@yunuseon/kayra 0.4.0 → 0.5.1

package/README.md

@@ -66,10 +66,11 @@ kayra status
 
 | | |
 |---|---|
+| [**The docs site**](https://yunuseon.github.io/kayra/) | architecture diagrams, getting started, the fleet, the CLI |
+| [The app contract](https://yunuseon.github.io/kayra/concepts/app-contract/) | what an app provides and what it may not do |
+| [CI isolation](https://yunuseon.github.io/kayra/concepts/ci-isolation/) | why app code cannot reach the host or the platform |
+| [Authentication](https://yunuseon.github.io/kayra/concepts/authentication/) | staff login (Authelia), adding people, recovery |
 | [`CLAUDE.md`](CLAUDE.md) | how everything fits together, and the rules that keep it working |
-| [`docs/app-contract.md`](docs/app-contract.md) | what an app provides and what it may not do |
-| [`docs/authentication.md`](docs/authentication.md) | staff login (Authelia), adding people, recovery |
-| [`docs/ci-isolation.md`](docs/ci-isolation.md) | why app code cannot reach the host or the platform |
 
 ## Contributing
 

package/ansible/roles/compose-stacks/tasks/main.yml

@@ -8,6 +8,11 @@
 #
 # Never deletes: a stack dropped from the list keeps running until it is
 # taken down by hand (docker compose -p <name> down).
+#
+# Private images: compose_registry_logins (in secrets.yml, a list of
+# {registry, username, password}) are logged in with a Docker config kept in
+# <dir>/.docker, which every compose call here uses (DOCKER_CONFIG) — the
+# host's own Docker config is never written.
 # =============================================================================
 
 - name: Create stack directories
@@ -52,7 +57,28 @@
   loop: "{{ compose_stacks.stacks | select('in', compose_stack_secrets | default({})) }}"
   no_log: true
 
+- name: Create the stacks' Docker config directory
+  ansible.builtin.file:
+    path: "{{ compose_stacks.dir }}/.docker"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+  when: compose_registry_logins | default([]) | length > 0
+
+- name: Log in to private registries
+  community.docker.docker_login:
+    registry_url: "{{ item.registry }}"
+    username: "{{ item.username }}"
+    password: "{{ item.password }}"
+    config_path: "{{ compose_stacks.dir }}/.docker/config.json"
+  loop: "{{ compose_registry_logins | default([]) }}"
+  loop_control: {label: "{{ item.registry }}"}
+  no_log: true
+
 - name: Start stacks
+  environment:
+    DOCKER_CONFIG: "{{ compose_stacks.dir }}/.docker"
   community.docker.docker_compose_v2:
     project_src: "{{ compose_stacks.dir }}/{{ item }}"
     project_name: "{{ item }}"
@@ -64,6 +90,8 @@
 # when a file it mounts did (a Caddyfile, Homepage's config): those take
 # effect on a restart.
 - name: Restart stacks whose files changed
+  environment:
+    DOCKER_CONFIG: "{{ compose_stacks.dir }}/.docker"
   ansible.builtin.command: docker compose --project-name {{ item.item }} --file compose.yaml restart
   args:
     chdir: "{{ compose_stacks.dir }}/{{ item.item }}"

package/ansible/roles/forgejo-config/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 # =============================================================================
 # forgejo-config role — what a Forgejo holds beyond its own config file, as
-# code: users and their SSH keys, Actions runners, repos (created empty
+# code: users and their SSH keys, organizations, Actions runners, repos (created empty
 # where missing) and their settings (issues, pull requests, actions), Actions
 # secrets, collaborators, webhooks and push mirrors, from
 # forgejo_config in the server's vars.yml. Adds what is missing through the
@@ -46,6 +46,45 @@
   loop_control: {label: "{{ item.name }}"}
   no_log: true
 
+- name: Look up organizations
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/orgs/{{ item.name }}"
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    status_code: [200, 404]
+  register: forgejo_orgs
+  loop: "{{ forgejo_config.orgs | default([]) }}"
+  loop_control: {label: "{{ item.name }}"}
+  no_log: true
+
+# An organization owns repos and packages alike, and its visibility is
+# theirs: a private one keeps what it owns, images included, from the world.
+# Created with its visibility, so it is never public for a moment.
+- name: Create missing organizations
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/admin/users/{{ item.owner }}/orgs"
+    method: POST
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    body_format: json
+    body: {username: "{{ item.name }}", visibility: "{{ item.visibility }}"}
+    status_code: [201]
+  changed_when: true
+  loop: "{{ forgejo_orgs.results | selectattr('status', 'eq', 404) | map(attribute='item') | list }}"
+  loop_control: {label: "{{ item.name }}"}
+  no_log: true
+
+- name: Apply organization visibility
+  ansible.builtin.uri:
+    url: "{{ forgejo_config.url }}/api/v1/orgs/{{ item.item.name }}"
+    method: PATCH
+    headers: {Authorization: "token {{ forgejo_admin_token }}"}
+    body_format: json
+    body: {visibility: "{{ item.item.visibility }}"}
+  changed_when: true
+  when: item.status == 200 and item.json.visibility != item.item.visibility
+  loop: "{{ forgejo_orgs.results }}"
+  loop_control: {label: "{{ item.item.name }}"}
+  no_log: true
+
 - name: Look up SSH keys
   ansible.builtin.uri:
     url: "{{ forgejo_config.url }}/api/v1/users/{{ item.user }}/keys"
@@ -76,10 +115,14 @@
 # --keep-labels: the runner declares its labels when it starts, and a
 # register without it replaces them with none, so no job finds a runner
 # until the runner restarts.
+# A scope (an owner, or owner/repo) limits a runner to those repos; without
+# one it serves every repo on the instance.
 - name: Register runners
   ansible.builtin.command:
-    argv: [docker, exec, -i, "{{ forgejo_config.container }}", forgejo, forgejo-cli, actions, register,
-           --secret-file, /dev/stdin, --name, "{{ item.name }}", --scope, "{{ item.scope }}", --keep-labels]
+    argv: >-
+      {{ ['docker', 'exec', '-i', forgejo_config.container, 'forgejo', 'forgejo-cli', 'actions', 'register',
+          '--secret-file', '/dev/stdin', '--name', item.name, '--keep-labels']
+         + (['--scope', item.scope] if item.scope | default('') | length > 0 else []) }}
     stdin: "{{ forgejo_runner_secrets[item.name] }}"
     # Exactly 40 characters: a trailing newline would be a 41st.
     stdin_add_newline: false
@@ -103,7 +146,9 @@
 # the content is pushed by hand.
 - name: Create missing repos
   ansible.builtin.uri:
-    url: "{{ forgejo_config.url }}/api/v1/admin/users/{{ item.name.split('/')[0] }}/repos"
+    url: >-
+      {{ forgejo_config.url }}/api/v1/{{ 'orgs' if item.name.split('/')[0] in (forgejo_config.orgs | default([]) | map(attribute='name'))
+      else 'admin/users' }}/{{ item.name.split('/')[0] }}/repos
     method: POST
     headers: {Authorization: "token {{ forgejo_admin_token }}"}
     body_format: json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunuseon/kayra",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "A self-hosted app platform and the CLI that runs it: Traefik, Authelia, Jenkins, a registry and rootless BuildKit per server, set up with OpenTofu and Ansible.",
   "license": "MIT",
   "author": "Yunus Öztürk",