William Gill
12bf35caf8
Greenfield Go multi-tenant IPFS Pinning Service wire-compatible with the
IPFS Pinning Services API spec. Paired 1:1 with Kubo over localhost RPC,
clustered via embedded NATS JetStream, Postgres source-of-truth with
RLS-enforced tenancy, Fiber + huma v2 for the HTTP surface, Authentik
OIDC for session login with kid-rotated HS256 JWT API tokens.
Feature-complete against the 22-milestone build plan, including the
ship-it v1.0 gap items:
* admin CLIs: drain/uncordon, maintenance, mint-token, rotate-key,
prune-denylist, rebalance --dry-run, cache-stats, cluster-presences
* TTL leader election via NATS KV, fence tokens, JetStream dedup
* rebalancer (plan/apply split), reconciler, requeue sweeper
* ristretto caches with NATS-backed cross-node invalidation
(placements live-nodes + token denylist)
* maintenance watchdog for stuck cluster-pause flag
* Prometheus /metrics with CIDR ACL, HTTP/pin/scheduler/cache gauges
* rate limiting: session (10/min) + anonymous global (120/min)
* integration tests: rebalance, refcount multi-org, RLS belt
* goreleaser (tar + deb/rpm/apk + Alpine Docker) targeting Gitea
Stack: Cobra/Viper, Fiber v2 + huma v2, embedded NATS JetStream,
pgx/sqlc/golang-migrate, ristretto, TypeID, prometheus/client_golang,
testcontainers-go.
30 lines
1.1 KiB
Bash
30 lines
1.1 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
systemctl daemon-reload
|
|
|
|
# Enable the service but don't start on a fresh install — the operator
|
|
# still needs to write /etc/anchorage/anchorage.yaml (start from
|
|
# /etc/anchorage/anchorage.yaml.example) and provision the JWT signing
|
|
# key at auth.apiToken.signingKeyPath.
|
|
systemctl enable anchorage.service >/dev/null 2>&1 || true
|
|
|
|
# On upgrade ("2" from rpm, "configure" from deb) restart only if the
|
|
# service was previously running so an operator who has it intentionally
|
|
# stopped stays that way.
|
|
if [ "$1" = "configure" ] || [ "$1" = "2" ]; then
|
|
if systemctl is-active --quiet anchorage.service; then
|
|
systemctl restart anchorage.service >/dev/null 2>&1 || true
|
|
fi
|
|
fi
|
|
|
|
if [ ! -f /etc/anchorage/anchorage.yaml ]; then
|
|
echo ""
|
|
echo "anchorage: configuration not found at /etc/anchorage/anchorage.yaml"
|
|
echo " cp /etc/anchorage/anchorage.yaml.example /etc/anchorage/anchorage.yaml"
|
|
echo " edit to point at your Postgres + Authentik + Kubo RPC endpoint"
|
|
echo " generate a signing key, e.g.: openssl rand -base64 48 > /etc/anchorage/jwt.key"
|
|
echo " systemctl start anchorage"
|
|
echo ""
|
|
fi
|