Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Nirav Patel
|
835d6705d6 |
@@ -1,10 +1,8 @@
|
||||
# granthi-sync v1.2
|
||||
|
||||
The signup → download → link-folders → cloud product spine for the Granthi
|
||||
forge. Developed and live-E2E-tested against the BETA forge
|
||||
(granthi-beta.shre.ai); **the deployed service now runs against the PRODUCTION
|
||||
forge** — see "Where this actually runs" below. Python 3 stdlib + git CLI only
|
||||
— same portability heritage as the estate's `gitea_sync.py` mesh.
|
||||
forge, tested against the BETA forge (granthi-beta.shre.ai). Python 3 stdlib +
|
||||
git CLI only — same portability heritage as the estate's `gitea_sync.py` mesh.
|
||||
|
||||
```
|
||||
┌──────────────┐ device flow ┌─────────────────┐
|
||||
@@ -15,8 +13,7 @@ forge** — see "Where this actually runs" below. Python 3 stdlib + git CLI only
|
||||
│ │ POST /v1/link {zitadel_access_token, device_name}
|
||||
│ │ ───────────────▶ ┌───────────────────────────────┐
|
||||
│ │ ◀─────────────── │ granthi-link :3042 │
|
||||
│ │ {login, token} │ (granthi VPS; public via │
|
||||
│ │ │ https://granthi-link.shre.ai)│
|
||||
│ │ {login, token} │ (granthi VPS, tailnet-only) │
|
||||
│ │ │ · userinfo validation │
|
||||
│ │ POST /v1/repos │ · ensure Gitea user (admin) │
|
||||
│ │ ───────────────▶ │ · mint scoped user token │
|
||||
@@ -24,28 +21,11 @@ forge** — see "Where this actually runs" below. Python 3 stdlib + git CLI only
|
||||
│ │ git push/fetch (user token │ admin API
|
||||
│ │ via credential helper) ▼
|
||||
│ │ ───────────────▶ ┌───────────────────────────────┐
|
||||
└──────────────┘ │ PROD forge :3040 │
|
||||
│ granthi.shre.ai │
|
||||
└──────────────┘ │ BETA forge :3041 │
|
||||
│ granthi-beta.shre.ai │
|
||||
└───────────────────────────────┘
|
||||
```
|
||||
|
||||
## Where this actually runs
|
||||
|
||||
Verified on the granthi VPS (`[email protected]`) on 2026-08-30, because
|
||||
this file previously described the beta tier long after the deployment moved:
|
||||
|
||||
| | value |
|
||||
|---|---|
|
||||
| service | `/opt/granthi-link/`, `granthi-link.service`, `systemctl is-active` → `active` |
|
||||
| public entry | `https://granthi-link.shre.ai` — `/health` → 200. `/` → 404 is **no root route**, not an outage |
|
||||
| `gitea_base` | `http://127.0.0.1:3040` (container `gitea-central-gitea-1`) |
|
||||
| `public_gitea_base` | `https://granthi.shre.ai` |
|
||||
| rate limiting | `trust_forwarded_for: true`, `trusted_proxies: ["100.107.37.98/32"]`, no `rules` key → falls back to `DEFAULT_RATE_RULES` |
|
||||
| deployed version | `/health` reports **1.1.0** while this repo is **v1.2** — the running service lags `main` |
|
||||
|
||||
So a new computer that follows Quickstart lands on the **production** forge.
|
||||
Beta remains where changes are proven before they reach it.
|
||||
|
||||
## Quickstart (invited user)
|
||||
|
||||
You need a shre-id account — an operator creates it; there is no open signup
|
||||
@@ -214,16 +194,13 @@ So:
|
||||
**64 KB** (413 beyond; missing `Content-Length` → 411, invalid → 400).
|
||||
* `POST /v1/repos {token, name, private}` → creates the user repo with the
|
||||
USER token; clone/html URLs are rebased onto `public_gitea_base` because the
|
||||
container `ROOT_URL` does not necessarily resolve for the client that asked
|
||||
(it was a tailnet-only address on beta; on prod the rebase keeps clone URLs
|
||||
on `https://granthi.shre.ai` rather than the container's own view).
|
||||
container `ROOT_URL` (https://granthi-beta.shre.ai) does not resolve for
|
||||
tailnet-only clients.
|
||||
|
||||
Deployment: `/opt/granthi-link/{granthi_link.py,config.json,state.json}` +
|
||||
systemd unit `granthi-link.service`; binds `127.0.0.1:3042` **and**
|
||||
`100.111.127.127:3042` (tailnet), and is **publicly reachable** at
|
||||
`https://granthi-link.shre.ai` through the `pulse-granthi-edge` cloudflared
|
||||
tunnel (done 2026-08-23; re-verified 2026-08-30). The service **refuses to
|
||||
start** (exit 2) unless `config.json` is
|
||||
`100.111.127.127:3042` (tailnet). **Not publicly exposed** — see promotion
|
||||
window. The service **refuses to start** (exit 2) unless `config.json` is
|
||||
mode 0600/0400 and owned by the user it runs as — the config carries the
|
||||
forge admin password, so permissive perms fail closed, not open.
|
||||
|
||||
@@ -643,12 +620,10 @@ Shape this should take, so the next session does not re-litigate it:
|
||||
`https://granthi-link.shre.ai` (second-level, see above), origin stays
|
||||
tailnet-only, `trust_forwarded_for` on with the tunnel as the only
|
||||
trusted proxy.
|
||||
2. ~~**Swap forge base URLs** in `/opt/granthi-link/config.json`~~
|
||||
**DONE — verified live 2026-08-30**: the deployed config reads
|
||||
`gitea_base: http://127.0.0.1:3040` and
|
||||
`public_gitea_base: https://granthi.shre.ai`, and the client default
|
||||
server is already the public endpoint. Linking a new device therefore
|
||||
creates the account on **prod**.
|
||||
2. **Swap forge base URLs** in `/opt/granthi-link/config.json`:
|
||||
`gitea_base` → prod forge, `public_gitea_base` →
|
||||
`https://granthi.shre.ai`; the client default server URL moves to the
|
||||
public endpoint.
|
||||
3. The `granthi-web` OIDC app already lists the prod callback; the device
|
||||
app is host-independent. Rotate the beta admin token/password out of the
|
||||
config when pointing at prod (prod forge is READ-ONLY to this estate —
|
||||
|
||||
@@ -1,17 +1,15 @@
|
||||
{
|
||||
"_comment_forge": "Values below mirror the LIVE prod deployment (verified 2026-08-30). For the beta tier use gitea_base http://127.0.0.1:3041, public_gitea_base https://granthi-beta.shre.ai, container gitea-beta-gitea-1, creds /opt/gitea-beta/.admin-creds.",
|
||||
"gitea_base": "http://127.0.0.1:3040",
|
||||
"public_gitea_base": "https://granthi.shre.ai",
|
||||
"gitea_base": "http://127.0.0.1:3041",
|
||||
"public_gitea_base": "http://100.111.127.127:3041",
|
||||
"zitadel_userinfo": "https://id.shre.ai/oidc/v1/userinfo",
|
||||
"admin_token": "MINT-VIA: docker exec -u git gitea-central-gitea-1 gitea admin user generate-access-token --username nirpa --scopes write:admin,write:user,write:repository --raw",
|
||||
"admin_token": "MINT-VIA: docker exec -u git gitea-beta-gitea-1 gitea admin user generate-access-token --username nirpa --scopes write:admin,write:user,write:repository --raw",
|
||||
"admin_login": "nirpa",
|
||||
"admin_password": "FROM shre-cred: superadmin/granthi-link/granthi-prod-forge-admin (required: Gitea 1.27 token minting only works via basic auth + Sudo header). NEVER paste this into chat or a shell history.",
|
||||
"admin_password": "FROM /opt/gitea-beta/.admin-creds (required: Gitea 1.27 token minting only works via basic auth + Sudo header)",
|
||||
"binds": [["127.0.0.1", 3042], ["100.111.127.127", 3042]],
|
||||
"test_mode": false,
|
||||
"rate_limit": {
|
||||
"enabled": true,
|
||||
"trust_forwarded_for": true,
|
||||
"trusted_proxies": ["100.107.37.98/32"],
|
||||
"trust_forwarded_for": false,
|
||||
"rules": {"/v1/link": [5, 3600], "/v1/repos": [60, 3600]}
|
||||
}
|
||||
}
|
||||
|
||||
+12
-12
@@ -29,9 +29,11 @@ GIT_ENV = {
|
||||
}
|
||||
|
||||
|
||||
def run_git(cwd, *args):
|
||||
return subprocess.run(["git", "-C", cwd] + list(args), check=True,
|
||||
capture_output=True, text=True, env=GIT_ENV).stdout.strip()
|
||||
def run_git(cwd, *args, strip=True):
|
||||
stdout = subprocess.run(["git", "-C", cwd] + list(args), check=True,
|
||||
capture_output=True, text=True,
|
||||
env=GIT_ENV).stdout
|
||||
return stdout.strip() if strip else stdout
|
||||
|
||||
|
||||
|
||||
@@ -905,15 +907,13 @@ class TestCredentialHelperIsolation(GitScenarioBase):
|
||||
def test_install_leaves_exactly_one_helper(self):
|
||||
run_git(self.local, "config", "--add", "credential.helper", "store")
|
||||
client.install_credential_helper(self.local)
|
||||
# --get-all merges system + global + local, so entries inherited from
|
||||
# the machine still appear. What matters is that the last two are the
|
||||
# reset and ours: git reads an empty value as "forget every helper
|
||||
# inherited so far", so nothing before it can answer.
|
||||
helpers = run_git(self.local, "config", "--get-all",
|
||||
"credential.helper").splitlines()
|
||||
self.assertEqual(helpers[-2], "", helpers)
|
||||
self.assertIn("git-credential", helpers[-1])
|
||||
# the repo-level 'store' this test added is gone, not merely outvoted
|
||||
# Inspect the repo-local list so this assertion is deterministic even
|
||||
# when the machine has no inherited helper. Keep the leading newline:
|
||||
# it represents the empty reset value, not disposable whitespace.
|
||||
helpers = run_git(self.local, "config", "--local", "--get-all",
|
||||
"credential.helper", strip=False).splitlines()
|
||||
self.assertEqual(helpers, ["", client.credential_helper_value()])
|
||||
# The repo-level 'store' this test added is gone, not merely outvoted.
|
||||
self.assertNotIn("store", helpers)
|
||||
|
||||
def test_inherited_helper_cannot_answer_for_the_forge(self):
|
||||
|
||||
Reference in New Issue
Block a user