@openmeet/snowglobe 0.3.0 → 0.5.0

package/stack/https/app-names.cjs

@@ -1,13 +1,14 @@
 // Preloaded into each PDS (NODE_OPTIONS=--require, in the globe bin/snowglobe.mjs render writes), so a PDS can
-// reach an app at https://<name>.app.<domain>: it fetches a confidential client's
-// metadata and keys from there. Docker's DNS has no wildcard names, so every such name is
+// reach an OAuth client under the globe's domain, an app at https://<name>.app.<domain> or
+// PDSls at https://pdsls.<domain>: it fetches the client's metadata and keys from there.
+// Docker's DNS has no wildcard names, so every such name is
 // looked up as nginx instead, which routes it by name (stack/https/nginx.conf.template). Only
 // the address lookup changes: the request still carries the app's name, and TLS still
 // checks the certificate for it against the snowglobe CA. Every other name resolves as usual.
 //
-// SG_RESOLVE_DOMAIN sets the domain whose names, itself included, go to nginx. Each PDS sets it
-// to app.<domain>, where the apps are; a group host sets it to the globe's domain: it resolves its members' handles, which Docker's DNS does
-// not know.
+// SG_RESOLVE_DOMAIN sets the domain whose names, itself included, go to nginx. Each PDS and
+// each group host sets it to the globe's domain; a group host also resolves its members'
+// handles there, which Docker's DNS does not know.
 'use strict';
 const dns = require('dns');
 

package/stack/jetstream/Dockerfile

@@ -0,0 +1,12 @@
+# Jetstream (github.com/bluesky-social/jetstream), the firehose as JSON for apps. It serves v2,
+# /xrpc/network.bsky.jetstream.subscribeEvents, which contrail and @bsky/jetstream read, and the
+# older /subscribe, which Slingshot, PDSls and the network page read.
+# To move to another Jetstream, change the second FROM line. snowglobe up builds the new image,
+# since the image's tag is a hash of this file.
+# The image has no shell, so busybox comes along for the health check. It runs as root so it can
+# write the jetstream-data volume, which Docker makes root's.
+FROM busybox:1.37.0-musl@sha256:f6a95d611e0a8780fabdb2aec43e31275b2720dfefa3e41b16835bfc42454478 AS tools
+
+FROM ghcr.io/bluesky-social/jetstream:v0.4.6@sha256:38e927566ed2aca19ffd2e9f3c440db74ffb404000aaf493b215dfefc6c7e54c
+COPY --from=tools /bin/busybox /busybox
+USER 0:0

package/stack/page/snowglobe.conf

@@ -37,7 +37,7 @@ location = /health/relay     { proxy_pass $relay/xrpc/_health; }
 location = /health/jetstream { proxy_pass $jetstream/; }
 location = /health/slingshot { proxy_pass $slingshot/; }
 location = /health/sync      { proxy_pass $tap/health; }
-location = /health/mail      { proxy_pass $maildev/healthz; }
+location = /health/mail      { proxy_pass $maildev/api/healthz; }
 location = /health/pdsls     { proxy_pass $pdsls/_health; }
 
 # Health and accounts for each account server (/health/<name>, /people/<name>/listRepos and

package/lib/hosts.mjs

@@ -1,36 +0,0 @@
-// The names snowglobe run maps to nginx, and the hosts file it binds over /etc/hosts. Pure:
-// lib/commands/run.mjs reads the files and runs the command.
-
-const NAME_RE = /^[A-Za-z0-9.-]+$/;
-const words = (text) => (text ?? '').split(/\s+/).filter(Boolean);
-
-/**
- * Every name a process under run should reach nginx at: the rendered globe's leaf names that are
- * not wildcards (its page, each PDS, its services, plc.directory), each handle in `handles`
- * (data/https/names), <name>.app.<domain> for each app in `apps`, and `extra`
- * (HTTPS_RUN_EXTRA_NAMES, space-separated). In that order, each once.
- */
-export function runNames({ leafNames, handles, apps, domain, extra }) {
-  return [
-    ...new Set([
-      ...words(leafNames).filter((n) => !n.startsWith('*')),
-      // One per line; a line that is not a name is skipped whole.
-      ...(handles ?? '').split('\n').filter((n) => NAME_RE.test(n)),
-      ...apps.map((a) => `${a.name}.app.${domain}`),
-      ...words(extra),
-    ]),
-  ];
-}
-
-/**
- * The hosts file: `etcHosts` (the machine's) without any line naming one of `names`, then each
- * name on `bind`.
- */
-export function hostsFile(etcHosts, names, bind) {
-  const ours = new Set(names);
-  const kept = etcHosts
-    .split('\n')
-    .filter((l, i, all) => i < all.length - 1 || l !== '')
-    .filter((l) => !l.trim().split(/\s+/).slice(1).some((n) => ours.has(n)));
-  return [...kept, '# snowglobe (bin/snowglobe.mjs run)', ...names.map((n) => `${bind} ${n}`), ''].join('\n');
-}