sirius/osint-dashboard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: push images to Forgejo over loopback, not Cloudflare
All checks were successful
build-and-deploy / build-push-deploy (push) Successful in 4m42s
Details

Browse source 
GITHUB_TOKEN cannot write packages (401). PAT works, but layers
over https://forgejo.siriusdevops.com 413 at Cloudflare's ~100MB
POST cap. Push 127.0.0.1:3000; pull names stay public.
This commit is contained in:
sirius 2026-08-28 00:17:52 -04:00
parent 6e4209e745
commit 8978324d33
1 changed files with 25 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
.forgejo/workflows/build.yml
View file

@ -1,14 +1,16 @@
# Build all OSINT images, publish to the Forgejo container registry, then # Build all OSINT images, publish to the Forgejo container registry, then
# redeploy on the Pi runner (docker.sock mounted). # redeploy on the Pi runner (docker.sock mounted).
# #
# Registry: forgejo.siriusdevops.com (NOT ghcr.io) # Public pull host: forgejo.siriusdevops.com (NOT ghcr.io)
# Images: # CI push host: 127.0.0.1:3000 — Cloudflare 413s layers ≳100MB on the public
# hostname, even from the Pi (hairpins out through the tunnel).
# Images (public names):
# forgejo.siriusdevops.com/sirius/osint-dashboard # forgejo.siriusdevops.com/sirius/osint-dashboard
# forgejo.siriusdevops.com/sirius/osint-dashboard-pg # forgejo.siriusdevops.com/sirius/osint-dashboard-pg
# forgejo.siriusdevops.com/sirius/osint-news-scraper # forgejo.siriusdevops.com/sirius/osint-news-scraper
# forgejo.siriusdevops.com/sirius/osint-news-summarizer # forgejo.siriusdevops.com/sirius/osint-news-summarizer
# #
# Optional repo variable FORGEJO_REGISTRY overrides the host (default below). # Optional repo variable FORGEJO_REGISTRY overrides the *public* pull host.
# Deploy still uses the local docker socket on the runner host (rpi). # Deploy still uses the local docker socket on the runner host (rpi).
name: build-and-deploy name: build-and-deploy
@ -19,8 +21,8 @@ on:
workflow_dispatch: workflow_dispatch:
env: env:
# Hostname only — Forgejo packages registry PUBLIC_REGISTRY: ${{ vars.FORGEJO_REGISTRY || 'forgejo.siriusdevops.com' }}
REGISTRY: ${{ vars.FORGEJO_REGISTRY || 'forgejo.siriusdevops.com' }} PUSH_REGISTRY: 127.0.0.1:3000
OWNER: sirius OWNER: sirius
# Keep compose project/volumes stable on the Pi # Keep compose project/volumes stable on the Pi
COMPOSE_PROJECT_NAME: osint-dashboard COMPOSE_PROJECT_NAME: osint-dashboard
@ -39,18 +41,21 @@ jobs:
id: img id: img
run: | run: |
set -euo pipefail set -euo pipefail
REG="${REGISTRY}" PUSH="${PUSH_REGISTRY}"
PUB="${PUBLIC_REGISTRY}"
OWN="${OWNER}" OWN="${OWNER}"
SHA="${GITHUB_SHA::12}" SHA="${GITHUB_SHA::12}"
{ {
echo "reg=$REG" echo "reg=$PUSH"
echo "pub=$PUB"
echo "sha=$SHA" echo "sha=$SHA"
echo "app=$REG/$OWN/osint-dashboard" echo "app=$PUSH/$OWN/osint-dashboard"
echo "pg=$REG/$OWN/osint-dashboard-pg" echo "pg=$PUSH/$OWN/osint-dashboard-pg"
echo "scraper=$REG/$OWN/osint-news-scraper" echo "scraper=$PUSH/$OWN/osint-news-scraper"
echo "summarizer=$REG/$OWN/osint-news-summarizer" echo "summarizer=$PUSH/$OWN/osint-news-summarizer"
} >> "$GITHUB_OUTPUT" } >> "$GITHUB_OUTPUT"
echo "Registry: $REG" echo "Push registry: $PUSH"
echo "Public pull: $PUB"
echo "SHA tag: $SHA" echo "SHA tag: $SHA"
- name: Login to Forgejo registry - name: Login to Forgejo registry
@ -125,10 +130,12 @@ jobs:
# Compose file still uses localhost/* for stable local names; we mirror # Compose file still uses localhost/* for stable local names; we mirror
# registry tags so a cold host can recover via docker pull. # registry tags so a cold host can recover via docker pull.
REG="${{ steps.img.outputs.reg }}" REG="${{ steps.img.outputs.reg }}"
PUB="${{ steps.img.outputs.pub }}"
OWN="${{ env.OWNER }}" OWN="${{ env.OWNER }}"
for name in osint-dashboard osint-dashboard-pg osint-news-scraper osint-news-summarizer; do for name in osint-dashboard osint-dashboard-pg osint-news-scraper osint-news-summarizer; do
docker pull "${REG}/${OWN}/${name}:latest" || true docker pull "${REG}/${OWN}/${name}:latest" || true
docker tag "${REG}/${OWN}/${name}:latest" "localhost/${name}:latest" || true docker tag "${REG}/${OWN}/${name}:latest" "localhost/${name}:latest" || true
docker tag "${REG}/${OWN}/${name}:latest" "${PUB}/${OWN}/${name}:latest" || true
done done
# Do NOT set COMPOSE_PROJECT_NAME differently — volumes must stay # Do NOT set COMPOSE_PROJECT_NAME differently — volumes must stay
# osint-dashboard_osint-pgdata (pinned by `name:` in compose). # osint-dashboard_osint-pgdata (pinned by `name:` in compose).
@ -136,15 +143,16 @@ jobs:
docker compose build app ingester camera-service news-scraper news-summarizer docker compose build app ingester camera-service news-scraper news-summarizer
docker compose up -d --force-recreate docker compose up -d --force-recreate
docker image prune -f docker image prune -f
echo "osint-dashboard deployed; images also on ${REG}/${OWN}/" echo "osint-dashboard deployed; images also on ${PUB}/${OWN}/"
- name: Summary - name: Summary
if: always() if: always()
run: | run: |
{ {
echo "## Forgejo registry images" echo "## Forgejo registry images"
echo "- \`${{ steps.img.outputs.app }}:latest\`" echo "Pushed via ${{ steps.img.outputs.reg }} (loopback). Pull publicly:"
echo "- \`${{ steps.img.outputs.pg }}:latest\`" echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-dashboard:latest\`"
echo "- \`${{ steps.img.outputs.scraper }}:latest\`" echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-dashboard-pg:latest\`"
echo "- \`${{ steps.img.outputs.summarizer }}:latest\`" echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-news-scraper:latest\`"
echo "- \`${{ steps.img.outputs.pub }}/sirius/osint-news-summarizer:latest\`"
} >> "$GITHUB_STEP_SUMMARY" } >> "$GITHUB_STEP_SUMMARY"