vh
786462ac9c
Deployed on corviduo-dev, co-located with the worldtree-personal muninn
watcher. ingestion_root=/data/state/ingestion (shared state volume, byte-
identical to the watcher); runs as uid 1000 to write the queue; staging
bound :ro at the ratified /mnt/muninn-staging/mimir-inbox (local placeholder
until the shared mount + mimir-inbox writer land). Boot verified: /ping
{"service":"ok"}, /health watcher.running=true (byte-identity proven).
Image built out-of-band with the Gitea read token as a BuildKit secret.
Real config (bearer keys) lives on-server at /opt/docker/conf 0600.
28 lines
1.1 KiB
Docker
28 lines
1.1 KiB
Docker
# muninn-gate — WG-internal HTTP front door for the Muninn ingestion queue (#377).
|
|
# No Dockerfile in the upstream repo (vh/muninn-gate); this is infra-ops's.
|
|
# muninn-dispatch==0.1.4 comes from the internal Gitea PyPI index "gitea";
|
|
# the read token is passed as a BuildKit secret (never baked into a layer).
|
|
#
|
|
# DOCKER_BUILDKIT=1 docker build \
|
|
# --secret id=gitea_pw,src=<read-token-file> \
|
|
# -t muninn-gate:0.0.14 .
|
|
FROM python:3.11-slim
|
|
|
|
RUN pip install --no-cache-dir uv==0.11.* \
|
|
&& useradd --system --uid 10014 --create-home --home-dir /home/gate gate
|
|
|
|
WORKDIR /app
|
|
COPY pyproject.toml README.md uv.lock ./
|
|
COPY src ./src
|
|
|
|
# Install the app + deps. muninn-dispatch resolves only from the "gitea" index
|
|
# (pinned via [tool.uv.sources]); everything else from PyPI.
|
|
RUN --mount=type=secret,id=gitea_pw \
|
|
UV_INDEX_GITEA_USERNAME=vh \
|
|
UV_INDEX_GITEA_PASSWORD="$(cat /run/secrets/gitea_pw)" \
|
|
uv pip install --system --no-cache .
|
|
|
|
# The launcher (compose) owns the bind — no CMD here. The app carries `bind`
|
|
# for observability only; --host/--port passed by compose are authoritative.
|
|
USER gate
|