feat(setup): configure GHCR_REG defaulting to ghcr.atyg.org for SPIRE compose

deno.json

@@ -13,6 +13,9 @@
     "setup": "deno run -A infra/setup.ts"
   },
   "lint": {
+    "exclude": [
+      "sdk/gen"
+    ],
     "rules": {
       "exclude": [
         "no-empty",

deno.lock

@@ -24,6 +24,7 @@
     "jsr:@std/path@~1.0.6": "1.0.9",
     "jsr:@std/testing@*": "1.0.20",
     "jsr:@std/text@~1.0.7": "1.0.19",
+    "npm:@bufbuild/buf@*": "1.72.0",
     "npm:@bufbuild/protobuf@^1.10.0": "1.10.1",
     "npm:@connectrpc/connect-node@^1.4.0": "1.7.0_@bufbuild+protobuf@1.10.1_@connectrpc+connect@1.7.0__@bufbuild+protobuf@1.10.1",
     "npm:@connectrpc/connect@^1.4.0": "1.7.0_@bufbuild+protobuf@1.10.1",
@@ -151,6 +152,55 @@
     }
   },
   "npm": {
+    "@bufbuild/buf-darwin-arm64@1.72.0": {
+      "integrity": "sha512-rKHRvjwAThapxIoOn92vIoTjYSz5FmRemDRLU4BYT4T6QWMEC13PM3/pPnqVgsNKZ5aW7iYDm9ztnisEqSi5yA==",
+      "os": ["darwin"],
+      "cpu": ["arm64"]
+    },
+    "@bufbuild/buf-darwin-x64@1.72.0": {
+      "integrity": "sha512-4TQ1AGft8sGspNg9NMsEjsKKis7nGaVV8tZLnNa3cKUBmx22gwOnB6VRhgKWwjf+BDqr85lUEzQ6wHCboNUutg==",
+      "os": ["darwin"],
+      "cpu": ["x64"]
+    },
+    "@bufbuild/buf-linux-aarch64@1.72.0": {
+      "integrity": "sha512-cbIsUcgM5bHhbZWcDaAXqaYOAi8N0c0u+NiDydwVmZ04Et3s1EZ3TDqfQDRzwvoBPDP+lsO6YuTRXX6nI28x4w==",
+      "os": ["linux"],
+      "cpu": ["arm64"]
+    },
+    "@bufbuild/buf-linux-armv7@1.72.0": {
+      "integrity": "sha512-v/bXVsFL8YNm2HgosGb9r3+nAt4jQiUc3r3JipYuiVY3DAJZAjoEvcak6/BkxQMTEQz9Zb8gRRlule9IFkbc5g==",
+      "os": ["linux"],
+      "cpu": ["arm"]
+    },
+    "@bufbuild/buf-linux-x64@1.72.0": {
+      "integrity": "sha512-4xHGXEjqFxo1wX1zMGq4CzhYt5++nrj4C7k30j+YmGtvqCnipfdSe+V6kknBYRfYswVZEUwUbQOh6pnMTcGcrA==",
+      "os": ["linux"],
+      "cpu": ["x64"]
+    },
+    "@bufbuild/buf-win32-arm64@1.72.0": {
+      "integrity": "sha512-WH7ClsoB9A0e/5fFhx0DLqLzillYPRdHBhlwzihgvjGci0bBdyJVHSQGf0B9uspCMU6sn6W/N1S9/2vvQBNMug==",
+      "os": ["win32"],
+      "cpu": ["arm64"]
+    },
+    "@bufbuild/buf-win32-x64@1.72.0": {
+      "integrity": "sha512-X3eWqFzhDmu8CYQZz+Fu7i+PgH+yUl8UwJ5+x+bhZRYAIdcijikthodk60c5u/qq42m1Z2XAnAGyp/mTf7IffA==",
+      "os": ["win32"],
+      "cpu": ["x64"]
+    },
+    "@bufbuild/buf@1.72.0": {
+      "integrity": "sha512-BwBKTX/WXkhAhqWJGrEKnqU03/4tK1O0OozSlwUMBCOEo8pLL3xu3M24RT3+umExEeM0wjlANO6axqGWMqtt4Q==",
+      "optionalDependencies": [
+        "@bufbuild/buf-darwin-arm64",
+        "@bufbuild/buf-darwin-x64",
+        "@bufbuild/buf-linux-aarch64",
+        "@bufbuild/buf-linux-armv7",
+        "@bufbuild/buf-linux-x64",
+        "@bufbuild/buf-win32-arm64",
+        "@bufbuild/buf-win32-x64"
+      ],
+      "scripts": true,
+      "bin": true
+    },
     "@bufbuild/protobuf@1.10.1": {
       "integrity": "sha512-wJ8ReQbHxsAfXhrf9ixl0aYbZorRuOWpBNzm8pL8ftmSxQx/wnJD5Eg861NwJU/czy2VXFIebCeZnZrI9rktIQ=="
     },

infra/setup.ts

@@ -9,6 +9,7 @@ const SPIRE_COMPOSE_PATH = path.join("infra", "compose.spire.yml");
 
 export interface AuthSetupConfig {
   reg: string;
+  ghcrReg: string;
   domainName: string;
   dbPassword: string;
   dbDataPath: string;
@@ -17,6 +18,7 @@ export interface AuthSetupConfig {
 
 const DEFAULT_AUTH_CONFIG: AuthSetupConfig = {
   reg: "quay.atyg.org",
+  ghcrReg: "ghcr.atyg.org",
   domainName: "auth.system.local",
   dbPassword: "",
   dbDataPath: "/volume1/docker/auth-yes/db",
@@ -33,6 +35,7 @@ export async function readEnv(): Promise<Partial<AuthSetupConfig>> {
       const [key, ...rest] = trimmed.split("=");
       const val = rest.join("=").trim();
       if (key === "REG") config.reg = val;
+      if (key === "GHCR_REG") config.ghcrReg = val;
       if (key === "SYSTEM_DOMAIN") config.domainName = val;
       if (key === "POSTGRES_PASSWORD") config.dbPassword = val;
       if (key === "DB_DATA_PATH") config.dbDataPath = val;
@@ -48,6 +51,7 @@ export async function readEnv(): Promise<Partial<AuthSetupConfig>> {
 export function generateEnv(config: AuthSetupConfig): string {
   return `# --- Container Registry ---
 REG=${config.reg}
+GHCR_REG=${config.ghcrReg || "ghcr.atyg.org"}
 
 # --- Network & Routing ---
 SYSTEM_DOMAIN=${config.domainName}
@@ -136,7 +140,7 @@ export function generateSpireDockerCompose(): string {
 
 services:
   spire-server:
-    image: gcr.io/spiffe-io/spire-server:1.9.3
+    image: \${GHCR_REG:-ghcr.atyg.org}/spiffe/spire-server:1.9.3
     container_name: spire-server
     hostname: spire-server
     networks:
@@ -147,7 +151,7 @@ services:
     command: ["-config", "/opt/spire/conf/server.conf"]
 
   spire-agent:
-    image: gcr.io/spiffe-io/spire-agent:1.9.3
+    image: \${GHCR_REG:-ghcr.atyg.org}/spiffe/spire-agent:1.9.3
     container_name: spire-agent
     hostname: spire-agent
     pid: host
@@ -276,10 +280,15 @@ export async function handleAuthSetup(
   );
 
   const reg = await Input.prompt({
-    message: "Enter the Container Registry URL:",
+    message: "Enter the Primary Container Registry URL:",
     default: currentConfig.reg,
   });
 
+  const ghcrReg = await Input.prompt({
+    message: "Enter the GHCR Mirror Registry URL (for SPIRE):",
+    default: currentConfig.ghcrReg || "ghcr.atyg.org",
+  });
+
   const domainName = await Input.prompt({
     message: "Enter the Auth Domain Name:",
     hint: "E.g., auth.system.local",
@@ -312,6 +321,7 @@ export async function handleAuthSetup(
 
   const newConfig: AuthSetupConfig = {
     reg,
+    ghcrReg,
     domainName,
     dbPassword,
     dbDataPath,
@@ -516,6 +526,7 @@ if (import.meta.main) {
     .command("auth", "Configure Auth Yes API")
     .option("--auto, --headless", "Run in headless mode")
     .option("--registry <reg:string>", "Container Registry URL")
+    .option("--ghcr-registry <ghcrReg:string>", "GHCR Mirror Registry URL")
     .option("--domain <domain:string>", "Auth Domain Name")
     .option("--db-path <path:string>", "Database Path on the Host")
     .action(async (options) => {
@@ -557,6 +568,8 @@ if (import.meta.main) {
 
         const newConfig: AuthSetupConfig = {
           reg: options.registry,
+          ghcrReg: options.ghcrRegistry || currentConfig.ghcrReg ||
+            "ghcr.atyg.org",
           domainName: options.domain,
           dbPassword,
           dbDataPath: options.dbPath,
@@ -565,6 +578,7 @@ if (import.meta.main) {
         await generateAuthSetupFiles(newConfig);
       } else {
         if (options.registry) currentConfig.reg = options.registry;
+        if (options.ghcrRegistry) currentConfig.ghcrReg = options.ghcrRegistry;
         if (options.domain) currentConfig.domainName = options.domain;
         if (options.dbPath) currentConfig.dbDataPath = options.dbPath;
         await handleAuthSetup(currentConfig);

sdk/gen/auth_connect.ts

@@ -1,10 +1,10 @@
 // @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts,import_extension=.ts"
 // @generated from file auth.proto (package auth.v1, syntax proto3)
 /* eslint-disable */
-// @ts-nocheck: Generated protobuf connect code
+// @ts-nocheck
 
 import { ValidateSessionRequest, ValidateSessionResponse } from "./auth_pb.ts";
-import { MethodKind } from "npm:@bufbuild/protobuf@^1.10.0";
+import { MethodKind } from "@bufbuild/protobuf";
 
 /**
  * @generated from service auth.v1.AuthService

sdk/gen/auth_pb.ts

@@ -1,7 +1,7 @@
 // @generated by protoc-gen-es v1.10.0 with parameter "target=ts,import_extension=.ts"
 // @generated from file auth.proto (package auth.v1, syntax proto3)
 /* eslint-disable */
-// @ts-nocheck: Generated protobuf schema code
+// @ts-nocheck
 
 import type {
   BinaryReadOptions,
@@ -10,8 +10,8 @@ import type {
   JsonValue,
   PartialMessage,
   PlainMessage,
-} from "npm:@bufbuild/protobuf@^1.10.0";
+} from "@bufbuild/protobuf";
-import { Message, proto3 } from "npm:@bufbuild/protobuf@^1.10.0";
+import { Message, proto3 } from "@bufbuild/protobuf";
 
 /**
  * @generated from message auth.v1.ValidateSessionRequest