- Python 34%
- Go 26.4%
- Shell 21.9%
- Nix 12.2%
- Makefile 4%
- Other 1.5%
comonad
0dbe610570
The mirror stack only had up targets; add down/logs/ps for the bare (local dev) compose plus the -siyuan/-zhiyuan site variants, and g-storage-down to complete the g-storage lifecycle set. Volumes are never removed. |
||
|---|---|---|
| .github | ||
| caddy | ||
| caddy-gen | ||
| clash | ||
| common | ||
| data | ||
| docs | ||
| frontend@aa45be5403 | ||
| gateway-gen | ||
| git-backend | ||
| integration-test | ||
| lug | ||
| mirror-intel | ||
| monitor/g-storage | ||
| rsync-gateway | ||
| rsyncd | ||
| scripts | ||
| secrets | ||
| .autocorrectrc | ||
| .editorconfig | ||
| .envrc | ||
| .gitignore | ||
| .gitmodules | ||
| .go-version | ||
| .python-version | ||
| .sops.yaml | ||
| config.siyuan.yaml | ||
| config.zhiyuan.yaml | ||
| docker-compose.siyuan.yml | ||
| docker-compose.yml | ||
| docker-compose.zhiyuan.yml | ||
| flake.lock | ||
| flake.nix | ||
| frontend-image.nix | ||
| LICENSE | ||
| MAINTENANCE.md | ||
| Makefile | ||
| PLAN.md | ||
| postgresql.siyuan.conf | ||
| postgresql.zhiyuan.conf | ||
| pyproject.toml | ||
| README.md | ||
| uv.lock | ||
mirror-docker-unified
Nix-flake orchestration for all SJTUG mirror servers.
Docs
For more information, refer to our Wiki.
Container runtime
The Compose stack targets rootful containerd through nerdctl compose. Install
nerdctl 2.3.1 or later and run BuildKit with its containerd worker. The root
services must expose /run/containerd/containerd.sock and
/run/buildkit/buildkitd.sock. The Makefile passes nerdctl's absolute path to
sudo:
make up-siyuan
make up-zhiyuan
Site deployments render ignored plaintext files under ./secrets/rendered/
from the SOPS-backed ./secrets/siyuan/ or ./secrets/zhiyuan/ directory
before running Compose. Use make secrets-siyuan or make secrets-zhiyuan to
refresh those files without starting containers.
nerdctl 2.3.1 does not translate Compose's memswap_limit or the Zhiyuan
device_read_bps/device_read_iops limits. The fields remain in the files for
the Docker fallback, but rootful containerd does not enforce them.
Native Nix images
The mirror stack runs natively from Nix images (caddy, git-backend, rsyncd,
clash, mirror-intel, rsync-gateway, frontend, lug) on hosts using
nix-snapshotter. Build and load their OCI manifests into the rootful containerd
mirror namespace with:
make nix-images
make nix-images-load
make nix-images-verify
After loading the images, start all services on one site with:
make nix-up-siyuan
# or
make nix-up-zhiyuan
These targets run the stack from Nix images with --no-build --pull never. The
host must have the nix snapshotter registered with rootful containerd before
running them.
The legacy logspout service needs the Docker Engine API and is therefore
disabled by default (gated behind the docker-engine profile). Under the
nerdctl-only runtime there is no Docker socket to attach to; logspout is
retained only as a reference and is not started in production.
Project structure & maintenance
.
├── apache # apache dockerfile
├── caddy
├── caddy-gen # caddy configuration generator (for ./caddy)
├── clash # clash dockerfile (for secured connection with monitor node)
├── common # common network configuration
├── data # caddy & lug backend dist
├── docs # Documentation
├── frontend # lug frontend (Next.js)
├── gateway-gen # rsync-sjtug configuration generator (for ./rsync-gateway)
├── git-backend # git backend
├── integration-test # test
├── lug # lug backend dockerfile
├── mirror-intel # mirror-intel configuration
├── monitor/g-storage # g-storage Prometheus, Grafana, and alerting stack
├── rsync-gateway
├── rsyncd
├── scripts
├── secrets # SOPS-encrypted source secrets and ignored rendered runtime secrets
└── upstream
Python version, treefmt, pre-commit configurations are controlled by flake.nix
(flake-parts, treefmt-nix, pre-commit-hooks) with Nix flakes.
See https://nixos.org/download/ or https://lix.systems/install/ for Nix installation manual.
License
Apache 2.0