mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-09-22 10:14:15 +00:00
Evan JarrettandClaude Fable 5.1
a01b08b924
indigo's identity directory refuses HTTP and IP-hosted did:web, and its OAuth client is growing an SSRF-guarded transport that refuses loopback and private addresses. Local development and the test suites need both, and the workarounds were scattered: two did:web fallbacks in the resolver, a hand-rolled appview key fetch on the hold, and the OAuth client left on indigo's defaults so any test driving it against an httptest server depended on the transport staying permissive. Move every departure from indigo's defaults into one file pair in pkg/atproto: indigo_prod.go (!testmode) returns indigo's directory and OAuth client unchanged; indigo_local.go (testmode) wraps the directory so a did:web naming an IP, localhost, or a host with a port resolves over plain HTTP, and gives the OAuth client plain HTTP clients. All six identity and OAuth constructor call sites go through NewDirectory and NewOAuthClientApp. The resolver fallbacks, DIDWebToURL, and the hold's scheme-guessing key fetch are gone; the hold resolves the appview key through the directory, preferring #appview, and purges and retries once on a signature failure so a re-keyed appview is not masked by the 24-hour cache. There is no runtime switch for this: a production binary cannot be configured to resolve local DIDs. The runtime test_mode flag still gates the remaining behavioral branches only. Tests, the harness, make dev, Air, Dockerfile.dev, and docker-compose build with the tag; fixtures that need loopback did:web fail fast naming it. Test hold servers now serve a did.json via pkg/testpds so they resolve as real holds under the tag. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UwYzaG3Yy7uA8FbZ5qk3tQ
30 lines
989 B
Docker
30 lines
989 B
Docker
# Development image with Air hot reload
|
|
# Build: docker build -f Dockerfile.dev -t atcr-dev .
|
|
# Run: docker run -v $(pwd):/app -p 5000:5000 atcr-dev
|
|
FROM mirror.gcr.io/library/golang:1.26.7-trixie
|
|
|
|
ARG AIR_CONFIG=.air.toml
|
|
# Extra Go build tags for Air's build command (comma-separated). docker-compose
|
|
# passes `testmode` so the dev stack can resolve its loopback did:web
|
|
# identities. Production images (Dockerfile.appview, Dockerfile.hold) never
|
|
# set this and never carry the tag.
|
|
ARG GO_TAGS=""
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
ENV AIR_CONFIG=${AIR_CONFIG}
|
|
ENV GO_TAGS=${GO_TAGS}
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends sqlite3 libsqlite3-dev curl nodejs npm && \
|
|
rm -rf /var/lib/apt/lists/* && \
|
|
go install github.com/air-verse/air@latest
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy go.mod first for layer caching
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
# For development: source mounted as volume, Air handles builds
|
|
CMD ["sh", "-c", "air -c ${AIR_CONFIG}"]
|