Add single-container Docker appliance and multi-arch publishing

.dockerignore

@@ -0,0 +1,17 @@
+.git
+.github
+.idea
+.vs
+.env
+.env.*
+!.env.example
+**/bin
+**/obj
+**/TestResults
+**/*.user
+**/*.suo
+coverage
+artifacts
+data
+Test.TruthGate
+TruthGate-Web/TruthGate-Web.Tests

.env.example

@@ -0,0 +1,55 @@
+# Published image. Local builds use the same Compose file and can override this.
+TRUTHGATE_IMAGE=ghcr.io/magiccodingman/truthgate-ipfs:master
+
+# Build inputs. Both official base images are multi-platform.
+DOTNET_VERSION=10.0
+KUBO_VERSION=v0.42.0
+TRUTHGATE_UID=1000
+TRUTHGATE_GID=1000
+
+# Host ports.
+TRUTHGATE_HTTP_PORT=80
+TRUTHGATE_HTTPS_PORT=443
+TRUTHGATE_DEV_HTTP_PORT=8080
+IPFS_SWARM_PORT=4001
+
+# Persistent host paths. The blockstore is always separate so it can later be
+# moved to different storage without changing the container's Kubo layout.
+TRUTHGATE_DATA_HOST_PATH=./data/truthgate
+IPFS_REPO_HOST_PATH=./data/ipfs/repo
+IPFS_BLOCKS_HOST_PATH=./data/ipfs/blocks
+
+# Certificate behavior.
+TRUTHGATE_ACME_STAGING=false
+# Optional comma-separated IP addresses for the self-signed fallback cert.
+TRUTHGATE_CERT_IPS=
+
+# TruthGate creates data/truthgate/config/kubo-settings.json on first boot.
+# That persistent file contains the normal server defaults and is the future
+# control-plane contract for the TruthGate UI. Uncomment any value below to
+# override the corresponding persistent setting from Docker/Compose.
+#
+# TRUTHGATE_KUBO_APPLY_SERVER_PROFILE=true
+# TRUTHGATE_KUBO_ENSURE_SWARM_LISTENERS=true
+# TRUTHGATE_KUBO_ROUTING_TYPE=dhtserver
+# TRUTHGATE_KUBO_HOLE_PUNCHING=true
+# TRUTHGATE_KUBO_RELAY_CLIENT=true
+# TRUTHGATE_KUBO_PROVIDE_ENABLED=true
+# TRUTHGATE_KUBO_PROVIDE_STRATEGY=all
+# TRUTHGATE_KUBO_PROVIDE_INTERVAL=22h
+# TRUTHGATE_KUBO_PROVIDE_SWEEP=true
+# TRUTHGATE_KUBO_PROVIDE_RESUME=true
+#
+# Storage can be "auto" or any Kubo size such as 750GB, 2TB, or 5TiB.
+# Auto uses the configured percentage of the filesystem containing the blockstore.
+# TRUTHGATE_KUBO_STORAGE_MAX=auto
+# TRUTHGATE_KUBO_STORAGE_PERCENT=90
+# TRUTHGATE_KUBO_STORAGE_FALLBACK=200GB
+# TRUTHGATE_KUBO_STORAGE_GC_WATERMARK=90
+# TRUTHGATE_KUBO_ENABLE_GC=true
+#
+# Public addresses can be "auto", "off", or a literal address. The announce
+# port defaults to IPFS_SWARM_PORT so non-default Docker host mappings work.
+# TRUTHGATE_KUBO_PUBLIC_IPV4=auto
+# TRUTHGATE_KUBO_PUBLIC_IPV6=auto
+# TRUTHGATE_KUBO_ANNOUNCE_PORT=4001

.github/workflows/docker-repo-migration.yml

@@ -0,0 +1,120 @@
+name: Docker repository migration
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docker-repo-migration-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  migrate-kubo-repository:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - architecture: amd64
+            runner: ubuntu-24.04
+          - architecture: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build production image (${{ matrix.architecture }})
+        run: |
+          docker build \
+            --platform linux/${{ matrix.architecture }} \
+            --target production \
+            --tag truthgate-ipfs:migration-test-${{ matrix.architecture }} \
+            .
+
+      - name: Create a Kubo 0.36 repository and verify automatic migration
+        shell: bash
+        run: |
+          exec > >(tee repo-migration-${{ matrix.architecture }}.log) 2>&1
+          set -Eeuo pipefail
+
+          export TRUTHGATE_IMAGE=truthgate-ipfs:migration-test-${{ matrix.architecture }}
+          export TRUTHGATE_HTTP_PORT=18080
+          export TRUTHGATE_HTTPS_PORT=18443
+          export IPFS_SWARM_PORT=14001
+          export TRUTHGATE_KUBO_PUBLIC_IPV4=off
+          export TRUTHGATE_KUBO_PUBLIC_IPV6=off
+          export TRUTHGATE_DATA_HOST_PATH=./.ci-migration/truthgate
+          export IPFS_REPO_HOST_PATH=./.ci-migration/ipfs/repo
+          export IPFS_BLOCKS_HOST_PATH=./.ci-migration/ipfs/blocks
+
+          cleanup() {
+            docker compose logs --no-color 2>/dev/null || true
+            docker compose down --remove-orphans 2>/dev/null || true
+          }
+          trap cleanup EXIT
+
+          rm -rf .ci-migration
+          mkdir -p \
+            .ci-migration/truthgate \
+            .ci-migration/ipfs/repo \
+            .ci-migration/ipfs/blocks
+
+          docker run --rm \
+            --user 0:0 \
+            --entrypoint /usr/local/bin/ipfs \
+            --env IPFS_PATH=/data/ipfs/repo \
+            --volume "$PWD/.ci-migration/ipfs/repo:/data/ipfs/repo" \
+            --volume "$PWD/.ci-migration/ipfs/blocks:/data/ipfs/repo/blocks" \
+            ipfs/kubo:v0.36.0 \
+            init --profile server
+
+          test "$(sudo tr -d '[:space:]' < .ci-migration/ipfs/repo/version)" = "16"
+          peer_id_before="$(sudo jq -r '.Identity.PeerID' .ci-migration/ipfs/repo/config)"
+          test -n "${peer_id_before}"
+
+          sudo chown -R 1000:1000 .ci-migration
+
+          docker compose up --detach --no-build
+
+          for attempt in $(seq 1 60); do
+            state="$(docker inspect --format '{{.State.Status}}' truthgate)"
+            health="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' truthgate)"
+            echo "Attempt ${attempt}: state=${state} health=${health}"
+
+            if [[ "${health}" == "healthy" ]]; then
+              break
+            fi
+
+            if [[ "${state}" == "exited" || "${health}" == "unhealthy" ]]; then
+              docker compose logs --no-color
+              exit 1
+            fi
+
+            sleep 5
+          done
+
+          test "$(docker inspect --format '{{.State.Health.Status}}' truthgate)" = "healthy"
+          test "$(docker exec truthgate cat /data/ipfs/repo/version | tr -d '[:space:]')" = "18"
+
+          peer_id_after="$(docker exec truthgate ipfs config Identity.PeerID)"
+          test "${peer_id_before}" = "${peer_id_after}"
+
+          docker compose logs --no-color \
+            | grep -F "Migrating Kubo repository from version 16 to 18 before applying managed configuration."
+          docker compose logs --no-color \
+            | grep -F "Kubo repository migration completed at version 18."
+
+          test "$(docker exec truthgate ipfs config Routing.Type)" = "dhtserver"
+          test "$(docker exec truthgate ipfs config Provide.Strategy)" = "all"
+          docker exec truthgate truthgate-kubo-status
+
+      - name: Upload migration diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: repo-migration-${{ matrix.architecture }}
+          path: repo-migration-${{ matrix.architecture }}.log
+          if-no-files-found: ignore