Skip to content

chore: pin sponsord to v0.1.0 #159

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
thiras wants to merge 1 commit into from
Closed

chore: pin sponsord to v0.1.0 #159

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ lint-alloy` validates and runs it.

**Pinned upstream releases.** One decdn/decdn release (`decdn_node_version`, today
`0.0.4`) and one decdn/sponsord release (`sponsord_version` = `sponsord_onramp_version`,
today `0.0.4`; decdn/sponsord tags its whole workspace `vX.Y.Z`, there are no per-crate
today `0.1.0`; decdn/sponsord tags its whole workspace `vX.Y.Z`, there are no per-crate
tags) are pinned across every path: the role defaults, the onramp's installer pin
(`sponsord_onramp_decdn_release` + `_decdn_sums_sha256`, copied into
`compose/sponsord-onramp.env.example`), `compose/.env.example`'s image digests, the
Expand Down
4 changes: 2 additions & 2 deletions ansible/inventory/group_vars/sponsord_hosts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,11 @@
# The default method, "release", installs the decdn/sponsord release the role pins
# (tag v<sponsord_version>); set it only to hold the host on another one, together
# with sponsord_onramp_version:
# sponsord_version: "0.0.4"
# sponsord_version: "0.1.0"
# Or build on the host from a git ref (tag, branch or SHA; sponsord_version is not
# checked in this mode):
# sponsord_install_method: source
# sponsord_source_ref: v0.0.4
# sponsord_source_ref: v0.1.0
# Or copy a control-machine build: a decdn/sponsord checkout's target dir
# (`cargo build --release -p sponsord`; the role checks the ELF matches the host).
# sponsord_install_method: manual
Expand Down
4 changes: 2 additions & 2 deletions ansible/inventory/group_vars/sponsord_onramp_hosts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@
# --- Binary ------------------------------------------------------------------------
# The same three methods as sponsord. "release" (default) installs the same release
# as the sponsord role; set both versions together to hold the host on another:
# sponsord_onramp_version: "0.0.4"
# sponsord_onramp_version: "0.1.0"
# Or build on the host (its own checkout, so it may pin a different ref):
# sponsord_onramp_install_method: source
# sponsord_onramp_source_ref: v0.0.4
# sponsord_onramp_source_ref: v0.1.0
# Or manual, which follows sponsord_release_target_dir (`cargo build --release` in
# a decdn/sponsord checkout builds both binaries):
# sponsord_onramp_install_method: manual
Expand Down
2 changes: 1 addition & 1 deletion ansible/roles/decdn_node/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ decdn_redeem_max_vouchers_per_tx: "" # daemon dflt 300; > 0 — gas-bounded
decdn_redeem_interval_secs: "" # daemon dflt 300; range 1..=21600 — redeemer self-tick
decdn_buyer_working_deposit_micro_usdc: "" # daemon dflt 10_000_000 (10 USDC); > 0
# bool; profile-dependent upstream — true for the daemon, false for the `decdn`
# client (fetch / bundle pull). node.toml is deliberately shared with the CLI, so
# client (decdn get). node.toml is deliberately shared with the CLI, so
# pinning it here changes client behaviour too. One-time max USDC approval to PaymentPool.
decdn_buyer_max_approve: ""
decdn_pool_min_remaining_deposit_micro_usdc: "" # daemon dflt 1_000_000 — solvency floor before a pool drains
Expand Down
4 changes: 2 additions & 2 deletions ansible/roles/iroh_relay/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ decdn_relay_urls:
Setting `decdn_relay_urls` **replaces** n0's relays; it does not add to them. A node
whose only relay is down has no fallback for peers it cannot hole-punch. Deploy
**at least two** relays, preferably in different regions, before switching a fleet
over. Clients (`decdn fetch`, `decdn probe --relay-url …`) take relays the same way,
over. Clients (`decdn get`, `decdn probe --relay-url …`) take relays the same way,
but a relay in the default `allowlist` mode refuses them (see below): point clients
only at relays in `everyone` or `denylist` mode.

Expand Down Expand Up @@ -155,7 +155,7 @@ anyone in every mode.
- **`denylist`:** everyone except `iroh_relay_denylist`.
- **`everyone`:** no restriction.

**What allowlist mode costs.** decdn clients (`decdn fetch`, `decdn probe`, onramp
**What allowlist mode costs.** decdn clients (`decdn get`, `decdn probe`, onramp
users) use a fresh iroh key for every fetch, so they **can never be listed**. iroh
hole-punches over a connection it already has, and a node behind NAT has no path
but its relay, so a client reaches a node homed on an allowlisted relay **only if
Expand Down
2 changes: 1 addition & 1 deletion ansible/roles/iroh_relay/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ iroh_relay_metrics_port: 9092
# anyone in every mode):
# "allowlist" (default): only the endpoint IDs below. The IDs of the inventory's
# deCDN nodes are added by playbooks/iroh_relay.yml (iroh_relay_allowlist_from_inventory).
# decdn clients (decdn fetch, onramp users) use a fresh key per fetch and can
# decdn clients (decdn get, onramp users) use a fresh key per fetch and can
# NEVER be listed, and iroh hole-punches over a connection it already has, so a
# client reaches a node homed here only if the node is directly reachable. A
# node behind NAT that serves clients needs its relays in "everyone" mode.
Expand Down
2 changes: 1 addition & 1 deletion ansible/roles/sponsord/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ decdn_rustup_sha256:
# The decdn/sponsord release (tag v<version>) this repo pins. Keep it equal to
# sponsord_onramp_version: both come from one workspace release (README.md,
# "Bumping the sponsord release"; make test-scripts checks the defaults agree).
sponsord_version: "0.0.4" # asserted non-empty in "release" mode
sponsord_version: "0.1.0" # asserted non-empty in "release" mode
# Release target triple, derived from the host's gathered architecture (see
# vars/main/arch.yml). Set it explicitly only for a play with gather_facts: false.
sponsord_target: "{{ _sponsord_arch_targets.get(ansible_facts.get('architecture', ''), '') }}"
Expand Down
2 changes: 1 addition & 1 deletion ansible/roles/sponsord_onramp/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ the public side of the deCDN onboarding sponsor. It serves:
their download;
- the `decdn.sh` / `decdn.ps1` installers, which install `decdn` from a pinned
release, make a throwaway download key, get the capability through the gate and
run `decdn bundle pull` with it;
run `decdn get` with it;
- the API the installers poll for that capability.

It holds no wallet. For each person who passes the gate it asks the
Expand Down
2 changes: 1 addition & 1 deletion ansible/roles/sponsord_onramp/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ decdn_rustup_sha256:
# --- Release to install ("release" mode) ----------------------------------------
# The decdn/sponsord release (tag v<version>) this repo pins, the
# same one as the sponsord role's sponsord_version.
sponsord_onramp_version: "0.0.4" # asserted non-empty in "release" mode
sponsord_onramp_version: "0.1.0" # asserted non-empty in "release" mode

@thiras thiras Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed: sponsord-onramp v0.1.0's installers run decdn get, which decdn v0.0.4 lacks, so this could never merge alone (and #158 alone has the mirror-image break). This commit is now folded into #158 as 1db2236, so both pins move in one merge; closing this PR.

# Derived from the host's gathered architecture (vars/main/arch.yml).
sponsord_onramp_target: "{{ _sponsord_onramp_arch_targets.get(ansible_facts.get('architecture', ''), '') }}"
sponsord_onramp_release_base: "https://github.com/decdn/sponsord/releases/download"
Expand Down
4 changes: 2 additions & 2 deletions compose/.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,9 +42,9 @@ DECDN_ENV_FILE=/etc/decdn/decdn.env

# --- sponsord and onramp ----------------------------------------------------------
# The decdn/sponsord release sponsord_version pins: one release for both images
SPONSORD_IMAGE_DIGEST=sha256:120982625257b28cf785c776cb2cc7a6c6cd8e2e5958b274f1a43d27ab857eea
SPONSORD_IMAGE_DIGEST=sha256:8f82f8f88ce75be0072abc8f72e0462e03c0afba8035fe8671d6ee79ebbc930b
# SPONSORD_IMAGE_REPO=ghcr.io/decdn/sponsord
SPONSORD_ONRAMP_IMAGE_DIGEST=sha256:76362c0de04d3febf43b39ee1d00bd29d45a1b4338fc3f8fb0427d52d5b13805
SPONSORD_ONRAMP_IMAGE_DIGEST=sha256:f0a2701a717c9cdd0ec0969866be30ccbf82773e08c7f25405413f543281a2df
# SPONSORD_ONRAMP_IMAGE_REPO=ghcr.io/decdn/sponsord-onramp

# uid/gid of the host's dedicated `sponsord` system account, which owns the
Expand Down
2 changes: 1 addition & 1 deletion compose/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -398,7 +398,7 @@ udp/7842 itself, so it cannot share a host with `onramp`, `caddy` or `dns`.
`decdn whoami` as the node's user) and add each `node id` to `access` in the
config. `check` refuses an empty list, which would admit nobody. Update every
relay after adding a node or rotating its key, then `restart iroh-relay`.
- **What it costs:** decdn clients (`decdn fetch`, onramp users) use a fresh key
- **What it costs:** decdn clients (`decdn get`, onramp users) use a fresh key
per fetch, so they can never be listed, and iroh hole-punches over a connection
it already has. A client therefore reaches a node homed on an allowlisted relay
only if the node is directly reachable. A node behind NAT that serves clients
Expand Down
4 changes: 2 additions & 2 deletions examples/collection-fleet/inventory/group_vars/sponsord_hosts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,11 @@
# The default method, "release", installs the decdn/sponsord release the role pins
# (tag v<sponsord_version>); set it only to hold the host on another one, together
# with sponsord_onramp_version:
# sponsord_version: "0.0.4"
# sponsord_version: "0.1.0"
# Or build on the host from a git ref (tag, branch or SHA; sponsord_version is not
# checked in this mode):
# sponsord_install_method: source
# sponsord_source_ref: v0.0.4
# sponsord_source_ref: v0.1.0
# Or copy a control-machine build: a decdn/sponsord checkout's target dir
# (`cargo build --release -p sponsord`; the role checks the ELF matches the host).
# sponsord_install_method: manual
Expand Down
4 changes: 2 additions & 2 deletions examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@
# --- Binary ------------------------------------------------------------------------
# The same three methods as sponsord. "release" (default) installs the same release
# as the sponsord role; set both versions together to hold the host on another:
# sponsord_onramp_version: "0.0.4"
# sponsord_onramp_version: "0.1.0"
# Or build on the host (its own checkout, so it may pin a different ref):
# sponsord_onramp_install_method: source
# sponsord_onramp_source_ref: v0.0.4
# sponsord_onramp_source_ref: v0.1.0
# Or manual, which follows sponsord_release_target_dir (`cargo build --release` in
# a decdn/sponsord checkout builds both binaries):
# sponsord_onramp_install_method: manual
Expand Down
Loading