Repository navigation
Conversation
A static token whose secret comes from token_env was rejected by serde because the literal token field was mandatory, so the documented token_env-only shape failed to load. Default token to an empty string; validate still requires token or token_env, and resolve_tokens still drops empty secrets. Add a regression test.
Add one Dockerfile for both services: the default bakes deploy/host.toml for WAL-Git, while WAL-Github selects deploy/walgithub.toml and port 8097 through build args. deploy/compose.yaml runs exactly those two services against an object store supplied by the operator; it starts no S3 backend. The optional rustfs dev store moves to deploy/compose.rustfs.yaml as a separate Compose project. Both services run with a read-only root filesystem, tmpfs /tmp and a disposable cache volume, and docs/HOSTING.md documents auth, TLS, roles, upgrades and the two-service split. Update README, AGENTS, CONTRACT, CI, justfile and the site; replace Containerfile with Dockerfile.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Package the WAL deployment as a Docker Compose stack with exactly two services:
:8080) — token/OIDC auth,serve + maintain:8097) — the GHES facade, auth-free and loopback-only,serve + eventsOne
Dockerfilebuilds both images: the default bakesdeploy/host.toml; WAL-Github selectsdeploy/walgithub.tomland port 8097 through build args.deploy/compose.yamlstarts no S3 backend — operators point both services at their own bucket viadeploy/walgit.env.example. The optional rustfs dev store is a separate Compose project (deploy/compose.rustfs.yaml).Both services run with a read-only root filesystem, a tmpfs
/tmp, a disposable cache volume, JSON log rotation and a 60s stop grace period for the D31 drain.Also
docs/HOSTING.md: build, auth, TLS, cache/rootfs, the two-service split, upgrades, troubleshooting.token_env-only static tokens:StaticToken.tokennow defaults to empty, so the documented{ principal = "admin", token_env = "WALGIT_TOKEN" }shape loads; validation still requires one oftoken/token_env. Regression test included.Containerfile→Dockerfile; CI validates the two-service Compose file and keeps the facade smoke image.Tested locally
OrbStack / Docker 29.8.2:
docker compose -f deploy/compose.yaml up -d --build: both services healthy./api/v3/repos/..., clone, create/delete ref.down -v: repo re-seeded through WAL-Git and visible through both services.cargo test -p walgit-config: 13 passed.