Monorepo for Tangled
wip: appview,spindle: more explicit TLS handling
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee
(May 16, 2026, 11:57 PM +0900)
78ec407c
f526d92f
+40
-28
+6
-6
appview/pipelines/pipelines.go
+6
-6
appview/pipelines/pipelines.go
···
7
7
"fmt"
8
8
"log/slog"
9
9
"net/http"
10
-
"strings"
10
+
"path"
11
11
"time"
12
12
13
13
"tangled.org/core/api/tangled"
···
218
218
}
219
219
220
220
scheme := "wss"
221
-
if p.config.Core.Dev {
222
-
scheme = "ws"
223
-
}
221
+
// if p.config.Core.Dev {
222
+
// scheme = "ws"
223
+
// }
224
224
225
-
url := scheme + "://" + strings.Join([]string{spindle, "logs", knot, rkey, workflow}, "/")
225
+
url := scheme + "://" + path.Join(spindle, "logs", knot, rkey, workflow)
226
226
l = l.With("url", url)
227
227
228
228
clientConn, err := upgrader.Upgrade(w, r, nil)
···
392
392
r,
393
393
oauth.WithService(f.Spindle),
394
394
oauth.WithLxm(tangled.PipelineCancelPipelineNSID),
395
-
oauth.WithDev(p.config.Core.Dev),
395
+
oauth.WithDev(false),
396
396
oauth.WithTimeout(time.Second*30), // workflow cleanup usually takes time
397
397
)
398
398
+1
-1
appview/state/knotstream.go
+1
-1
appview/state/knotstream.go
+1
-1
appview/state/spindlestream.go
+1
-1
appview/state/spindlestream.go
+14
-13
spindle/config/config.go
+14
-13
spindle/config/config.go
···
9
9
)
10
10
11
11
type Server struct {
12
-
ListenAddr string `env:"LISTEN_ADDR, default=0.0.0.0:6555"`
13
-
DBPath string `env:"DB_PATH, default=spindle.db"`
14
-
Hostname string `env:"HOSTNAME, required"`
15
-
JetstreamEndpoint string `env:"JETSTREAM_ENDPOINT, default=wss://jetstream1.us-west.bsky.network/subscribe"`
16
-
Tap Tap `env:",prefix=TAP_"`
17
-
PlcUrl string `env:"PLC_URL, default=https://plc.directory"`
18
-
Dev bool `env:"DEV, default=false"`
19
-
Owner string `env:"OWNER, required"`
20
-
Secrets Secrets `env:",prefix=SECRETS_"`
21
-
LogDir string `env:"LOG_DIR, default=/var/log/spindle"`
22
-
QueueSize int `env:"QUEUE_SIZE, default=100"`
23
-
MaxJobCount int `env:"MAX_JOB_COUNT, default=2"` // max number of pipelines that run at a time
24
-
MaxConcurrentWorkflows int `env:"MAX_CONCURRENT_WORKFLOWS, default=8"` // max number of workflow containers running at once (memory cap)
12
+
ListenAddr string `env:"LISTEN_ADDR, default=0.0.0.0:6555"`
13
+
DBPath string `env:"DB_PATH, default=spindle.db"`
14
+
Hostname string `env:"HOSTNAME, required"`
15
+
JetstreamEndpoint string `env:"JETSTREAM_ENDPOINT, default=wss://jetstream1.us-west.bsky.network/subscribe"`
16
+
Tap Tap `env:",prefix=TAP_"`
17
+
PlcUrl string `env:"PLC_URL, default=https://plc.directory"`
18
+
Dev bool `env:"DEV, default=false"`
19
+
DevExtraHosts []string `env:"DEV_EXTRA_HOSTS"`
20
+
Owner string `env:"OWNER, required"`
21
+
Secrets Secrets `env:",prefix=SECRETS_"`
22
+
LogDir string `env:"LOG_DIR, default=/var/log/spindle"`
23
+
QueueSize int `env:"QUEUE_SIZE, default=100"`
24
+
MaxJobCount int `env:"MAX_JOB_COUNT, default=2"` // max number of pipelines that run at a time
25
+
MaxConcurrentWorkflows int `env:"MAX_CONCURRENT_WORKFLOWS, default=8"` // max number of workflow containers running at once (memory cap)
25
26
}
26
27
27
28
type Tap struct {
+7
-2
spindle/engines/nixery/engine.go
+7
-2
spindle/engines/nixery/engine.go
···
219
219
for scanner.Scan() {
220
220
line := scanner.Text()
221
221
wfLogger.DataWriter(setupStepIdx, "stdout").Write([]byte(line))
222
-
l.Info("image pull progress", "stdout", line)
222
+
// l.Info("image pull progress", "stdout", line)
223
223
}
224
224
225
225
/// -------------------------CONTAINER CREATION-------------------------------------
226
226
l.Info("creating container")
227
227
wfLogger.DataWriter(setupStepIdx, "stdout").Write([]byte("creating container..."))
228
+
229
+
extraHosts := []string{"host.docker.internal:host-gateway"}
230
+
for _, h := range e.cfg.Server.DevExtraHosts {
231
+
extraHosts = append(extraHosts, h+":host-gateway")
232
+
}
228
233
229
234
resp, err := e.docker.ContainerCreate(ctx, &container.Config{
230
235
Image: addl.image,
···
256
261
CapDrop: []string{"ALL"},
257
262
CapAdd: []string{"CAP_DAC_OVERRIDE", "CAP_CHOWN", "CAP_FOWNER", "CAP_SETUID", "CAP_SETGID"},
258
263
SecurityOpt: []string{"no-new-privileges"},
259
-
ExtraHosts: []string{"host.docker.internal:host-gateway"},
264
+
ExtraHosts: extraHosts,
260
265
Resources: container.Resources{
261
266
Memory: e.cfg.NixeryPipelines.MaxJobMemoryMB * 1024 * 1024,
262
267
},
+10
-4
spindle/models/clone.go
+10
-4
spindle/models/clone.go
···
63
63
}
64
64
fetchArgs := buildFetchArgs(cloneOpts, commitSHA)
65
65
66
+
// In dev mode we point at Caddy via host-gateway with a self-signed cert,
67
+
// so skip the TLS check for the fetch call.
68
+
fetchCmd := "git fetch"
69
+
if dev {
70
+
fetchCmd = "git -c http.sslVerify=false fetch"
71
+
}
72
+
66
73
return CloneStep{
67
74
kind: StepKindSystem,
68
75
name: "Clone repository into workspace",
69
76
commands: []string{
70
77
"git init",
71
78
fmt.Sprintf("git remote add origin %s", repoURL),
72
-
fmt.Sprintf("git fetch %s", strings.Join(fetchArgs, " ")),
79
+
fmt.Sprintf("%s %s", fetchCmd, strings.Join(fetchArgs, " ")),
73
80
"git checkout FETCH_HEAD",
74
81
},
75
82
}
···
104
111
// BuildRepoURL constructs the repository URL from repo metadata.
105
112
func BuildRepoURL(repo *tangled.Pipeline_TriggerRepo, devMode bool) string {
106
113
scheme := "https://"
107
-
if devMode {
108
-
scheme = "http://"
109
-
}
110
114
111
115
// Get host from knot
112
116
host := repo.Knot
113
117
118
+
// TODO(boltless): replace this with hostutil once docker-compose devenv become stable
114
119
// In dev mode, replace localhost with host.docker.internal for Docker networking
115
120
if devMode && strings.Contains(host, "localhost") {
121
+
scheme = "http://"
116
122
host = strings.ReplaceAll(host, "localhost", "host.docker.internal")
117
123
}
118
124
+1
-1
spindle/server.go
+1
-1
spindle/server.go
···
171
171
// job in the above registered queue.
172
172
ccfg := eventconsumer.NewConsumerConfig()
173
173
ccfg.Logger = log.SubLogger(logger, "eventconsumer")
174
-
ccfg.Dev = cfg.Server.Dev
174
+
ccfg.Dev = false
175
175
ccfg.ProcessFunc = spindle.processPipeline
176
176
ccfg.CursorStore = cursorStore
177
177
knownKnots, err := d.Knots()