pinnace 0.3.2 → 0.3.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/provision/cloud-init.d.ts.map +1 -1
  2. package/dist/provision/cloud-init.js +35 -10
  3. package/dist/provision/cloud-init.js.map +1 -1
  4. package/package.json +1 -1
  5. package/src/provision/cloud-init.ts +35 -10
package/dist/provision/cloud-init.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"cloud-init.d.ts","sourceRoot":"","sources":["../../src/provision/cloud-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,gCAAgC,CAAC;AAE7D,8DAA8D;AAC9D,MAAM,MAAM,QAAQ,GAAG,SAAS,CAAC;AAEjC,yEAAyE;AACzE,eAAO,MAAM,cAAc,EAAE,SAAS,QAAQ,EAAgB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC9B,mDAAmD;IACnD,IAAI,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,IAAI,EAAE,QAAQ,CAAC;IACf;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+DAA+D;AAC/D,MAAM,WAAW,WAAW;IAC3B,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC/B,mEAAmE;IACnE,IAAI,EAAE,QAAQ,CAAC;IACf,6CAA6C;IAC7C,SAAS,EAAE,WAAW,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC5B,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,0EAA0E;IAC1E,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAAC;CAClD;AAodD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,YAWjC,CAAC;AAOF;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAUhE"}
1
+ {"version":3,"file":"cloud-init.d.ts","sourceRoot":"","sources":["../../src/provision/cloud-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,gCAAgC,CAAC;AAE7D,8DAA8D;AAC9D,MAAM,MAAM,QAAQ,GAAG,SAAS,CAAC;AAEjC,yEAAyE;AACzE,eAAO,MAAM,cAAc,EAAE,SAAS,QAAQ,EAAgB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC9B,mDAAmD;IACnD,IAAI,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,IAAI,EAAE,QAAQ,CAAC;IACf;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+DAA+D;AAC/D,MAAM,WAAW,WAAW;IAC3B,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC/B,mEAAmE;IACnE,IAAI,EAAE,QAAQ,CAAC;IACf,6CAA6C;IAC7C,SAAS,EAAE,WAAW,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC5B,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,0EAA0E;IAC1E,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAAC;CAClD;AA6eD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,YAWjC,CAAC;AAOF;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAUhE"}
package/dist/provision/cloud-init.js CHANGED
@@ -10,7 +10,7 @@ const DEFAULT_KUBO_VERSION = 'v0.38.1';
10
10
  * the same agent. Overridable per-box via {@link ProvisionInput.pinnaceVersion}.
11
11
  * `pinnace@0.1.0` is the first published release (npm, public, OIDC provenance).
12
12
  */
13
- const DEFAULT_PINNACE_VERSION = '0.3.2';
13
+ const DEFAULT_PINNACE_VERSION = '0.3.4';
14
14
  /**
15
15
  * The pinned Node.js major the box installs via NodeSource (`setup_<this>.x`).
16
16
  * Node 22 is a current active LTS; Node 20 (the old literal) is the OLDEST LTS
@@ -220,6 +220,15 @@ write_files:
220
220
  set -euo pipefail
221
221
  source /etc/pinnace-node.env
222
222
 
223
+ # cloud-init runs runcmd with NO HOME in the environment, and the ipfs
224
+ # binary REFUSES to run without it (Error: HOME is not defined) because it
225
+ # resolves HOME/.config/ipfs for the nopfs denylists. Under set -e that
226
+ # aborts this script at the very first ipfs call (ipfs --version), before
227
+ # the user/datadir/repo are set up, leaving the box crash-looping. Set a
228
+ # default for the whole script; the per-user calls below override it with
229
+ # the ipfs user home.
230
+ export HOME="\${HOME:-/root}"
231
+
223
232
  ARCH="$(dpkg --print-architecture)" # amd64 / arm64
224
233
  TARBALL="kubo_\${KUBO_VERSION}_linux-\${ARCH}.tar.gz"
225
234
  URL="https://dist.ipfs.tech/kubo/\${KUBO_VERSION}/\${TARBALL}"
@@ -236,12 +245,19 @@ write_files:
236
245
  install -d -o ipfs -g ipfs /var/lib/ipfs
237
246
 
238
247
  export IPFS_PATH=/var/lib/ipfs/.ipfs
248
+ # HOME must be passed to every sudo -u ipfs invocation: sudo does not
249
+ # inherit it, and the ipfs binary aborts (Error: HOME is not defined) since
250
+ # it resolves HOME/.config/ipfs for the nopfs denylists. Without this,
251
+ # ipfs init fails under set -e and aborts this whole script before the
252
+ # datadir/config are set up (the box then crash-loops). Point it at the
253
+ # ipfs user home (the datadir root).
254
+ IPFS_HOME=/var/lib/ipfs
239
255
  if [ ! -f "$IPFS_PATH/config" ]; then
240
256
  # 'server' profile disables local-network announce (good for a datacenter box)
241
- sudo -u ipfs env IPFS_PATH="$IPFS_PATH" ipfs init --profile server
257
+ sudo -u ipfs env IPFS_PATH="$IPFS_PATH" HOME="$IPFS_HOME" ipfs init --profile server
242
258
  fi
243
259
 
244
- cfg() { sudo -u ipfs env IPFS_PATH="$IPFS_PATH" ipfs config "$@"; }
260
+ cfg() { sudo -u ipfs env IPFS_PATH="$IPFS_PATH" HOME="$IPFS_HOME" ipfs config "$@"; }
245
261
 
246
262
  # --- Reachability: bind API + gateway to localhost only (NEVER public) ---
247
263
  cfg Addresses.API "/ip4/127.0.0.1/tcp/5001"
@@ -297,12 +313,14 @@ write_files:
297
313
  # dies at startup with "denylists: permission denied". Setting HOME here
298
314
  # keeps that lookup inside the writable datadir.
299
315
  Environment=HOME=/var/lib/ipfs
300
- # Guarantee the datadir exists (owned by ipfs) BEFORE the sandboxed daemon
301
- # starts: ReadWritePaths=/var/lib/ipfs requires the path to exist at unit
302
- # start, so a missing datadir otherwise fails namespace setup with
303
- # 226/NAMESPACE and crash-loops. The leading '+' runs this as root, outside
304
- # the sandbox; it is idempotent.
305
- ExecStartPre=+/usr/bin/install -d -o ipfs -g ipfs /var/lib/ipfs
316
+ # NOTE: the datadir /var/lib/ipfs is created by a runcmd step BEFORE this
317
+ # unit is enabled (see runcmd) — NOT via ExecStartPre. ReadWritePaths=
318
+ # /var/lib/ipfs makes systemd set up the mount namespace (referencing that
319
+ # path) BEFORE running any Exec* line, including ExecStartPre — even an
320
+ # ExecStartPre=+ one — so if the path is missing, namespace setup fails
321
+ # with 226/NAMESPACE and the ExecStartPre can never create it (a catch-22).
322
+ # The path must therefore exist before the unit starts, guaranteed outside
323
+ # the unit.
306
324
  ExecStart=/usr/local/bin/ipfs daemon --migrate=true --enable-gc
307
325
  Restart=on-failure
308
326
  RestartSec=5
@@ -404,7 +422,14 @@ runcmd:
404
422
  - ufw allow 443/tcp
405
423
  - ufw --force enable
406
424
 
407
- # Install + start Kubo
425
+ # Install + start Kubo.
426
+ # Create the datadir FIRST, unconditionally, before anything that needs it.
427
+ # This MUST happen outside the ipfs.service unit: that unit's
428
+ # ReadWritePaths=/var/lib/ipfs makes systemd fail namespace setup
429
+ # (226/NAMESPACE) if the path is missing, before any ExecStartPre could create
430
+ # it. And it must not depend on ipfs-setup.sh reaching its own mkdir (that
431
+ # script can abort early). So we guarantee it here, first.
432
+ - install -d -o ipfs -g ipfs /var/lib/ipfs
408
433
  - /usr/local/sbin/ipfs-setup.sh
409
434
  - systemctl daemon-reload
410
435
  - systemctl enable --now ipfs.service
package/dist/provision/cloud-init.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"cloud-init.js","sourceRoot":"","sources":["../../src/provision/cloud-init.ts"],"names":[],"mappings":"AA6DA,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAwB,CAAC,SAAS,CAAC,CAAC;AA8F/D,qEAAqE;AACrE,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,OAAO,CAAC;AACxC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,MAAM,gBAAgB,GAAsB;IAC3C,+BAA+B;IAC/B,iCAAiC;IACjC,4BAA4B;CAC5B,CAAC;AAmBF;;;;;GAKG;AACH,MAAM,MAAM,GAAyB;IACpC;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,kDAAkD;QAC/D,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,IAAI;KACrB;IACD;QACC,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,8CAA8C;QAC3D,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,IAAI;KACrB;IACD;QACC,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,8CAA8C;QAC3D,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,OAAO;KACxB;IACD;QACC,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,uDAAuD;QACpE,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,OAAO;KACxB;CACD,CAAC;AAEF,qEAAqE;AACrE,SAAS,gBAAgB,CAAC,CAAY;IACrC,OAAO,yCAAyC,CAAC,CAAC,IAAI;;;;;oBAKnC,CAAC,CAAC,WAAW;;;;;;;;;8CASa,CAAC,CAAC,IAAI;;wCAEZ,CAAC,CAAC,IAAI;;;;;0CAKJ,CAAC,CAAC,IAAI;;;kBAG9B,CAAC,CAAC,SAAS;wBACL,CAAC,CAAC,eAAe;;;;;CAKxC,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,KAAqB;IACpD,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC;IACpD,MAAM,WAAW,GAChB,KAAK,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5E,MAAM,iBAAiB,GACtB,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACpD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC9D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACrD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAExC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,CAAC,CAAC,IAAI,QAAQ,CAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO;;IAEJ,KAAK,CAAC,IAAI;;4CAE8B,KAAK,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAmDlC,KAAK,CAAC,SAAS;qBACd,eAAe;0BACV,WAAW;oBACjB,KAAK,CAAC,SAAS;0BACT,KAAK,CAAC,WAAW;;;;;uBAKpB,YAAY;;;mBAGhB,QAAQ;;;;;;;;;;;;;;;;;;;;mBAoBR,KAAK,CAAC,IAAI;;;4BAGD,iBAAiB;;sBAEvB,WAAW;;;;;oBAKb,SAAS;yBACJ,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8KrC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2CV,YAAY;;;;;;;;;;;CAWb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAiB;IAChD,IAAI,EAAE,SAAS;IACf,SAAS,CAAC,KAAqB;QAC9B,OAAO;YACN,IAAI,EAAE,SAAS;YACf,SAAS,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,sBAAsB,CAAC,KAAK,CAAC;aACvC;SACD,CAAC;IACH,CAAC;CACD,CAAC;AAEF,uEAAuE;AACvE,MAAM,SAAS,GAAmC;IACjD,OAAO,EAAE,mBAAmB;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACd,qBAAqB,KAAK,CAAC,IAAI,yBAAyB,cAAc,CAAC,IAAI,CAC1E,IAAI,CACJ,kEAAkE,CACnE,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC"}
1
+ {"version":3,"file":"cloud-init.js","sourceRoot":"","sources":["../../src/provision/cloud-init.ts"],"names":[],"mappings":"AA6DA,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAwB,CAAC,SAAS,CAAC,CAAC;AA8F/D,qEAAqE;AACrE,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,OAAO,CAAC;AACxC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,MAAM,gBAAgB,GAAsB;IAC3C,+BAA+B;IAC/B,iCAAiC;IACjC,4BAA4B;CAC5B,CAAC;AAmBF;;;;;GAKG;AACH,MAAM,MAAM,GAAyB;IACpC;QACC,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,kDAAkD;QAC/D,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,IAAI;KACrB;IACD;QACC,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,8CAA8C;QAC3D,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,IAAI;KACrB;IACD;QACC,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,8CAA8C;QAC3D,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,OAAO;KACxB;IACD;QACC,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,uDAAuD;QACpE,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,OAAO;KACxB;CACD,CAAC;AAEF,qEAAqE;AACrE,SAAS,gBAAgB,CAAC,CAAY;IACrC,OAAO,yCAAyC,CAAC,CAAC,IAAI;;;;;oBAKnC,CAAC,CAAC,WAAW;;;;;;;;;8CASa,CAAC,CAAC,IAAI;;wCAEZ,CAAC,CAAC,IAAI;;;;;0CAKJ,CAAC,CAAC,IAAI;;;kBAG9B,CAAC,CAAC,SAAS;wBACL,CAAC,CAAC,eAAe;;;;;CAKxC,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,KAAqB;IACpD,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC;IACpD,MAAM,WAAW,GAChB,KAAK,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5E,MAAM,iBAAiB,GACtB,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACpD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC9D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACrD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAExC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,CAAC,CAAC,IAAI,QAAQ,CAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO;;IAEJ,KAAK,CAAC,IAAI;;4CAE8B,KAAK,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAmDlC,KAAK,CAAC,SAAS;qBACd,eAAe;0BACV,WAAW;oBACjB,KAAK,CAAC,SAAS;0BACT,KAAK,CAAC,WAAW;;;;;uBAKpB,YAAY;;;mBAGhB,QAAQ;;;;;;;;;;;;;;;;;;;;mBAoBR,KAAK,CAAC,IAAI;;;4BAGD,iBAAiB;;sBAEvB,WAAW;;;;;oBAKb,SAAS;yBACJ,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgMrC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkDV,YAAY;;;;;;;;;;;CAWb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAiB;IAChD,IAAI,EAAE,SAAS;IACf,SAAS,CAAC,KAAqB;QAC9B,OAAO;YACN,IAAI,EAAE,SAAS;YACf,SAAS,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,sBAAsB,CAAC,KAAK,CAAC;aACvC;SACD,CAAC;IACH,CAAC;CACD,CAAC;AAEF,uEAAuE;AACvE,MAAM,SAAS,GAAmC;IACjD,OAAO,EAAE,mBAAmB;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACd,qBAAqB,KAAK,CAAC,IAAI,yBAAyB,cAAc,CAAC,IAAI,CAC1E,IAAI,CACJ,kEAAkE,CACnE,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "pinnace",
3
- "version": "0.3.2",
3
+ "version": "0.3.4",
4
4
  "license": "AGPL-3.0-only",
5
5
  "description": "Self-host a static website on IPFS across one or more self-owned Kubo nodes.",
6
6
  "repository": {
package/src/provision/cloud-init.ts CHANGED
@@ -164,7 +164,7 @@ const DEFAULT_KUBO_VERSION = 'v0.38.1';
164
164
  * the same agent. Overridable per-box via {@link ProvisionInput.pinnaceVersion}.
165
165
  * `pinnace@0.1.0` is the first published release (npm, public, OIDC provenance).
166
166
  */
167
- const DEFAULT_PINNACE_VERSION = '0.3.2';
167
+ const DEFAULT_PINNACE_VERSION = '0.3.4';
168
168
  /**
169
169
  * The pinned Node.js major the box installs via NodeSource (`setup_<this>.x`).
170
170
  * Node 22 is a current active LTS; Node 20 (the old literal) is the OLDEST LTS
@@ -400,6 +400,15 @@ write_files:
400
400
  set -euo pipefail
401
401
  source /etc/pinnace-node.env
402
402
 
403
+ # cloud-init runs runcmd with NO HOME in the environment, and the ipfs
404
+ # binary REFUSES to run without it (Error: HOME is not defined) because it
405
+ # resolves HOME/.config/ipfs for the nopfs denylists. Under set -e that
406
+ # aborts this script at the very first ipfs call (ipfs --version), before
407
+ # the user/datadir/repo are set up, leaving the box crash-looping. Set a
408
+ # default for the whole script; the per-user calls below override it with
409
+ # the ipfs user home.
410
+ export HOME="\${HOME:-/root}"
411
+
403
412
  ARCH="$(dpkg --print-architecture)" # amd64 / arm64
404
413
  TARBALL="kubo_\${KUBO_VERSION}_linux-\${ARCH}.tar.gz"
405
414
  URL="https://dist.ipfs.tech/kubo/\${KUBO_VERSION}/\${TARBALL}"
@@ -416,12 +425,19 @@ write_files:
416
425
  install -d -o ipfs -g ipfs /var/lib/ipfs
417
426
 
418
427
  export IPFS_PATH=/var/lib/ipfs/.ipfs
428
+ # HOME must be passed to every sudo -u ipfs invocation: sudo does not
429
+ # inherit it, and the ipfs binary aborts (Error: HOME is not defined) since
430
+ # it resolves HOME/.config/ipfs for the nopfs denylists. Without this,
431
+ # ipfs init fails under set -e and aborts this whole script before the
432
+ # datadir/config are set up (the box then crash-loops). Point it at the
433
+ # ipfs user home (the datadir root).
434
+ IPFS_HOME=/var/lib/ipfs
419
435
  if [ ! -f "$IPFS_PATH/config" ]; then
420
436
  # 'server' profile disables local-network announce (good for a datacenter box)
421
- sudo -u ipfs env IPFS_PATH="$IPFS_PATH" ipfs init --profile server
437
+ sudo -u ipfs env IPFS_PATH="$IPFS_PATH" HOME="$IPFS_HOME" ipfs init --profile server
422
438
  fi
423
439
 
424
- cfg() { sudo -u ipfs env IPFS_PATH="$IPFS_PATH" ipfs config "$@"; }
440
+ cfg() { sudo -u ipfs env IPFS_PATH="$IPFS_PATH" HOME="$IPFS_HOME" ipfs config "$@"; }
425
441
 
426
442
  # --- Reachability: bind API + gateway to localhost only (NEVER public) ---
427
443
  cfg Addresses.API "/ip4/127.0.0.1/tcp/5001"
@@ -477,12 +493,14 @@ write_files:
477
493
  # dies at startup with "denylists: permission denied". Setting HOME here
478
494
  # keeps that lookup inside the writable datadir.
479
495
  Environment=HOME=/var/lib/ipfs
480
- # Guarantee the datadir exists (owned by ipfs) BEFORE the sandboxed daemon
481
- # starts: ReadWritePaths=/var/lib/ipfs requires the path to exist at unit
482
- # start, so a missing datadir otherwise fails namespace setup with
483
- # 226/NAMESPACE and crash-loops. The leading '+' runs this as root, outside
484
- # the sandbox; it is idempotent.
485
- ExecStartPre=+/usr/bin/install -d -o ipfs -g ipfs /var/lib/ipfs
496
+ # NOTE: the datadir /var/lib/ipfs is created by a runcmd step BEFORE this
497
+ # unit is enabled (see runcmd) — NOT via ExecStartPre. ReadWritePaths=
498
+ # /var/lib/ipfs makes systemd set up the mount namespace (referencing that
499
+ # path) BEFORE running any Exec* line, including ExecStartPre — even an
500
+ # ExecStartPre=+ one — so if the path is missing, namespace setup fails
501
+ # with 226/NAMESPACE and the ExecStartPre can never create it (a catch-22).
502
+ # The path must therefore exist before the unit starts, guaranteed outside
503
+ # the unit.
486
504
  ExecStart=/usr/local/bin/ipfs daemon --migrate=true --enable-gc
487
505
  Restart=on-failure
488
506
  RestartSec=5
@@ -584,7 +602,14 @@ runcmd:
584
602
  - ufw allow 443/tcp
585
603
  - ufw --force enable
586
604
 
587
- # Install + start Kubo
605
+ # Install + start Kubo.
606
+ # Create the datadir FIRST, unconditionally, before anything that needs it.
607
+ # This MUST happen outside the ipfs.service unit: that unit's
608
+ # ReadWritePaths=/var/lib/ipfs makes systemd fail namespace setup
609
+ # (226/NAMESPACE) if the path is missing, before any ExecStartPre could create
610
+ # it. And it must not depend on ipfs-setup.sh reaching its own mkdir (that
611
+ # script can abort early). So we guarantee it here, first.
612
+ - install -d -o ipfs -g ipfs /var/lib/ipfs
588
613
  - /usr/local/sbin/ipfs-setup.sh
589
614
  - systemctl daemon-reload
590
615
  - systemctl enable --now ipfs.service