66bbda9 docs(readme): point links to the public mirror and drop private infrastructure details (#68) · ermite

M .forgejo/workflows/ci.yml +5 -8


@@ -16,8 +16,7 @@ jobs:
16	16		runs-on: ubuntu-latest
17	17		steps:
18	18		- uses: actions/checkout@v6
19		-	# Job containers reach Forgejo through the Gordon edge on the host loopback,
20		-	# in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
	19	+	# Job containers reach the forge over plain HTTP on the host loopback.
21	20		- name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
22	21		run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
23	22		- uses: actions/setup-go@v5

@@ -40,8 +39,7 @@ jobs:
40	39		- name: System packages
41	40		run: pacman -Syu --noconfirm --needed git gcc openssh nodejs
42	41		- uses: actions/checkout@v6
43		-	# Job containers reach Forgejo through the Gordon edge on the host loopback,
44		-	# in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
	42	+	# Job containers reach the forge over plain HTTP on the host loopback.
45	43		- name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
46	44		run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
47	45		- uses: actions/setup-go@v5

@@ -86,8 +84,7 @@ jobs:
86	84		with:
87	85		# buf breaking compares with the base branch.
88	86		fetch-depth: 0
89		-	# Job containers reach Forgejo through the Gordon edge on the host loopback,
90		-	# in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
	87	+	# Job containers reach the forge over plain HTTP on the host loopback.
91	88		- name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
92	89		run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
93	90		- uses: actions/setup-go@v5

@@ -124,8 +121,8 @@ jobs:
124	121		# git describe needs the tags for the image version.
125	122		fetch-depth: 0
126	123		# The build runs in Podman on the runner host. With the host network it resolves
127		-	# git.bnema.dev through the host's /etc/hosts (127.0.0.1, see vps-infra
128		-	# homelab/igor/ci-runner) and reaches Forgejo on :8088. Podman's Docker API rejects
	124	+	# the forge through the host's /etc/hosts (loopback) and reaches it over plain HTTP.
	125	+	# Podman's Docker API rejects
129	126		# the classic builder's --add-host encoding, so host networking is used instead.
130	127		# Acceptable because only trusted branches of this repo trigger CI (no fork PRs).
131	128		- name: Build the image

     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      # Job containers reach Forgejo through the Gordon edge on the host loopback,
+      # Job containers reach the forge over plain HTTP on the host loopback.
-      # in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
       - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
         run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
       - uses: actions/setup-go@v5
       - name: System packages
         run: pacman -Syu --noconfirm --needed git gcc openssh nodejs
       - uses: actions/checkout@v6
-      # Job containers reach Forgejo through the Gordon edge on the host loopback,
+      # Job containers reach the forge over plain HTTP on the host loopback.
-      # in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
       - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
         run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
       - uses: actions/setup-go@v5
         with:
           # buf breaking compares with the base branch.
           fetch-depth: 0
-      # Job containers reach Forgejo through the Gordon edge on the host loopback,
+      # Job containers reach the forge over plain HTTP on the host loopback.
-      # in plain HTTP on :8088 (see vps-infra homelab/igor/ci-runner).
       - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route
         run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/"
       - uses: actions/setup-go@v5
           # git describe needs the tags for the image version.
           fetch-depth: 0
       # The build runs in Podman on the runner host. With the host network it resolves
-      # git.bnema.dev through the host's /etc/hosts (127.0.0.1, see vps-infra
+      # the forge through the host's /etc/hosts (loopback) and reaches it over plain HTTP.
-      # homelab/igor/ci-runner) and reaches Forgejo on :8088. Podman's Docker API rejects
+      # Podman's Docker API rejects
       # the classic builder's --add-host encoding, so host networking is used instead.
       # Acceptable because only trusted branches of this repo trigger CI (no fork PRs).
       - name: Build the image

M Dockerfile +3 -5


@@ -4,11 +4,9 @@
4	4		#
5	5		# docker build --build-arg VERSION="$(git describe --tags --always --dirty)" -t ermite .
6	6		#
7		-	# The modules bnema.dev/ermite-* are private and resolve through git.bnema.dev, which is
8		-	# reachable from the NetBird network only. The build container uses the host's DNS and
9		-	# routes, so on a NetBird host it needs nothing more. Behind a different route (CI), set
10		-	# --build-arg GIT_REWRITE_BASE=http://git.bnema.dev:8088/ --network host
11		-	# to fetch the modules over that URL instead of https://git.bnema.dev/.
	7	+	# The modules bnema.dev/ermite-* resolve through the bnema.dev vanity path.
	8	+	# GIT_REWRITE_BASE optionally rewrites the git host for builds behind a private route:
	9	+	# --build-arg GIT_REWRITE_BASE=<url> --network host
12	10		#
13	11		# Base images are pinned to an Alpine minor release; bump them on purpose.
14	12

 #
 #   docker build --build-arg VERSION="$(git describe --tags --always --dirty)" -t ermite .
 #
-# The modules bnema.dev/ermite-* are private and resolve through git.bnema.dev, which is
+# The modules bnema.dev/ermite-* resolve through the bnema.dev vanity path.
-# reachable from the NetBird network only. The build container uses the host's DNS and
+# GIT_REWRITE_BASE optionally rewrites the git host for builds behind a private route:
-# routes, so on a NetBird host it needs nothing more. Behind a different route (CI), set
+#   --build-arg GIT_REWRITE_BASE=<url> --network host
-#   --build-arg GIT_REWRITE_BASE=http://git.bnema.dev:8088/ --network host
-# to fetch the modules over that URL instead of https://git.bnema.dev/.
 #
 # Base images are pinned to an Alpine minor release; bump them on purpose.

M README.md +6 -4

@@ -1,5 +1,7 @@
1	1		# ermite
2	2
	3	+	> Read-only mirror. Development happens at git.bnema.dev; issues and pull requests are closed here.
	4	+
3	5		A single-user Git forge in one Go binary. ermite hosts bare repositories, serves clone and push over HTTPS, reviews branches as merge requests, and shows everything in a web interface with live updates.
4	6
5	7		Status: early development. `ermite serve` serves Git over HTTP (clone, fetch, push), the API, `GET /-/health`, and the web: repositories, an expandable file tree with a repository-wide fuzzy file finder, files, commits, refs and merge requests. Visitors read public repositories; the owner signs in with a one-time link from the CLI to see private ones and to review and merge.

@@ -21,7 +23,7 @@ ermite serve
21	23		\| `ERMITE_ADDR` \| `:7341` \| listen address \|
22	24		\| `ERMITE_TRUSTED_PROXIES` \| empty \| comma-separated CIDRs \|
23	25		\| `ERMITE_GIT` \| `git` \| git 2.45 or newer \|
24		-	\| `ERMITE_GIT_READER` \| `ermite-git` \| `ermite-git` reads refs, trees, blobs and history with the [ermite-git](https://git.bnema.dev/bnema/ermite-git) library where it is faster than the `git` binary and falls back to `git` elsewhere and for repositories it does not read; `cli` uses the `git` binary for every read (the escape hatch if a read looks wrong: set it and restart) \|
	26	+	\| `ERMITE_GIT_READER` \| `ermite-git` \| `ermite-git` reads refs, trees, blobs and history with the [ermite-git](https://github.com/bnema/ermite-git) library where it is faster than the `git` binary and falls back to `git` elsewhere and for repositories it does not read; `cli` uses the `git` binary for every read (the escape hatch if a read looks wrong: set it and restart) \|
25	27		\| `ERMITE_SOURCE_URL` \| `$ERMITE_PUBLIC_URL/ermite` \| link to the source (AGPL) \|
26	28		\| `ERMITE_LOG_LEVEL` \| `info` \| `trace`, `debug`, `info`, `warn`, `error` \|
27	29		\| `ERMITE_LOG_FORMAT` \| `json` \| `json` or `console` \|

@@ -34,7 +36,7 @@ ermite serve
34	36		\| `ERMITE_CI_ARTIFACT_RETENTION` \| `90d` \| default and longest retention of an artifact (`retention-days`), at least one day: `Nd` or a Go duration \|
35	37		\| `ERMITE_CI_ARTIFACT_QUOTA` \| `10GiB` \| space of the artifacts of one repository, uploads in progress included: bytes, or a number with `KiB`, `MiB`, `GiB`, `TiB` \|
36	38		\| `ERMITE_CI_ARTIFACT_MAX` \| `5GiB` \| size of one artifact, same syntax \|
37		-	\| `ERMITE_CI_POLL_TIMEOUT` \| `50s` \| how long the server holds a runner's `FetchJob` call when no job is queued, from `1s` to `55s`; set it below the response timeout of a reverse proxy in front of ermite (Gordon cuts a response that has no headers after 30 s, so use `25s` behind it) \|
	39	+	\| `ERMITE_CI_POLL_TIMEOUT` \| `50s` \| how long the server holds a runner's `FetchJob` call when no job is queued, from `1s` to `55s`; set it below the response timeout of a reverse proxy in front of ermite (a reverse proxy may cut a response that has no headers after 30 s, so use `25s` behind such a proxy) \|
38	40
39	41		`ermite version` prints the version (and the server's when a server URL is configured, see Remote CLI).
40	42

@@ -122,7 +124,7 @@ A merge request proposes a branch for its target (the default branch unless set)
122	124
123	125		ermite runs the `.github/workflows/*.yml` workflows of a repository on `push` (a branch or a tag, and the merge of a merge request), on `pull_request` and `pull_request_target` (the merge requests, below), `workflow_dispatch`, `schedule`, `workflow_run`, `create` and `delete` (below) and shows each job as a check on the commit, the branch list and the merge request. CI is on once a runner is registered; there is no switch. Before that a push makes no run and no check.
124	126
125		-	Runs execute on [ermite-runner](https://git.bnema.dev/bnema/ermite-runner) hosts, which call ermite over its API. Create a token for the runner host with `ermite token create <label> --preset runner` (the `runner:register` scope, which also gives access to the code and the secrets of every repository: give it only to runners you operate), then register the runner with it. `ermite runner list` shows the runners and whether they are online; `ermite runner remove <id>` stops one. A job goes to a runner that has every label of its `runs-on`; a job no runner takes within 24 hours fails.
	127	+	Runs execute on [ermite-runner](https://github.com/bnema/ermite-runner) hosts, which call ermite over its API. Create a token for the runner host with `ermite token create <label> --preset runner` (the `runner:register` scope, which also gives access to the code and the secrets of every repository: give it only to runners you operate), then register the runner with it. `ermite runner list` shows the runners and whether they are online; `ermite runner remove <id>` stops one. A job goes to a runner that has every label of its `runs-on`; a job no runner takes within 24 hours fails.
126	128
127	129		Every job gets a repository token (`github.token`, `ermitegh_…`) when a runner takes it: it reads the repository of the run, even a private one, over Git and the REST subset below, writes nothing, and ends with the job (completion, cancel, lost runner) or five minutes after the job's deadline. It is not a stored token: `ermite token list` never shows it and no scope manages it.
128	130

@@ -185,7 +187,7 @@ docker run -d -p 127.0.0.1:7341:7341 -v ermite-data:/data \
185	187		-e ERMITE_PUBLIC_URL=http://localhost:7341 -e ERMITE_ADMIN_TOKEN="$token" ermite
186	188		```
187	189
188		-	The image is alpine with git, runs as uid 10001 and keeps its data in the `/data` volume. Logs are JSON by default. The build fetches `bnema.dev/ermite-*` from `git.bnema.dev`, so the host must reach it (NetBird); the build container uses the host's DNS and routes. Behind another route, pass `--build-arg GIT_REWRITE_BASE=http://git.bnema.dev:8088/` with `--network host`, as the CI job does.
	190	+	The image is alpine with git, runs as uid 10001 and keeps its data in the `/data` volume. Logs are JSON by default. The build fetches the `bnema.dev/ermite-*` modules through their `bnema.dev` vanity paths. Behind a private route, `--build-arg GIT_REWRITE_BASE=<url>` rewrites the git host used for those modules.
189	191
190	192		## Develop with compose
191	193

 # ermite
+> Read-only mirror. Development happens at git.bnema.dev; issues and pull requests are closed here.
 A single-user Git forge in one Go binary. ermite hosts bare repositories, serves clone and push over HTTPS, reviews branches as merge requests, and shows everything in a web interface with live updates.
 Status: early development. `ermite serve` serves Git over HTTP (clone, fetch, push), the API, `GET /-/health`, and the web: repositories, an expandable file tree with a repository-wide fuzzy file finder, files, commits, refs and merge requests. Visitors read public repositories; the owner signs in with a one-time link from the CLI to see private ones and to review and merge.
 | `ERMITE_ADDR` | `:7341` | listen address |
 | `ERMITE_TRUSTED_PROXIES` | empty | comma-separated CIDRs |
 | `ERMITE_GIT` | `git` | git 2.45 or newer |
-| `ERMITE_GIT_READER` | `ermite-git` | `ermite-git` reads refs, trees, blobs and history with the [ermite-git](https://git.bnema.dev/bnema/ermite-git) library where it is faster than the `git` binary and falls back to `git` elsewhere and for repositories it does not read; `cli` uses the `git` binary for every read (the escape hatch if a read looks wrong: set it and restart) |
+| `ERMITE_GIT_READER` | `ermite-git` | `ermite-git` reads refs, trees, blobs and history with the [ermite-git](https://github.com/bnema/ermite-git) library where it is faster than the `git` binary and falls back to `git` elsewhere and for repositories it does not read; `cli` uses the `git` binary for every read (the escape hatch if a read looks wrong: set it and restart) |
 | `ERMITE_SOURCE_URL` | `$ERMITE_PUBLIC_URL/ermite` | link to the source (AGPL) |
 | `ERMITE_LOG_LEVEL` | `info` | `trace`, `debug`, `info`, `warn`, `error` |
 | `ERMITE_LOG_FORMAT` | `json` | `json` or `console` |
 | `ERMITE_CI_ARTIFACT_RETENTION` | `90d` | default and longest retention of an artifact (`retention-days`), at least one day: `Nd` or a Go duration |
 | `ERMITE_CI_ARTIFACT_QUOTA` | `10GiB` | space of the artifacts of one repository, uploads in progress included: bytes, or a number with `KiB`, `MiB`, `GiB`, `TiB` |
 | `ERMITE_CI_ARTIFACT_MAX` | `5GiB` | size of one artifact, same syntax |
-| `ERMITE_CI_POLL_TIMEOUT` | `50s` | how long the server holds a runner's `FetchJob` call when no job is queued, from `1s` to `55s`; set it below the response timeout of a reverse proxy in front of ermite (Gordon cuts a response that has no headers after 30 s, so use `25s` behind it) |
+| `ERMITE_CI_POLL_TIMEOUT` | `50s` | how long the server holds a runner's `FetchJob` call when no job is queued, from `1s` to `55s`; set it below the response timeout of a reverse proxy in front of ermite (a reverse proxy may cut a response that has no headers after 30 s, so use `25s` behind such a proxy) |
 `ermite version` prints the version (and the server's when a server URL is configured, see Remote CLI).
 ermite runs the `.github/workflows/*.yml` workflows of a repository on `push` (a branch or a tag, and the merge of a merge request), on `pull_request` and `pull_request_target` (the merge requests, below), `workflow_dispatch`, `schedule`, `workflow_run`, `create` and `delete` (below) and shows each job as a check on the commit, the branch list and the merge request. CI is on once a runner is registered; there is no switch. Before that a push makes no run and no check.
-Runs execute on [ermite-runner](https://git.bnema.dev/bnema/ermite-runner) hosts, which call ermite over its API. Create a token for the runner host with `ermite token create <label> --preset runner` (the `runner:register` scope, which also gives access to the code and the secrets of every repository: give it only to runners you operate), then register the runner with it. `ermite runner list` shows the runners and whether they are online; `ermite runner remove <id>` stops one. A job goes to a runner that has every label of its `runs-on`; a job no runner takes within 24 hours fails.
+Runs execute on [ermite-runner](https://github.com/bnema/ermite-runner) hosts, which call ermite over its API. Create a token for the runner host with `ermite token create <label> --preset runner` (the `runner:register` scope, which also gives access to the code and the secrets of every repository: give it only to runners you operate), then register the runner with it. `ermite runner list` shows the runners and whether they are online; `ermite runner remove <id>` stops one. A job goes to a runner that has every label of its `runs-on`; a job no runner takes within 24 hours fails.
 Every job gets a **repository token** (`github.token`, `ermitegh_…`) when a runner takes it: it reads the repository of the run, even a private one, over Git and the REST subset below, writes nothing, and ends with the job (completion, cancel, lost runner) or five minutes after the job's deadline. It is not a stored token: `ermite token list` never shows it and no scope manages it.
   -e ERMITE_PUBLIC_URL=http://localhost:7341 -e ERMITE_ADMIN_TOKEN="$token" ermite
 ```
-The image is alpine with git, runs as uid 10001 and keeps its data in the `/data` volume. Logs are JSON by default. The build fetches `bnema.dev/ermite-*` from `git.bnema.dev`, so the host must reach it (NetBird); the build container uses the host's DNS and routes. Behind another route, pass `--build-arg GIT_REWRITE_BASE=http://git.bnema.dev:8088/` with `--network host`, as the CI job does.
+The image is alpine with git, runs as uid 10001 and keeps its data in the `/data` volume. Logs are JSON by default. The build fetches the `bnema.dev/ermite-*` modules through their `bnema.dev` vanity paths. Behind a private route, `--build-arg GIT_REWRITE_BASE=<url>` rewrites the git host used for those modules.
 ## Develop with compose

M compose.yaml +1 -1

@@ -1,6 +1,6 @@
1	1		# Development server with hot reload: `docker compose up`, then http://localhost:7341.
2	2		# The module is built on its own (no go.work), like CI. Private modules bnema.dev/ermite-*
3		-	# are fetched from git.bnema.dev, which the container reaches through the host's DNS and routes.
	3	+	# resolve through the bnema.dev vanity path, using the host's DNS and routes.
4	4		services:
5	5		ermite:
6	6		build:

@@ -1,6 +1,6 @@
1		# Development server with hot reload: `docker compose up`, then http://localhost:7341.	1		# Development server with hot reload: `docker compose up`, then http://localhost:7341.
2		# The module is built on its own (no go.work), like CI. Private modules bnema.dev/ermite-*	2		# The module is built on its own (no go.work), like CI. Private modules bnema.dev/ermite-*
3	-	# are fetched from git.bnema.dev, which the container reaches through the host's DNS and routes.	3	+	# resolve through the bnema.dev vanity path, using the host's DNS and routes.
4		services:	4		services:
5		ermite:	5		ermite:
6		build:	6		build:

M go.sum +1 -1 generated file: collapsed

load diff