olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(bootstrap): forgejo forge — postgres + rustfs + ssh (T08)

Browse source 
foundation-forgejo (forgejo:11, digest-pinned) on foundation-net: git repos on the
foundation-forgejo-data volume (the irreducible state), metadata in external
Postgres, blobs in RustFS (default storage + LFS over the minio API). Config is
seeded via FORGEJO__section__KEY env -> app.ini; INSTALL_LOCK skips the web
installer and the crypto secrets (SECRET_KEY/INTERNAL_TOKEN/JWT) auto-generate and
persist in the volume. HTTP 3000 is internal (Caddy fronts forge.olsitec.net); the
image's openssh sshd owns container :22 (START_SSH_SERVER=false — explicitly, so a
stale app.ini value can't keep Forgejo's built-in Go SSH server colliding on :22),
published on host :22 (scp-form goal) and :2222 (CONTRACT_003). A healthz-gated
ready command is GATE B for T09/T10.

Live on cx33 Helsinki: container healthy, https://forge.olsitec.net = 200 over a
valid Let's Encrypt cert, API 11.0.15, sshd reachable on :22 and :2222.
Acceptance T08 met.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Andreas Niemann 2026-06-30 22:23:39 +02:00
parent 6a7c28b54c
commit f1e1d6facd
3 changed files with 173 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
bootstrap/index.ts
View file

@ -17,6 +17,7 @@ import { deployPostgres } from "./components/postgres";
import { deployRustfs } from "./components/rustfs";
import { deployVault } from "./components/vault";
import { deployProxy } from "./components/proxy";
import { deployForgejo } from "./components/forgejo";
const cfg = loadConfig();
@ -48,7 +49,12 @@ const vaultCreds = writeCredentialsToVault(ctx, credentials, vault);
// T07 caddy ✓ · T08 forgejo · T10 runner
// -----------------------------------------------------------------------------
const proxy = deployProxy(ctx);
// const forgejo = deployForgejo(ctx, { postgres, rustfs, credentials, proxy });
const forgejo = deployForgejo(ctx, {
postgres,
rustfs,
pgCreds: credentials.postgres,
rustfsCreds: credentials.rustfs,
});
// --- GATE B: Forgejo healthy → handover (T11) + runner registration (T10).
// const runner = deployRunner(ctx, { forgejo, credentials });
// =============================================================================
@ -57,8 +63,10 @@ const proxy = deployProxy(ctx);
// vaultCreds (T06) is a gate for Forgejo (T08) — it has no output to export yet.
void vaultCreds;
export const phase = "T07-caddy"; // data-plane + creds + public ingress (Caddy)
export const phase = "T08-forgejo"; // forge live (postgres + rustfs + caddy + ssh)
export const caddyImageId = proxy.imageId;
export const forgejoEndpoint = forgejo.endpoint;
void forgejo.ready; // GATE B for T09/T10
export const networkName = network.name;
export const vmTarget = `${cfg.vm.user}@${cfg.vm.host}`;
export const postgresEndpoint = postgres.endpoint;