ci: enable PKG_CACHE via a TLS probe that falls back to upstream; host repo tool
- build-push.yaml: Build-and-Push, Build-FPM-Images, Build-Shared-httpd and Build-Shared-OLS probe https://192.168.1.40 and :5000 with the pinned pkg-cache CA (5 s timeouts). When the cache answers they pass PKG_CACHE and configure the BuildKit Docker Hub mirror (ca=). When it doesn't, they build from upstream exactly as before and emit a warning. Fallback measured from the runner bridge: refused <1 s, silent drop 10 s. - scripts/host/pkgcache-host-repos.sh: apply/revert/status for WHP hosts. Each rewritten repo uses baseurl=<cache> <origin> as the real fallback; mirrorlist/metalink stay commented because measured dnf ignores baseurl when they are present. Keeps gpgcheck=1 / repo_gpgcheck=1 and backs up every file. Tested on 192.168.1.148, including cache-down and silent-drop fallback. - docs: runner firewall rule (applied), measured fallback results. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
shadowdaoandClaude Opus 5.5 committed
1 parent
18f65c6d84
commit
2b9e7f302c
3 files changed
+301
-51
No files matched your search
@@ -85,10 +85,40 @@ jobs:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# Internal package cache (CT130 pkg-cache, docs/pkg-cache.md). Used ONLY if
|
||||
# it answers over TLS with our pinned CA; otherwise (down, unreachable,
|
||||
# bad/expired cert) this job builds from the upstream repos and Docker Hub
|
||||
# exactly as before. The repo cache and the registry mirror are probed
|
||||
# separately so either can fail back on its own.
|
||||
- name: Probe package cache
|
||||
id: pkgcache
|
||||
run: |
|
||||
url=""; mirror=""
|
||||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
||||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
||||
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<unreachable: Docker Hub>}"
|
||||
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
||||
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
||||
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
||||
# so the mirror is configured on the builder; BuildKit itself still falls
|
||||
# back to Docker Hub if the mirror stops answering mid-run.
|
||||
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
||||
if: steps.pkgcache.outputs.mirror != ''
|
||||
uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
buildkitd-config-inline: |
|
||||
[registry."docker.io"]
|
||||
mirrors = ["192.168.1.40:5000"]
|
||||
[registry."192.168.1.40:5000"]
|
||||
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
if: steps.pkgcache.outputs.mirror == ''
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
# Per-run cache-bust value. Each job's buildx builder is created fresh by
|
||||
@@ -135,6 +165,7 @@ jobs:
|
||||
build-args: |
|
||||
PHPVER=${{ matrix.phpver }}
|
||||
CACHE_BUST=${{ steps.bust.outputs.value }}
|
||||
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
||||
EXPECT_PHP_MIN=${{ steps.phpmin.outputs.min }}
|
||||
tags: |
|
||||
repo.anhonesthost.net/cloud-hosting-platform/cac:php${{ matrix.phpver }}
|
||||
@@ -152,10 +183,40 @@ jobs:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# Internal package cache (CT130 pkg-cache, docs/pkg-cache.md). Used ONLY if
|
||||
# it answers over TLS with our pinned CA; otherwise (down, unreachable,
|
||||
# bad/expired cert) this job builds from the upstream repos and Docker Hub
|
||||
# exactly as before. The repo cache and the registry mirror are probed
|
||||
# separately so either can fail back on its own.
|
||||
- name: Probe package cache
|
||||
id: pkgcache
|
||||
run: |
|
||||
url=""; mirror=""
|
||||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
||||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
||||
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<unreachable: Docker Hub>}"
|
||||
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
||||
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
||||
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
||||
# so the mirror is configured on the builder; BuildKit itself still falls
|
||||
# back to Docker Hub if the mirror stops answering mid-run.
|
||||
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
||||
if: steps.pkgcache.outputs.mirror != ''
|
||||
uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
buildkitd-config-inline: |
|
||||
[registry."docker.io"]
|
||||
mirrors = ["192.168.1.40:5000"]
|
||||
[registry."192.168.1.40:5000"]
|
||||
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
if: steps.pkgcache.outputs.mirror == ''
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
# Per-run cache-bust value. Each job's buildx builder is created fresh by
|
||||
@@ -203,6 +264,7 @@ jobs:
|
||||
build-args: |
|
||||
PHPVER=${{ matrix.phpver }}
|
||||
CACHE_BUST=${{ steps.bust.outputs.value }}
|
||||
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
||||
EXPECT_PHP_MIN=${{ steps.phpmin.outputs.min }}
|
||||
tags: |
|
||||
repo.anhonesthost.net/cloud-hosting-platform/cac-fpm:php${{ matrix.phpver }}
|
||||
@@ -417,10 +479,40 @@ jobs:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# Internal package cache (CT130 pkg-cache, docs/pkg-cache.md). Used ONLY if
|
||||
# it answers over TLS with our pinned CA; otherwise (down, unreachable,
|
||||
# bad/expired cert) this job builds from the upstream repos and Docker Hub
|
||||
# exactly as before. The repo cache and the registry mirror are probed
|
||||
# separately so either can fail back on its own.
|
||||
- name: Probe package cache
|
||||
id: pkgcache
|
||||
run: |
|
||||
url=""; mirror=""
|
||||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
||||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
||||
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<unreachable: Docker Hub>}"
|
||||
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
||||
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
||||
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
||||
# so the mirror is configured on the builder; BuildKit itself still falls
|
||||
# back to Docker Hub if the mirror stops answering mid-run.
|
||||
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
||||
if: steps.pkgcache.outputs.mirror != ''
|
||||
uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
buildkitd-config-inline: |
|
||||
[registry."docker.io"]
|
||||
mirrors = ["192.168.1.40:5000"]
|
||||
[registry."192.168.1.40:5000"]
|
||||
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
if: steps.pkgcache.outputs.mirror == ''
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Login to Gitea
|
||||
@@ -436,6 +528,8 @@ jobs:
|
||||
file: ./Dockerfile.shared-httpd
|
||||
platforms: linux/amd64
|
||||
push: true
|
||||
build-args: |
|
||||
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
||||
tags: |
|
||||
repo.anhonesthost.net/cloud-hosting-platform/shared-httpd:latest
|
||||
|
||||
@@ -445,10 +539,40 @@ jobs:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# Internal package cache (CT130 pkg-cache, docs/pkg-cache.md). Used ONLY if
|
||||
# it answers over TLS with our pinned CA; otherwise (down, unreachable,
|
||||
# bad/expired cert) this job builds from the upstream repos and Docker Hub
|
||||
# exactly as before. The repo cache and the registry mirror are probed
|
||||
# separately so either can fail back on its own.
|
||||
- name: Probe package cache
|
||||
id: pkgcache
|
||||
run: |
|
||||
url=""; mirror=""
|
||||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
||||
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
||||
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<unreachable: Docker Hub>}"
|
||||
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
||||
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
||||
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
||||
# so the mirror is configured on the builder; BuildKit itself still falls
|
||||
# back to Docker Hub if the mirror stops answering mid-run.
|
||||
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
||||
if: steps.pkgcache.outputs.mirror != ''
|
||||
uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
buildkitd-config-inline: |
|
||||
[registry."docker.io"]
|
||||
mirrors = ["192.168.1.40:5000"]
|
||||
[registry."192.168.1.40:5000"]
|
||||
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
if: steps.pkgcache.outputs.mirror == ''
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Login to Gitea
|
||||
@@ -469,5 +593,6 @@ jobs:
|
||||
build-args: |
|
||||
PHPVER=83
|
||||
OLS_VERSION=1.8.4
|
||||
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
||||
tags: |
|
||||
repo.anhonesthost.net/cloud-hosting-platform/shared-ols:latest
|
||||
Reference in new issue
Block a user