New Docker Build

.dockerignore

@@ -0,0 +1,17 @@
+.git
+.github
+.idea
+.vs
+.env
+.env.*
+!.env.example
+**/bin
+**/obj
+**/TestResults
+**/*.user
+**/*.suo
+coverage
+artifacts
+data
+Test.TruthGate
+TruthGate-Web/TruthGate-Web.Tests

.env.example

@@ -0,0 +1,55 @@
+# Tested multi-platform release. Override this to pin a version or use a local image.
+TRUTHGATE_IMAGE=magiccodingman/truthgate-ipfs:stable
+
+# Build inputs. Both official base images are multi-platform.
+DOTNET_VERSION=10.0
+KUBO_VERSION=v0.42.0
+TRUTHGATE_UID=1000
+TRUTHGATE_GID=1000
+
+# Host ports.
+TRUTHGATE_HTTP_PORT=80
+TRUTHGATE_HTTPS_PORT=443
+TRUTHGATE_DEV_HTTP_PORT=8080
+IPFS_SWARM_PORT=4001
+
+# Persistent host paths. The blockstore is always separate so it can later be
+# moved to different storage without changing the container's Kubo layout.
+TRUTHGATE_DATA_HOST_PATH=./data/truthgate
+IPFS_REPO_HOST_PATH=./data/ipfs/repo
+IPFS_BLOCKS_HOST_PATH=./data/ipfs/blocks
+
+# Certificate behavior.
+TRUTHGATE_ACME_STAGING=false
+# Optional comma-separated IP addresses for the self-signed fallback cert.
+TRUTHGATE_CERT_IPS=
+
+# TruthGate creates data/truthgate/config/kubo-settings.json on first boot.
+# That persistent file contains the normal server defaults and is the future
+# control-plane contract for the TruthGate UI. Uncomment any value below to
+# override the corresponding persistent setting from Docker/Compose.
+#
+# TRUTHGATE_KUBO_APPLY_SERVER_PROFILE=true
+# TRUTHGATE_KUBO_ENSURE_SWARM_LISTENERS=true
+# TRUTHGATE_KUBO_ROUTING_TYPE=dhtserver
+# TRUTHGATE_KUBO_HOLE_PUNCHING=true
+# TRUTHGATE_KUBO_RELAY_CLIENT=true
+# TRUTHGATE_KUBO_PROVIDE_ENABLED=true
+# TRUTHGATE_KUBO_PROVIDE_STRATEGY=all
+# TRUTHGATE_KUBO_PROVIDE_INTERVAL=22h
+# TRUTHGATE_KUBO_PROVIDE_SWEEP=true
+# TRUTHGATE_KUBO_PROVIDE_RESUME=true
+#
+# Storage can be "auto" or any Kubo size such as 750GB, 2TB, or 5TiB.
+# Auto uses the configured percentage of the filesystem containing the blockstore.
+# TRUTHGATE_KUBO_STORAGE_MAX=auto
+# TRUTHGATE_KUBO_STORAGE_PERCENT=90
+# TRUTHGATE_KUBO_STORAGE_FALLBACK=200GB
+# TRUTHGATE_KUBO_STORAGE_GC_WATERMARK=90
+# TRUTHGATE_KUBO_ENABLE_GC=true
+#
+# Public addresses can be "auto", "off", or a literal address. The announce
+# port defaults to IPFS_SWARM_PORT so non-default Docker host mappings work.
+# TRUTHGATE_KUBO_PUBLIC_IPV4=auto
+# TRUTHGATE_KUBO_PUBLIC_IPV6=auto
+# TRUTHGATE_KUBO_ANNOUNCE_PORT=4001

.github/workflows/docker-ci.yml

@@ -0,0 +1,235 @@
+name: Reusable Docker appliance CI
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  validate-compose:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate production Compose
+        run: docker compose -f compose.yaml config
+
+      - name: Validate development override
+        run: docker compose -f compose.yaml -f compose.dev.yaml config
+
+      - name: Validate container scripts
+        run: |
+          bash -n docker/entrypoint.sh
+          bash -n docker/healthcheck.sh
+          bash -n docker/kubo-configure.sh
+          bash -n docker/kubo-status.sh
+
+  smoke-test:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - architecture: amd64
+            runner: ubuntu-24.04
+          - architecture: arm64
+            runner: ubuntu-24.04-arm
+
+    runs-on: ${{ matrix.runner }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build production image (${{ matrix.architecture }})
+        shell: bash
+        run: |
+          set -o pipefail
+          docker build \
+            --progress=plain \
+            --platform linux/${{ matrix.architecture }} \
+            --target production \
+            --tag truthgate-ipfs:test-${{ matrix.architecture }} \
+            . 2>&1 | tee production-image-build-${{ matrix.architecture }}.log
+
+      - name: Upload production build diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: production-image-build-${{ matrix.architecture }}
+          path: production-image-build-${{ matrix.architecture }}.log
+          if-no-files-found: error
+
+      - name: Build development image (${{ matrix.architecture }})
+        shell: bash
+        run: |
+          set -o pipefail
+          docker build \
+            --progress=plain \
+            --platform linux/${{ matrix.architecture }} \
+            --target development \
+            --tag truthgate-ipfs:dev-test-${{ matrix.architecture }} \
+            . 2>&1 | tee development-image-build-${{ matrix.architecture }}.log
+
+      - name: Upload development build diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: development-image-build-${{ matrix.architecture }}
+          path: development-image-build-${{ matrix.architecture }}.log
+          if-no-files-found: ignore
+
+      - name: Start, replace, and revalidate the appliance
+        shell: bash
+        run: |
+          exec > >(tee runtime-smoke-${{ matrix.architecture }}.log) 2>&1
+          set -Eeuo pipefail
+
+          export TRUTHGATE_IMAGE=truthgate-ipfs:test-${{ matrix.architecture }}
+          export TRUTHGATE_HTTP_PORT=18080
+          export TRUTHGATE_HTTPS_PORT=18443
+          export IPFS_SWARM_PORT=14001
+          export TRUTHGATE_KUBO_PUBLIC_IPV4=off
+          export TRUTHGATE_KUBO_PUBLIC_IPV6=off
+          export TRUTHGATE_DATA_HOST_PATH=./.ci-data/truthgate
+          export IPFS_REPO_HOST_PATH=./.ci-data/ipfs/repo
+          export IPFS_BLOCKS_HOST_PATH=./.ci-data/ipfs/blocks
+
+          cleanup() {
+            docker compose logs --no-color 2>/dev/null || true
+            docker compose down --remove-orphans 2>/dev/null || true
+          }
+          trap cleanup EXIT
+
+          wait_for_health() {
+            for attempt in $(seq 1 60); do
+              status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' truthgate)"
+              if [[ "${status}" == "healthy" ]]; then
+                return 0
+              fi
+
+              if [[ "${status}" == "unhealthy" ]]; then
+                echo "TruthGate became unhealthy."
+                return 1
+              fi
+
+              sleep 5
+            done
+
+            echo "TruthGate did not become healthy in time."
+            return 1
+          }
+
+          read_peer_id() {
+            docker exec truthgate \
+              ipfs --api=/ip4/127.0.0.1/tcp/5001 id \
+              | python3 -c 'import json, sys; print(json.load(sys.stdin)["ID"])'
+          }
+
+          read_bootstrap_hash() {
+            docker exec truthgate \
+              sha256sum /data/truthgate/state/bootstrap-admin-password \
+              | cut -d' ' -f1
+          }
+
+          read_settings_hash() {
+            docker exec truthgate \
+              sha256sum /data/truthgate/config/kubo-settings.json \
+              | cut -d' ' -f1
+          }
+
+          validate_truthgate_portal() {
+            local asset=/tmp/truthgate-blazor.web.js
+
+            curl \
+              --silent \
+              --show-error \
+              --fail \
+              --insecure \
+              --header 'Accept-Encoding: identity' \
+              --output "${asset}" \
+              https://127.0.0.1:18443/_framework/blazor.web.js
+
+            local size
+            size="$(wc -c <"${asset}")"
+            echo "Blazor bootstrap size: ${size} bytes"
+            test "${size}" -gt 10000
+          }
+
+          validate_kubo_server_defaults() {
+            test "$(docker exec truthgate ipfs config Routing.Type)" = "dhtserver"
+            test "$(docker exec truthgate ipfs config Swarm.EnableHolePunching)" = "true"
+            test "$(docker exec truthgate ipfs config Swarm.RelayClient.Enabled)" = "true"
+            test "$(docker exec truthgate ipfs config Provide.Enabled)" = "true"
+            test "$(docker exec truthgate ipfs config Provide.Strategy)" = "all"
+            test "$(docker exec truthgate ipfs config Provide.DHT.Interval)" = "22h"
+            test "$(docker exec truthgate ipfs config Provide.DHT.SweepEnabled)" = "true"
+            test "$(docker exec truthgate ipfs config Provide.DHT.ResumeEnabled)" = "true"
+            test "$(docker exec truthgate ipfs config Datastore.StorageGCWatermark)" = "90"
+
+            storage_max="$(docker exec truthgate ipfs config Datastore.StorageMax)"
+            test "${storage_max}" != "10GB"
+            [[ "${storage_max}" =~ ^[0-9]+B$ ]]
+
+            docker exec truthgate test -s /data/truthgate/state/kubo-server-profile-v1
+            docker exec truthgate test -s /data/truthgate/config/kubo-settings.json
+            docker exec truthgate test -s /data/truthgate/config/kubo-overrides.json
+
+            docker exec truthgate \
+              ipfs config --json Addresses.Swarm \
+              | jq -e '
+                  index("/ip4/0.0.0.0/tcp/4001") and
+                  index("/ip6/::/tcp/4001") and
+                  index("/ip4/0.0.0.0/udp/4001/quic-v1") and
+                  index("/ip4/0.0.0.0/udp/4001/quic-v1/webtransport") and
+                  index("/ip6/::/udp/4001/quic-v1") and
+                  index("/ip6/::/udp/4001/quic-v1/webtransport")
+                '
+
+            test "$(docker exec truthgate ipfs config Addresses.API)" = "/ip4/127.0.0.1/tcp/5001"
+            test "$(docker exec truthgate ipfs config Addresses.Gateway)" = "/ip4/127.0.0.1/tcp/9010"
+            docker exec truthgate truthgate-kubo-status
+          }
+
+          mkdir -p .ci-data/truthgate .ci-data/ipfs/repo .ci-data/ipfs/blocks
+
+          docker compose up --detach --no-build
+          wait_for_health
+
+          # Read protected state from inside the container. The host runner is
+          # intentionally unable to inspect the bootstrap secret directly.
+          docker exec truthgate test -s /data/ipfs/repo/config
+          docker exec truthgate test -s /data/truthgate/state/bootstrap-admin-password
+          validate_truthgate_portal
+          validate_kubo_server_defaults
+          peer_id_before="$(read_peer_id)"
+          bootstrap_hash_before="$(read_bootstrap_hash)"
+          settings_hash_before="$(read_settings_hash)"
+
+          # Replace the container while retaining only the documented bind-mounted
+          # state. Kubo identity, managed settings, and first-run credentials must
+          # remain stable.
+          docker compose down --remove-orphans
+          docker compose up --detach --no-build
+          wait_for_health
+
+          docker exec truthgate test -s /data/ipfs/repo/config
+          docker exec truthgate test -s /data/truthgate/state/bootstrap-admin-password
+          validate_truthgate_portal
+          validate_kubo_server_defaults
+          peer_id_after="$(read_peer_id)"
+          bootstrap_hash_after="$(read_bootstrap_hash)"
+          settings_hash_after="$(read_settings_hash)"
+
+          test "${peer_id_before}" = "${peer_id_after}"
+          test "${bootstrap_hash_before}" = "${bootstrap_hash_after}"
+          test "${settings_hash_before}" = "${settings_hash_after}"
+
+          docker compose logs --no-color
+
+      - name: Upload runtime diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: runtime-smoke-${{ matrix.architecture }}
+          path: runtime-smoke-${{ matrix.architecture }}.log
+          if-no-files-found: ignore