4b0e44fc6c
The tx1138 Gitea was retired as a release server 2026-06-13 and its registry frontend is fully dead (500 on every /v2 manifest read, observed 2026-07-10). Nothing may reference it anymore: - registry.rs: no longer a default registry, no longer force-enabled on load; saved configs are stripped of it on load (same one-time migration treatment as the decommissioned Hetzner mirror), with a regression test. - image_policy.rs: removed from TRUSTED_REGISTRIES — refs through the dead host are now refused at the pull site (rejection test added). - api/handler: dropped the legacy catalog-proxy fallback URL. - .gitmodules: indeedhub submodule repointed to the OVH Gitea. - scripts, image-recipe, app-catalog data, neode-ui strings, docs, and all test fixtures repointed to 146.59.87.168:3000 (or neutral example hosts). - image-versions.sh: ARCHY_REGISTRY_FALLBACK emptied (guarded consumers skip it); reconcile-containers.sh candidate guard hardened. The only remaining occurrences of the host string are the strip/reject enforcement paths and their regression tests — the code that guarantees it is never used again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
79 lines
2.5 KiB
Bash
Executable File
79 lines
2.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Podman Installation and Configuration Script for Archipelago
|
|
# Configures Podman for rootless operation
|
|
|
|
set -e
|
|
|
|
echo "🐳 Configuring Podman for rootless operation..."
|
|
|
|
if ! command -v catatonit >/dev/null 2>&1; then
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
apt-get update || true
|
|
apt-get install -y catatonit || true
|
|
elif command -v dnf >/dev/null 2>&1; then
|
|
dnf install -y catatonit || true
|
|
elif command -v apk >/dev/null 2>&1; then
|
|
apk add catatonit || true
|
|
fi
|
|
fi
|
|
|
|
command -v catatonit >/dev/null 2>&1 || echo "WARNING: catatonit not installed; Podman init-enabled containers may fail"
|
|
|
|
# Ensure archipelago user exists
|
|
if ! id "archipelago" &>/dev/null; then
|
|
echo "Creating archipelago user..."
|
|
adduser -D -s /bin/bash archipelago
|
|
fi
|
|
|
|
# Create Podman configuration directories
|
|
mkdir -p /home/archipelago/.config/containers
|
|
mkdir -p /home/archipelago/.local/share/containers/storage
|
|
|
|
# Configure storage
|
|
cat > /home/archipelago/.config/containers/storage.conf <<EOF
|
|
[storage]
|
|
driver = "overlay"
|
|
runroot = "/run/user/$(id -u archipelago)/containers"
|
|
graphroot = "/home/archipelago/.local/share/containers/storage"
|
|
EOF
|
|
|
|
# Configure registries (use Docker Hub and quay.io)
|
|
mkdir -p /home/archipelago/.config/containers/registries.conf.d
|
|
cat > /home/archipelago/.config/containers/registries.conf <<EOF
|
|
unqualified-search-registries = ["docker.io", "ghcr.io", "quay.io", "146.59.87.168:3000"]
|
|
|
|
[[registry]]
|
|
location = "146.59.87.168:3000"
|
|
insecure = true
|
|
EOF
|
|
|
|
# Set up subuid and subgid for rootless containers
|
|
if ! grep -q "^archipelago:" /etc/subuid; then
|
|
echo "archipelago:100000:65536" >> /etc/subuid
|
|
fi
|
|
|
|
if ! grep -q "^archipelago:" /etc/subgid; then
|
|
echo "archipelago:100000:65536" >> /etc/subgid
|
|
fi
|
|
|
|
# Create systemd user service directory
|
|
mkdir -p /home/archipelago/.config/systemd/user
|
|
|
|
# Enable lingering for archipelago user (allows user services to run without login)
|
|
loginctl enable-linger archipelago || true
|
|
|
|
# Ensure /run/user/1000 exists for podman socket
|
|
mkdir -p /run/user/1000
|
|
chown archipelago:archipelago /run/user/1000
|
|
chmod 700 /run/user/1000
|
|
|
|
# Enable podman API socket for archipelago user (backend connects via this)
|
|
su - archipelago -c "XDG_RUNTIME_DIR=/run/user/1000 systemctl --user enable podman.socket" || true
|
|
su - archipelago -c "XDG_RUNTIME_DIR=/run/user/1000 systemctl --user start podman.socket" || true
|
|
|
|
# Set proper permissions
|
|
chown -R archipelago:archipelago /home/archipelago/.config
|
|
chown -R archipelago:archipelago /home/archipelago/.local
|
|
|
|
echo "✅ Podman configuration complete!"
|