# knotless-fork-infra

Our [knotless fork](https://knotless.dev/johnandersen777.bsky.social/knotless) (branch `runner-atlibs-composition`), deployed:

| | |
|---|---|
| https://knotless.socialweb.computer | knotless-serve + pages |
| https://knotless-runner.socialweb.computer | `knotless-run --executor composition`: CI on an [atlibs composition](REPORT.md) |

## Sign in

Log in → your handle → Log in.

![home](docs/img/01-home.png)
![log in](docs/img/02-log-in.png)

Authorize on your PDS.

![authorize](docs/img/03-authorize.png)
![signed in](docs/img/04-signed-in.png)

## Set up CI on a composition

**+** → name → Create repository.

![new repository](docs/img/05-new-repo.png)

Settings › Actions › Runners: `aliceoa.bsky.social` (new repositories here name it already).

![runners](docs/img/06-runners.png)

Settings › Executor: `bobvmbuilder.bsky.social/socialweb-computer-cicd` → Look it up → bidders → Bind it.
Runner: `https://knotless-runner.socialweb.computer` → follow the sign-in link.

```json
["did:plc:4vcig7s43z3nyqrnepmcfzqt", "did:plc:7q5lnitxv4meizdon5fmhzrq"]
```

![bind](docs/img/07-bind.png)
![bound](docs/img/08-bound.png)

Authorize the composition at the runner: its own client, only its modules' scopes.

![runner authorize](docs/img/09-runner-authorize.png)
![runner signed in](docs/img/10-runner-signed-in.png)

## Push

```sh
export KNOTLESS_APPVIEW=https://knotless.socialweb.computer
knotless login you.bsky.social
git init -q -b main kc-ci-demo && cd kc-ci-demo
echo 42 > answer.txt && git add . && git commit -q -m answer
git remote add origin knotless://you.bsky.social/kc-ci-demo
git push -u origin main
```

![pushed](docs/img/11-pushed.png)

A workflow: each push to main rents a VM, runs the steps, releases it.

```sh
mkdir -p .knotless/workflows && cat > .knotless/workflows/ci.yml <<'EOF'
on:
  push:
    refs: [refs/heads/main]
steps:
  - name: where
    run: uname -a && id -un && pwd && git log --oneline -1
  - name: test
    run: test "$(cat answer.txt)" = 42 && echo "answer ok"
EOF
git add . && git commit -q -m ci && git push
```

Checks: rented, steps run, released.

![check](docs/img/12-check.png)

## Deploy

Build on hat-8, ship to the socialweb.computer gateway, run as systemd-managed docker containers behind its Caddy.

```sh
git clone https://knotless.dev/johnandersen777.bsky.social/knotless-fork-infra && cd knotless-fork-infra
scripts/build.sh
scripts/deploy.sh
scripts/deploy.sh rollback   # back to the image the last deploy replaced
```

| File | |
|---|---|
| `versions.env` | fork commit, base images by digest |
| `scripts/build.sh` | `knotless-fork:<commit>` on hat-8 |
| `Dockerfile` | the fork's image + `dumbpipe` and `ssh` (atlibs-iroh reaches a rented machine with them) |
| `scripts/deploy.sh` | `docker save \| docker load` to the gateway, units, Caddy (backup, validate, reload), restart |
| `host/systemd/` | serve `127.0.0.1:2590`, pages (network only), runner `127.0.0.1:8796` |
| `host/caddy/` | `/etc/caddy/sites/knotless*.caddy` |
| `host/knotless-fork.env` | `/etc/knotless-fork/knotless-fork.env`: domains, DIDs; no secrets |

Caps (4 vCPU / 8 GB host): serve 1.5 CPU 1.5 GB, pages 1 CPU 512 MB, runner 1 CPU 512 MB; `--cpu-shares 256` each, so the gateway wins contention.

Once, after the first deploy: the runner's account logs in at
`https://knotless.socialweb.computer/oauth/bot?account=aliceoa.bsky.social`.

State: `/var/lib/knotless-fork/{serve,runner}` on the gateway.

Unlicense.