sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fleet-manager: pull non-CI images through the Harbor mirror

Browse Source 
Route the ad-hoc images I introduced through harbor.bitasylum.org (the standing
rule): backup.sh uses harbor.bitasylum.org/dockerhub/library/alpine:3.20 (via an
overridable ALPINE_IMAGE); the DEPLOY.md volume-chown fix + the goacme/lego prose
use the Harbor paths too. Compose (influxdb/traefik) + Dockerfile bases are already
harbor-mirrored; git.bitasylum.org/audiobuzz/* stays (CI-built).
This commit is contained in:
Audiobuzz
2026-07-05 01:28:06 +00:00
parent 46d54798b7
commit 08847532ee
3 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/fleet-manager/DEPLOY.md
+3 -2
View File
@@ -151,7 +151,8 @@ also keeps the WebAuthn secure-context clean.
> **Self-TLS alternative (no Traefik):** set `FLEET_MGR_ADMIN_BEHIND_PROXY=false`
> and give the manager a cert at `/pki/admin/{fullchain,privkey}.pem` (e.g. via the
> `acme/renew-loop.sh` helper under a `goacme/lego` container). The manager then
> `acme/renew-loop.sh` helper under a `harbor.bitasylum.org/dockerhub/goacme/lego`
> container). The manager then
> terminates TLS itself and the origin includes the port it listens on.
<a name="network-paths"></a>
@@ -251,7 +252,7 @@ If you run compose under a non-default project name, pass
once:
```bash
docker volume ls | grep fleet # find the name, e.g. fleet-manager_fleet-data
docker run --rm -v <vol>:/data alpine chown -R 65532:65532 /data
docker run --rm -v <vol>:/data harbor.bitasylum.org/dockerhub/library/alpine:3.20 chown -R 65532:65532 /data
```
- **`authorise plane not configured (no enrol-broker wired)` in the SPA** — the
manager has the pillar disabled (`s.broker == nil`). Check
serving/fleet-manager/acme/renew-loop.sh
+2 -1
View File
@@ -4,7 +4,8 @@
# NOTE: the default deployment fronts the admin UI with Traefik (docker-compose.yml),
# which owns ACME itself — this script is NOT used then. It remains as the cert
# helper for the SELF-TLS admin mode (FLEET_MGR_ADMIN_BEHIND_PROXY=false, no
# Traefik): run it under a `goacme/lego` container to write ./pki/admin/.
# Traefik): run it under a harbor.bitasylum.org/dockerhub/goacme/lego container to
# write ./pki/admin/.
#
# Runs inside the goacme/lego image (alpine-based). Obtains the fleet-manager
# admin-UI cert from Let's Encrypt via DNS-01 over AWS Route 53, and writes it
serving/fleet-manager/backup.sh
+5 -2
View File
@@ -14,7 +14,8 @@
# COMPOSE_PROJECT_NAME=foo ./backup.sh # if you run compose under another project
#
# Restore (manager stopped):
# docker run --rm -v <project>_fleet-data:/dest -v "$PWD/backups":/src alpine \
# docker run --rm -v <project>_fleet-data:/dest -v "$PWD/backups":/src \
# harbor.bitasylum.org/dockerhub/library/alpine:3.20 \
# sh -c 'rm -rf /dest/* && tar xzf /src/fleet-data-YYYYmmdd-HHMMSS.tar.gz -C /dest'
set -euo pipefail
@@ -22,6 +23,8 @@ DEST=${1:-./backups}
PROJECT=${COMPOSE_PROJECT_NAME:-fleet-manager} # compose derives volume names as <project>_<key>
STAMP=$(date -u +%Y%m%d-%H%M%S)
VOLUMES=${BACKUP_VOLUMES:-"fleet-data influx-data"}
# Non-CI images pull through the Harbor mirror; overridable for other registries.
ALPINE_IMAGE=${ALPINE_IMAGE:-harbor.bitasylum.org/dockerhub/library/alpine:3.20}
mkdir -p "$DEST"
DEST_ABS=$(cd "$DEST" && pwd)
@@ -37,7 +40,7 @@ for key in $VOLUMES; do
docker run --rm \
-v "${vol}:/src:ro" \
-v "${DEST_ABS}:/backup" \
alpine tar czf "/backup/${out}" -C /src .
"$ALPINE_IMAGE" tar czf "/backup/${out}" -C /src .
done
# Retention: keep the newest $KEEP of each volume's tarballs (0 = keep all).