sdk/gen" + ], "rules": { "exclude": [ "no-empty", diff --git a/deno.lock b/deno.lock index e74382c..fc0a520 100644 --- a/deno.lock +++ b/deno.lock @@ -24,6 +24,7 @@ "jsr:@std/path@~1.0.6": "1.0.9", "jsr:@std/testing@*": "1.0.20", "jsr:@std/text@~1.0.7": "1.0.19", + "npm:@bufbuild/buf@*": "1.72.0", "npm:@bufbuild/protobuf@^1.10.0": "1.10.1", "npm:@connectrpc/connect-node@^1.4.0": "1.7.0_@bufbuild+protobuf@1.10.1_@connectrpc+connect@1.7.0__@bufbuild+protobuf@1.10.1", "npm:@connectrpc/connect@^1.4.0": "1.7.0_@bufbuild+protobuf@1.10.1", @@ -151,6 +152,55 @@ } }, "npm": { + "@bufbuild/buf-darwin-arm64@1.72.0": { + "integrity": "sha512-rKHRvjwAThapxIoOn92vIoTjYSz5FmRemDRLU4BYT4T6QWMEC13PM3/pPnqVgsNKZ5aW7iYDm9ztnisEqSi5yA==", + "os": ["darwin"], + "cpu": ["arm64"] + }, + "@bufbuild/buf-darwin-x64@1.72.0": { + "integrity": "sha512-4TQ1AGft8sGspNg9NMsEjsKKis7nGaVV8tZLnNa3cKUBmx22gwOnB6VRhgKWwjf+BDqr85lUEzQ6wHCboNUutg==", + "os": ["darwin"], + "cpu": ["x64"] + }, + "@bufbuild/buf-linux-aarch64@1.72.0": { + "integrity": "sha512-cbIsUcgM5bHhbZWcDaAXqaYOAi8N0c0u+NiDydwVmZ04Et3s1EZ3TDqfQDRzwvoBPDP+lsO6YuTRXX6nI28x4w==", + "os": ["linux"], + "cpu": ["arm64"] + }, + "@bufbuild/buf-linux-armv7@1.72.0": { + "integrity": "sha512-v/bXVsFL8YNm2HgosGb9r3+nAt4jQiUc3r3JipYuiVY3DAJZAjoEvcak6/BkxQMTEQz9Zb8gRRlule9IFkbc5g==", + "os": ["linux"], + "cpu": ["arm"] + }, + "@bufbuild/buf-linux-x64@1.72.0": { + "integrity": "sha512-4xHGXEjqFxo1wX1zMGq4CzhYt5++nrj4C7k30j+YmGtvqCnipfdSe+V6kknBYRfYswVZEUwUbQOh6pnMTcGcrA==", + "os": ["linux"], + "cpu": ["x64"] + }, + "@bufbuild/buf-win32-arm64@1.72.0": { + "integrity": "sha512-WH7ClsoB9A0e/5fFhx0DLqLzillYPRdHBhlwzihgvjGci0bBdyJVHSQGf0B9uspCMU6sn6W/N1S9/2vvQBNMug==", + "os": ["win32"], + "cpu": ["arm64"] + }, + "@bufbuild/buf-win32-x64@1.72.0": { + "integrity": "sha512-X3eWqFzhDmu8CYQZz+Fu7i+PgH+yUl8UwJ5+x+bhZRYAIdcijikthodk60c5u/qq42m1Z2XAnAGyp/mTf7IffA==", + "os": ["win32"], + "cpu": ["x64"] + }, + "@bufbuild/buf@1.72.0": { + "integrity": "sha512-BwBKTX/WXkhAhqWJGrEKnqU03/4tK1O0OozSlwUMBCOEo8pLL3xu3M24RT3+umExEeM0wjlANO6axqGWMqtt4Q==", + "optionalDependencies": [ + "@bufbuild/buf-darwin-arm64", + "@bufbuild/buf-darwin-x64", + "@bufbuild/buf-linux-aarch64", + "@bufbuild/buf-linux-armv7", + "@bufbuild/buf-linux-x64", + "@bufbuild/buf-win32-arm64", + "@bufbuild/buf-win32-x64" + ], + "scripts": true, + "bin": true + }, "@bufbuild/protobuf@1.10.1": { "integrity": "sha512-wJ8ReQbHxsAfXhrf9ixl0aYbZorRuOWpBNzm8pL8ftmSxQx/wnJD5Eg861NwJU/czy2VXFIebCeZnZrI9rktIQ==" }, diff --git a/infra/setup.ts b/infra/setup.ts index 05542c5..ca2f19d 100644 --- a/infra/setup.ts +++ b/infra/setup.ts @@ -9,6 +9,7 @@ const SPIRE_COMPOSE_PATH = path.join("infra", "compose.spire.yml"); export interface AuthSetupConfig { reg: string; + ghcrReg: string; domainName: string; dbPassword: string; dbDataPath: string; @@ -17,6 +18,7 @@ export interface AuthSetupConfig { const DEFAULT_AUTH_CONFIG: AuthSetupConfig = { reg: "quay.atyg.org", + ghcrReg: "ghcr.atyg.org", domainName: "auth.system.local", dbPassword: "", dbDataPath: "/volume1/docker/auth-yes/db", @@ -33,6 +35,7 @@ export async function readEnv(): Promise> { const [key, ...rest] = trimmed.split("="); const val = rest.join("=").trim(); if (key === "REG") config.reg = val; + if (key === "GHCR_REG") config.ghcrReg = val; if (key === "SYSTEM_DOMAIN") config.domainName = val; if (key === "POSTGRES_PASSWORD") config.dbPassword = val; if (key === "DB_DATA_PATH") config.dbDataPath = val; @@ -48,6 +51,7 @@ export async function readEnv(): Promise> { export function generateEnv(config: AuthSetupConfig): string { return `# --- Container Registry --- REG=${config.reg} +GHCR_REG=${config.ghcrReg || "ghcr.atyg.org"} # --- Network & Routing --- SYSTEM_DOMAIN=${config.domainName} @@ -136,7 +140,7 @@ export function generateSpireDockerCompose(): string { services: spire-server: - image: gcr.io/spiffe-io/spire-server:1.9.3 + image: \${GHCR_REG:-ghcr.atyg.org}/spiffe/spire-server:1.9.3 container_name: spire-server hostname: spire-server networks: @@ -147,7 +151,7 @@ services: command: ["-config", "/opt/spire/conf/server.conf"] spire-agent: - image: gcr.io/spiffe-io/spire-agent:1.9.3 + image: \${GHCR_REG:-ghcr.atyg.org}/spiffe/spire-agent:1.9.3 container_name: spire-agent hostname: spire-agent pid: host @@ -276,10 +280,15 @@ export async function handleAuthSetup( ); const reg = await Input.prompt({ - message: "Enter the Container Registry URL:", + message: "Enter the Primary Container Registry URL:", default: currentConfig.reg, }); + const ghcrReg = await Input.prompt({ + message: "Enter the GHCR Mirror Registry URL (for SPIRE):", + default: currentConfig.ghcrReg || "ghcr.atyg.org", + }); + const domainName = await Input.prompt({ message: "Enter the Auth Domain Name:", hint: "E.g., auth.system.local", @@ -312,6 +321,7 @@ export async function handleAuthSetup( const newConfig: AuthSetupConfig = { reg, + ghcrReg, domainName, dbPassword, dbDataPath, @@ -516,6 +526,7 @@ if (import.meta.main) { .command("auth", "Configure Auth Yes API") .option("--auto, --headless", "Run in headless mode") .option("--registry ", "Container Registry URL") + .option("--ghcr-registry ", "GHCR Mirror Registry URL") .option("--domain ", "Auth Domain Name") .option("--db-path ", "Database Path on the Host") .action(async (options) => { @@ -557,6 +568,8 @@ if (import.meta.main) { const newConfig: AuthSetupConfig = { reg: options.registry, + ghcrReg: options.ghcrRegistry || currentConfig.ghcrReg || + "ghcr.atyg.org", domainName: options.domain, dbPassword, dbDataPath: options.dbPath, @@ -565,6 +578,7 @@ if (import.meta.main) { await generateAuthSetupFiles(newConfig); } else { if (options.registry) currentConfig.reg = options.registry; + if (options.ghcrRegistry) currentConfig.ghcrReg = options.ghcrRegistry; if (options.domain) currentConfig.domainName = options.domain; if (options.dbPath) currentConfig.dbDataPath = options.dbPath; await handleAuthSetup(currentConfig); diff --git a/sdk/gen/auth_connect.ts b/sdk/gen/auth_connect.ts index fb33026..22d15cb 100644 --- a/sdk/gen/auth_connect.ts +++ b/sdk/gen/auth_connect.ts @@ -1,10 +1,10 @@ // @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts,import_extension=.ts" // @generated from file auth.proto (package auth.v1, syntax proto3) /* eslint-disable */ -// @ts-nocheck: Generated protobuf connect code +// @ts-nocheck import { ValidateSessionRequest, ValidateSessionResponse } from "./auth_pb.ts"; -import { MethodKind } from "npm:@bufbuild/protobuf@^1.10.0"; +import { MethodKind } from "@bufbuild/protobuf"; /** * @generated from service auth.v1.AuthService diff --git a/sdk/gen/auth_pb.ts b/sdk/gen/auth_pb.ts index bfaabfa..530bc2b 100644 --- a/sdk/gen/auth_pb.ts +++ b/sdk/gen/auth_pb.ts @@ -1,7 +1,7 @@ // @generated by protoc-gen-es v1.10.0 with parameter "target=ts,import_extension=.ts" // @generated from file auth.proto (package auth.v1, syntax proto3) /* eslint-disable */ -// @ts-nocheck: Generated protobuf schema code +// @ts-nocheck import type { BinaryReadOptions, @@ -10,8 +10,8 @@ import type { JsonValue, PartialMessage, PlainMessage, -} from "npm:@bufbuild/protobuf@^1.10.0"; -import { Message, proto3 } from "npm:@bufbuild/protobuf@^1.10.0"; +} from "@bufbuild/protobuf"; +import { Message, proto3 } from "@bufbuild/protobuf"; /** * @generated from message auth.v1.ValidateSessionRequest