@le-space/rootfs 0.6.28 → 0.6.29

package/README.md

@@ -11,6 +11,8 @@ Shared rootfs contract parsing, reference profile assets, and build helpers.
   including the delayed first-start, setup endpoint, Caddy, and AutoTLS flow
 - added a `ucan-store` reference contract scaffold with documented service
   ports and consumer env expectations
+- added an ephemeral `playwright-runner` profile with Node.js 24, exact
+  Playwright/Chromium `1.61.1`, authenticated WSS, bounded logs, and a guest TTL
 
 ## Reference assets
 
@@ -22,3 +24,5 @@ Current shared reference profiles live under:
 - `reference/orbitdb-relay/rootfs/*`
 - `reference/ucan-store/contract.json`
 - `reference/ucan-store/rootfs/*`
+- `reference/playwright-runner/contract.json`
+- `reference/playwright-runner/rootfs/*`

package/index.d.ts

@@ -123,6 +123,7 @@ interface RootfsManifest {
     rootfsSizeMiB: number;
     createdAt: string;
     notes: string;
+    playwrightVersion?: string;
 }
 interface RootfsManifestOptions {
     createdAt?: string;

package/index.js

@@ -274,6 +274,9 @@ function validateRootfsManifest(manifest) {
     return { manifest, valid: false, errors: ["Rootfs manifest is missing."] };
   }
   if (!manifest.version) errors.push("Rootfs manifest version is missing.");
+  if (manifest.profile === "playwright-runner" && !/^\d+\.\d+\.\d+$/u.test(manifest.playwrightVersion ?? "")) {
+    errors.push("Playwright runner manifest must expose an exact Playwright version.");
+  }
   if (manifest.rootfsInstallStrategy != null && manifest.rootfsInstallStrategy !== "thin" && manifest.rootfsInstallStrategy !== "prebaked") {
     errors.push('Rootfs install strategy must be "thin" or "prebaked" when provided.');
   }
@@ -345,6 +348,9 @@ function createRootfsManifest(plan, contract, options = {}) {
     createdAt: options.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     notes: contract.manifest.notes ?? ""
   };
+  if (contract.rootfs.profile === "playwright-runner") {
+    manifest.playwrightVersion = "1.61.1";
+  }
   if (typeof options.rootfsSourceSizeBytes === "number" && Number.isFinite(options.rootfsSourceSizeBytes) && options.rootfsSourceSizeBytes > 0) {
     manifest.rootfsSourceSizeBytes = options.rootfsSourceSizeBytes;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.6.28",
+  "version": "0.6.29",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/playwright-runner/README.md

@@ -0,0 +1,21 @@
+# Playwright runner RootFS
+
+This profile prebakes Node.js 24, Playwright `1.61.1`, its matching Chromium
+headless shell, Caddy, and systemd units. It intentionally contains no endpoint
+credential or TLS private key. The full headed Chromium bundle is omitted
+because this remote CI runner only launches headless browsers.
+
+After Aleph allocates the VM, the reusable action must inject:
+
+- `/etc/default/playwright-runner` with `PLAYWRIGHT_RUNNER_SECRET` and the exact
+  `PLAYWRIGHT_VERSION=1.61.1`;
+- a per-run certificate and key readable by the dedicated proxy service;
+- the requested TTL override, if shorter than the default 45 minutes.
+
+The bootstrap unit refuses to start the browser and proxy until those files are
+present. Caddy protects `/version` and the websocket upgrade with the same
+Bearer credential. The Playwright server only listens on `127.0.0.1:3000`.
+
+The TTL is a last-resort shutdown, not authoritative Aleph cleanup. The owner
+must still erase and FORGET the exact INSTANCE and verify scheduler
+deallocation.

package/reference/playwright-runner/contract.json

@@ -0,0 +1,40 @@
+{
+  "schemaVersion": 1,
+  "id": "playwright-runner",
+  "displayName": "Ephemeral Playwright Chromium Runner",
+  "source": {
+    "repository": "NiKrause/relay-button",
+    "subdirectory": "packages/rootfs/reference/playwright-runner"
+  },
+  "rootfs": {
+    "profile": "playwright-runner",
+    "installMode": "prebaked",
+    "installDir": "/opt/playwright-runner",
+    "binaryPath": "/opt/playwright-runner/node_modules/.bin/playwright",
+    "dataDir": "/var/lib/playwright-runner",
+    "envFile": "/etc/default/playwright-runner"
+  },
+  "services": {
+    "bootstrap": "playwright-runner-bootstrap.service",
+    "main": "playwright-runner.service",
+    "autotlsRefresh": "playwright-runner-ttl.timer"
+  },
+  "ports": [
+    {
+      "port": 22,
+      "tcp": true,
+      "udp": false,
+      "purpose": "SSH bootstrap and diagnostics"
+    },
+    {
+      "port": 443,
+      "tcp": true,
+      "udp": false,
+      "purpose": "Authenticated Playwright WSS and version endpoint"
+    }
+  ],
+  "manifest": {
+    "copyTarget": "packages/rootfs/reference/playwright-runner/latest.json",
+    "notes": "Node.js 24 and Playwright 1.61.1 with matching Chromium are prebaked. A random bearer secret and per-run TLS material must be injected after boot. The image contains no reusable credential and shuts down through a bounded TTL timer."
+  }
+}

package/reference/playwright-runner/rootfs/Caddyfile

@@ -0,0 +1,18 @@
+{
+	admin off
+	auto_https disable_redirects
+}
+
+:443 {
+	tls /etc/playwright-runner/tls.crt /etc/playwright-runner/tls.key
+
+	@unauthorized not header Authorization "Bearer {$PLAYWRIGHT_RUNNER_SECRET}"
+	respond @unauthorized 401
+
+	handle /version {
+		header Content-Type application/json
+		respond `{"playwrightVersion":"{$PLAYWRIGHT_VERSION}"}` 200
+	}
+
+	reverse_proxy 127.0.0.1:3000
+}

package/reference/playwright-runner/rootfs/Dockerfile.rootfs

@@ -0,0 +1,16 @@
+FROM debian:12
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV LIBGUESTFS_BACKEND=direct
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    libguestfs-tools \
+    linux-image-amd64 \
+    qemu-system-x86 \
+    qemu-utils \
+  && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace/shared-rootfs

package/reference/playwright-runner/rootfs/build-rootfs-image.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+OUT_DIR="${OUT_DIR:-${SCRIPT_DIR}/../dist-rootfs}"
+BASE_URL="${BASE_URL:-https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2}"
+BASE_IMAGE="${OUT_DIR}/debian-12-genericcloud-amd64.qcow2"
+IMAGE="${OUT_DIR}/aleph-playwright-runner.qcow2"
+ROOTFS_IMAGE_SIZE="${ROOTFS_IMAGE_SIZE:-20G}"
+PLAYWRIGHT_VERSION="${PLAYWRIGHT_VERSION:-1.61.1}"
+HOST_UID="${HOST_UID:-}"
+HOST_GID="${HOST_GID:-}"
+ROOTFS_SPARSIFY_TMPDIR=""
+
+require() {
+  command -v "$1" >/dev/null 2>&1 || { echo "Missing required command: $1" >&2; exit 1; }
+}
+
+for command in curl qemu-img virt-customize; do require "${command}"; done
+test "${PLAYWRIGHT_VERSION}" = "1.61.1" || {
+  echo "playwright-runner only supports Playwright 1.61.1" >&2
+  exit 1
+}
+
+cleanup() {
+  if [ -n "${ROOTFS_SPARSIFY_TMPDIR}" ] && [ -d "${ROOTFS_SPARSIFY_TMPDIR}" ]; then
+    rm -rf "${ROOTFS_SPARSIFY_TMPDIR}"
+  fi
+}
+trap cleanup EXIT
+
+mkdir -p "${OUT_DIR}"
+if [ ! -f "${BASE_IMAGE}" ]; then
+  curl --fail --show-error --location --retry 5 --retry-all-errors \
+    --connect-timeout 20 --max-time 300 "${BASE_URL}" -o "${BASE_IMAGE}"
+fi
+
+cp "${BASE_IMAGE}" "${IMAGE}"
+qemu-img resize "${IMAGE}" "${ROOTFS_IMAGE_SIZE}"
+
+virt-customize \
+  -a "${IMAGE}" \
+  --network \
+  --mkdir /opt/playwright-runner \
+  --mkdir /opt/playwright-browsers \
+  --mkdir /etc/playwright-runner \
+  --mkdir /etc/systemd/journald.conf.d \
+  --mkdir /var/lib/playwright-runner \
+  --copy-in "${SCRIPT_DIR}/Caddyfile:/etc/playwright-runner" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner-bootstrap.sh:/usr/local/sbin" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner.service:/etc/systemd/system" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner-proxy.service:/etc/systemd/system" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner-bootstrap.service:/etc/systemd/system" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner-ttl.service:/etc/systemd/system" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner-ttl.timer:/etc/systemd/system" \
+  --run-command "apt-get update && apt-get install -y --no-install-recommends ca-certificates caddy curl gnupg" \
+  --run-command "curl -fsSL https://deb.nodesource.com/setup_24.x | bash -" \
+  --run-command "apt-get install -y --no-install-recommends nodejs" \
+  --run-command "useradd --system --home /var/lib/playwright-runner --shell /usr/sbin/nologin playwright-runner" \
+  --run-command "useradd --system --home /var/lib/playwright-runner --shell /usr/sbin/nologin playwright-proxy" \
+  --run-command "cd /opt/playwright-runner && npm init -y && npm install --omit=dev --no-audit --no-fund playwright@${PLAYWRIGHT_VERSION}" \
+  --run-command "cd /opt/playwright-runner && PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers ./node_modules/.bin/playwright install --with-deps --only-shell chromium" \
+  --run-command "chown -R playwright-runner:playwright-runner /opt/playwright-runner /opt/playwright-browsers /var/lib/playwright-runner" \
+  --run-command "chown -R root:playwright-proxy /etc/playwright-runner && chmod 0750 /etc/playwright-runner" \
+  --run-command "chmod 0755 /usr/local/sbin/playwright-runner-bootstrap.sh" \
+  --run-command "printf '[Journal]\\nSystemMaxUse=128M\\nRuntimeMaxUse=64M\\nMaxRetentionSec=2day\\n' >/etc/systemd/journald.conf.d/playwright-runner.conf" \
+  --run-command "npm cache clean --force" \
+  --run-command "apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* /root/.npm /tmp/* /var/tmp/*" \
+  --run-command "systemctl enable playwright-runner-bootstrap.service"
+
+if command -v virt-sparsify >/dev/null 2>&1; then
+  SPARSE_IMAGE="${IMAGE%.qcow2}.sparse.qcow2"
+  ROOTFS_SPARSIFY_TMPDIR="$(mktemp -d "${OUT_DIR}/virt-sparsify-tmp.XXXXXX")"
+  TMPDIR="${ROOTFS_SPARSIFY_TMPDIR}" virt-sparsify --check-tmpdir=continue --compress \
+    "${IMAGE}" "${SPARSE_IMAGE}"
+  mv "${SPARSE_IMAGE}" "${IMAGE}"
+fi
+
+if [ -n "${HOST_UID}" ] && [ -n "${HOST_GID}" ]; then
+  chown -R "${HOST_UID}:${HOST_GID}" "${OUT_DIR}"
+fi
+
+echo "Compressed RootFS size: $(stat -c '%s bytes' "${IMAGE}") ($(du -h "${IMAGE}" | cut -f1) on disk)"
+echo "Playwright ${PLAYWRIGHT_VERSION} RootFS ready: ${IMAGE}"

package/reference/playwright-runner/rootfs/playwright-runner-bootstrap.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Validate and start the injected Playwright runner configuration
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/etc/default/playwright-runner
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/playwright-runner-bootstrap.sh
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

package/reference/playwright-runner/rootfs/playwright-runner-bootstrap.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ENV_FILE=/etc/default/playwright-runner
+TLS_CERT=/etc/playwright-runner/tls.crt
+TLS_KEY=/etc/playwright-runner/tls.key
+
+test -s "${ENV_FILE}"
+test -s "${TLS_CERT}"
+test -s "${TLS_KEY}"
+
+set -a
+# shellcheck disable=SC1090
+source "${ENV_FILE}"
+set +a
+
+test "${PLAYWRIGHT_VERSION:-}" = "1.61.1"
+test -n "${PLAYWRIGHT_RUNNER_SECRET:-}"
+
+chown root:playwright-proxy "${TLS_CERT}" "${TLS_KEY}"
+chmod 0644 "${TLS_CERT}"
+chmod 0640 "${TLS_KEY}"
+
+systemctl restart playwright-runner.service
+systemctl restart playwright-runner-proxy.service
+systemctl restart playwright-runner-ttl.timer

package/reference/playwright-runner/rootfs/playwright-runner-proxy.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=Authenticated TLS proxy for the Playwright runner
+After=network-online.target playwright-runner.service
+Requires=playwright-runner.service
+ConditionPathExists=/etc/default/playwright-runner
+ConditionPathExists=/etc/playwright-runner/tls.crt
+ConditionPathExists=/etc/playwright-runner/tls.key
+
+[Service]
+Type=simple
+User=playwright-proxy
+Group=playwright-proxy
+EnvironmentFile=/etc/default/playwright-runner
+ExecStart=/usr/bin/caddy run --config /etc/playwright-runner/Caddyfile --adapter caddyfile
+ExecReload=/usr/bin/caddy reload --config /etc/playwright-runner/Caddyfile --adapter caddyfile
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

package/reference/playwright-runner/rootfs/playwright-runner-ttl.service

@@ -0,0 +1,6 @@
+[Unit]
+Description=Stop an expired ephemeral Playwright runner
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/systemctl poweroff

package/reference/playwright-runner/rootfs/playwright-runner-ttl.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Maximum lifetime for an ephemeral Playwright runner
+
+[Timer]
+OnActiveSec=45min
+AccuracySec=1min
+Unit=playwright-runner-ttl.service
+
+[Install]
+WantedBy=timers.target

package/reference/playwright-runner/rootfs/playwright-runner.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=Ephemeral Playwright 1.61.1 browser server
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/etc/default/playwright-runner
+
+[Service]
+Type=simple
+User=playwright-runner
+Group=playwright-runner
+EnvironmentFile=/etc/default/playwright-runner
+Environment=PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers
+WorkingDirectory=/opt/playwright-runner
+ExecStart=/opt/playwright-runner/node_modules/.bin/playwright run-server --host 127.0.0.1 --port 3000
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/playwright-runner
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target