sirius/osint-dashboard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: push images to Forgejo over loopback, not Cloudflare
All checks were successful
build-and-deploy / build-push-deploy (push) Successful in 4m42s
Details

Browse source 
GITHUB_TOKEN cannot write packages (401). PAT works, but layers
over https://forgejo.siriusdevops.com 413 at Cloudflare's ~100MB
POST cap. Push 127.0.0.1:3000; pull names stay public.
This commit is contained in:
sirius 2026-08-28 00:17:52 -04:00
parent 6e4209e745
commit 8978324d33
1 changed files with 25 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
.forgejo/workflows/build.yml
View file

@ -1,14 +1,16 @@
# Build all OSINT images, publish to the Forgejo container registry, then
# redeploy on the Pi runner (docker.sock mounted).
#
# Registry: forgejo.siriusdevops.com (NOT ghcr.io)
# Images:
# Public pull host: forgejo.siriusdevops.com (NOT ghcr.io)
# CI push host: 127.0.0.1:3000 — Cloudflare 413s layers ≳100MB on the public
# hostname, even from the Pi (hairpins out through the tunnel).
# Images (public names):
# forgejo.siriusdevops.com/sirius/osint-dashboard
# forgejo.siriusdevops.com/sirius/osint-dashboard-pg
# forgejo.siriusdevops.com/sirius/osint-news-scraper
# forgejo.siriusdevops.com/sirius/osint-news-summarizer
#
# Optional repo variable FORGEJO_REGISTRY overrides the host (default below).
# Optional repo variable FORGEJO_REGISTRY overrides the *public* pull host.
# Deploy still uses the local docker socket on the runner host (rpi).
name: build-and-deploy
@ -19,8 +21,8 @@ on:
workflow_dispatch:
env:
# Hostname only — Forgejo packages registry
REGISTRY: ${{ vars.FORGEJO_REGISTRY || 'forgejo.siriusdevops.com' }}
PUBLIC_REGISTRY: ${{ vars.FORGEJO_REGISTRY || 'forgejo.siriusdevops.com' }}
PUSH_REGISTRY: 127.0.0.1:3000
OWNER: sirius
# Keep compose project/volumes stable on the Pi
COMPOSE_PROJECT_NAME: osint-dashboard
@ -39,18 +41,21 @@ jobs:
id: img
run: |
set -euo pipefail
REG="${REGISTRY}"
PUSH="${PUSH_REGISTRY}"
PUB="${PUBLIC_REGISTRY}"
OWN="${OWNER}"
SHA="${GITHUB_SHA::12}"
{
echo "reg=$REG"
echo "reg=$PUSH"
echo "pub=$PUB"
echo "sha=$SHA"
echo "app=$REG/$OWN/osint-dashboard"
echo "pg=$REG/$OWN/osint-dashboard-pg"
echo "scraper=$REG/$OWN/osint-news-scraper"
echo "summarizer=$REG/$OWN/osint-news-summarizer"
echo "app=$PUSH/$OWN/osint-dashboard"
echo "pg=$PUSH/$OWN/osint-dashboard-pg"
echo "scraper=$PUSH/$OWN/osint-news-scraper"
echo "summarizer=$PUSH/$OWN/osint-news-summarizer"
} >> "$GITHUB_OUTPUT"
echo "Registry: $REG"
echo "Push registry: $PUSH"
echo "Public pull: $PUB"
echo "SHA tag: $SHA"
- name: Login to Forgejo registry
@ -125,10 +130,12 @@ jobs:
# Compose file still uses localhost/* for stable local names; we mirror
# registry tags so a cold host can recover via docker pull.
REG="${{ steps.img.outputs.reg }}"
PUB="${{ steps.img.outputs.pub }}"
OWN="${{ env.OWNER }}"
for name in osint-dashboard osint-dashboard-pg osint-news-scraper osint-news-summarizer; do
docker pull "${REG}/${OWN}/${name}:latest" || true
docker tag "${REG}/${OWN}/${name}:latest" "localhost/${name}:latest" || true
docker tag "${REG}/${OWN}/${name}:latest" "${PUB}/${OWN}/${name}:latest" || true
done
# Do NOT set COMPOSE_PROJECT_NAME differently — volumes must stay
# osint-dashboard_osint-pgdata (pinned by `name:` in compose).
@ -136,15 +143,16 @@ jobs:
docker compose build app ingester camera-service news-scraper news-summarizer
docker compose up -d --force-recreate
docker image prune -f
echo "osint-dashboard deployed; images also on ${REG}/${OWN}/"
echo "osint-dashboard deployed; images also on ${PUB}/${OWN}/"
- name: Summary
if: always()
run: |
{
echo "## Forgejo registry images"
echo "- \`${{ steps.img.outputs.app }}:latest\`"
echo "- \`${{ steps.img.outputs.pg }}:latest\`"
echo "- \`${{ steps.img.outputs.scraper }}:latest\`"
echo "- \`${{ steps.img.outputs.summarizer }}:latest\`"
echo "Pushed via ${{ steps.img.outputs.reg }} (loopback). Pull publicly:"
echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-dashboard:latest\`"
echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-dashboard-pg:latest\`"
echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-news-scraper:latest\`"
echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-news-summarizer:latest\`"
} >> "$GITHUB_STEP_SUMMARY"