ops: paivana and caddy config refresh
This commit is contained in:
Hernâni Marques
parent
d8dbc6242b
commit
56f814a6de
74 changed files with 4517 additions and 79 deletions
47
configs/cryptpad/Containerfile
Normal file
47
configs/cryptpad/Containerfile
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
# koopa-cryptpad — CryptPad on CachyOS base + Node from pacman
|
||||
# Build on koopa (x86_64):
|
||||
# bash ~/koopa-admin-log/scripts/cryptpad/build.sh
|
||||
# → localhost/koopa-cryptpad:cachyos
|
||||
#
|
||||
# App tree from upstream release tarball (not the official Debian-ish image).
|
||||
|
||||
ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
|
||||
FROM ${CACHYOS_IMAGE}
|
||||
|
||||
ARG CRYPTPAD_VERSION=2025.9.0
|
||||
ARG CRYPTPAD_URL=https://github.com/cryptpad/cryptpad/archive/refs/tags/${CRYPTPAD_VERSION}.tar.gz
|
||||
|
||||
ENV TZ=Europe/Zurich \
|
||||
PATH=/usr/local/bin:$PATH \
|
||||
CRYPTPAD_HOME=/cryptpad
|
||||
|
||||
RUN pacman -Syu --noconfirm --needed \
|
||||
bash curl ca-certificates catatonit tar git \
|
||||
nodejs npm \
|
||||
&& pacman -Scc --noconfirm \
|
||||
&& rm -rf /var/cache/pacman/pkg/* /tmp/*
|
||||
|
||||
# npm may block git deps (EALLOWGIT); rewrite git+ssh → https and allow git installs.
|
||||
RUN curl -fsSL "$CRYPTPAD_URL" -o /tmp/cryptpad.tgz \
|
||||
&& mkdir -p /cryptpad \
|
||||
&& tar -xzf /tmp/cryptpad.tgz -C /cryptpad --strip-components=1 \
|
||||
&& rm -f /tmp/cryptpad.tgz \
|
||||
&& cd /cryptpad \
|
||||
&& git config --global url."https://github.com/".insteadOf "ssh://git@github.com/" \
|
||||
&& git config --global url."https://github.com/".insteadOf "git@github.com:" \
|
||||
&& git config --global url."https://".insteadOf "git://" \
|
||||
&& printf 'allow-git=all\nallow-remote=all\n' > /root/.npmrc \
|
||||
&& (npm ci --omit=dev --allow-git=all --allow-remote=all \
|
||||
|| npm install --omit=dev --allow-git=all --allow-remote=all) \
|
||||
&& (npm run install:components || true) \
|
||||
&& rm -rf /root/.npm /tmp/* /var/cache/pacman/pkg/*
|
||||
|
||||
COPY entrypoint.sh /docker-entrypoint.sh
|
||||
RUN mkdir -p /cryptpad/config /cryptpad/data /cryptpad/datastore /cryptpad/block /cryptpad/blob \
|
||||
/cryptpad/blobstage /cryptpad/data/logs
|
||||
COPY config.example.js /cryptpad/config/config.js
|
||||
RUN chmod 755 /docker-entrypoint.sh
|
||||
|
||||
EXPOSE 3000
|
||||
WORKDIR /cryptpad
|
||||
ENTRYPOINT ["/usr/bin/catatonit", "--", "/docker-entrypoint.sh"]
|
||||
32
configs/cryptpad/README.md
Normal file
32
configs/cryptpad/README.md
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# CryptPad — on CachyOS (koopa)
|
||||
|
||||
| Item | Value |
|
||||
|------|--------|
|
||||
| Stack | [CryptPad](https://cryptpad.org/) |
|
||||
| Image | `localhost/koopa-cryptpad:cachyos` |
|
||||
| Live dir | `/home/hernani/koopa-cryptpad/` |
|
||||
| Host port | **9030** = Paivana paywall; nginx edge backend **127.0.0.1:19130** → app |
|
||||
| App ports (internal) | **3000** HTTP, **3003** websocket |
|
||||
| Public site | `cryptpad.hacktivism.ch` |
|
||||
|
||||
`websocketPort` must differ from `httpPort` (upstream default 3003). Compose runs `koopa-cryptpad-edge` (nginx) so Caddy still only targets **9030**.
|
||||
Upstream wants a separate **safe/sandbox** origin for some builds — add a second vhost after first boot if the admin UI requires it.
|
||||
|
||||
## Build + up
|
||||
|
||||
```bash
|
||||
bash /path/to/koopa-admin-log/scripts/cryptpad/build.sh
|
||||
mkdir -p ~/koopa-cryptpad
|
||||
cp -a /path/to/koopa-admin-log/configs/cryptpad/{compose.yml,config.example.js} ~/koopa-cryptpad/
|
||||
cp ~/koopa-cryptpad/config.example.js ~/koopa-cryptpad/config.js
|
||||
# edit httpUnsafeOrigin / httpSafeOrigin in config.js
|
||||
cd ~/koopa-cryptpad && podman-compose up -d
|
||||
```
|
||||
|
||||
## Caddy
|
||||
|
||||
```bash
|
||||
sudo bash /path/to/koopa-admin-log/scripts/caddy/caddy-apply.sh \
|
||||
--snippet …/configs/caddy/cryptpad.hacktivism.ch.caddy \
|
||||
--site cryptpad.hacktivism.ch --port 9030 --label cryptpad
|
||||
```
|
||||
53
configs/cryptpad/compose.yml
Normal file
53
configs/cryptpad/compose.yml
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
# koopa-cryptpad — CryptPad on CachyOS + nginx edge (HTTP+WS on :9030)
|
||||
# Live: /home/hernani/koopa-cryptpad/
|
||||
# Build: bash ~/koopa-admin-log/scripts/cryptpad/build.sh → localhost/koopa-cryptpad:cachyos
|
||||
#
|
||||
# Public :9030 = koopa-paivana-cryptpad (shared paivana image).
|
||||
# Edge backend loopback only — Paivana DEST → 127.0.0.1:19130
|
||||
# App listens 3000 (http) + 3003 (websocket) inside the net.
|
||||
services:
|
||||
cryptpad:
|
||||
image: localhost/koopa-cryptpad:cachyos
|
||||
build:
|
||||
context: .
|
||||
dockerfile: Containerfile
|
||||
args:
|
||||
CRYPTPAD_VERSION: "${CRYPTPAD_VERSION:-2025.9.0}"
|
||||
container_name: koopa-cryptpad
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- TZ=Europe/Zurich
|
||||
volumes:
|
||||
- ./data:/cryptpad/data
|
||||
- ./datastore:/cryptpad/datastore
|
||||
- ./block:/cryptpad/block
|
||||
- ./blob:/cryptpad/blob
|
||||
- ./config.js:/cryptpad/config/config.js:ro
|
||||
expose:
|
||||
- "3000"
|
||||
- "3003"
|
||||
labels:
|
||||
org.hacktivism.service: cryptpad
|
||||
org.hacktivism.host_port: "9030"
|
||||
org.hacktivism.backend_port: "${BACKEND_PORT:-19130}"
|
||||
org.hacktivism.site: cryptpad.hacktivism.ch
|
||||
org.hacktivism.managed_by: koopa-admin
|
||||
org.hacktivism.port_status: backend-19130-paywall-9030
|
||||
org.hacktivism.image_base: cachyos
|
||||
|
||||
edge:
|
||||
image: docker.io/library/nginx:alpine
|
||||
container_name: koopa-cryptpad-edge
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- cryptpad
|
||||
volumes:
|
||||
- ./edge.conf:/etc/nginx/conf.d/default.conf:ro
|
||||
ports:
|
||||
- "127.0.0.1:${BACKEND_PORT:-19130}:80"
|
||||
labels:
|
||||
org.hacktivism.service: cryptpad-edge
|
||||
org.hacktivism.host_port: "9030"
|
||||
org.hacktivism.backend_port: "${BACKEND_PORT:-19130}"
|
||||
org.hacktivism.site: cryptpad.hacktivism.ch
|
||||
org.hacktivism.managed_by: koopa-admin
|
||||
13
configs/cryptpad/config.example.js
Normal file
13
configs/cryptpad/config.example.js
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
/* CryptPad config — http on 3000, websockets on 3003 (must differ).
|
||||
* Live: mount ./config.js over /cryptpad/config/config.js
|
||||
* Edge nginx in compose merges both onto host :9030 (Caddy unchanged).
|
||||
*/
|
||||
module.exports = {
|
||||
httpUnsafeOrigin: 'https://cryptpad.hacktivism.ch',
|
||||
httpSafeOrigin: 'https://cryptpad.hacktivism.ch',
|
||||
httpAddress: '0.0.0.0',
|
||||
httpPort: 3000,
|
||||
websocketPort: 3003,
|
||||
logToStdout: true,
|
||||
maxWorkers: 2,
|
||||
};
|
||||
37
configs/cryptpad/edge.conf
Normal file
37
configs/cryptpad/edge.conf
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
# Front for koopa-cryptpad: HTTP :3000 + /cryptpad_websocket → :3003
|
||||
upstream cryptpad_http {
|
||||
server cryptpad:3000;
|
||||
}
|
||||
upstream cryptpad_ws {
|
||||
server cryptpad:3003;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80 default_server;
|
||||
server_name _;
|
||||
client_max_body_size 150m;
|
||||
|
||||
location /cryptpad_websocket {
|
||||
proxy_pass http://cryptpad_ws;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 3600s;
|
||||
proxy_send_timeout 3600s;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://cryptpad_http;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_read_timeout 3600s;
|
||||
proxy_send_timeout 3600s;
|
||||
}
|
||||
}
|
||||
5
configs/cryptpad/entrypoint.sh
Executable file
5
configs/cryptpad/entrypoint.sh
Executable file
|
|
@ -0,0 +1,5 @@
|
|||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
cd /cryptpad
|
||||
# Expect config.js already present (compose mounts or image default).
|
||||
exec node server.js "$@"
|
||||
Loading…
Add table
Add a link
Reference in a new issue