docs: add workspace registry installation manuals

2026-08-04 07:57:09 +02:00
parent 802b564200
commit 72e16dd5ea
6 changed files with 584 additions and 0 deletions
@@ -0,0 +1,46 @@
+# Standalone local registry example. Copy beside the clone as compose.workspace-registry.yaml
+# and put path-only bindings in .env; keep the referenced files outside Git.
+name: thothii-workspace-registry-local
+
+services:
+  core:
+    image: thothii-core:local
+    build:
+      context: ../../..
+      dockerfile: docker/core.Dockerfile
+    environment:
+      HOST: 0.0.0.0
+      PORT: "8787"
+      AUTH_MODE: none
+      THT_SESSION_STORAGE: local
+      THT_HOME: /data/local-home
+      SETTINGS_FILE: /data/settings/settings.json
+      THT_HARNESS_DIR: /app/harness
+      THT_BIN: /opt/venv/bin/tht
+      THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry
+      THT_WORKSPACE_GIT_REMOTE: ${THT_WORKSPACE_GIT_REMOTE:-ssh://git@git.example.invalid/platform/thoth-workspaces.git}
+      THT_WORKSPACE_GIT_BRANCH: ${THT_WORKSPACE_GIT_BRANCH:-main}
+      THT_WORKSPACE_INSTALLATION_ID: ${THT_WORKSPACE_INSTALLATION_ID:-local-laptop}
+      THT_WORKSPACE_GIT_AUTHOR_NAME: ${THT_WORKSPACE_GIT_AUTHOR_NAME:-Thoth Workspace Registry}
+      THT_WORKSPACE_GIT_AUTHOR_EMAIL: ${THT_WORKSPACE_GIT_AUTHOR_EMAIL:-thoth-workspace-registry@localhost}
+      THT_WORKSPACE_SECRET_ROOTS: /run/secrets
+      GIT_CONFIG_COUNT: "2"
+      GIT_CONFIG_KEY_0: credential.helper
+      GIT_CONFIG_VALUE_0: store --file=/run/secrets/workspace-registry-git-credentials
+      GIT_CONFIG_KEY_1: http.sslCAInfo
+      GIT_CONFIG_VALUE_1: /run/secrets/workspace-registry-git-ca
+      GIT_SSH_COMMAND: ssh -i /run/secrets/workspace-registry-git-ssh-key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/run/secrets/workspace-registry-git-known-hosts
+    ports:
+      - "127.0.0.1:8787:8787"
+    volumes:
+      - thoth-local-data:/data
+      - workspace-registry:/data/workspace-registry
+      - ${THT_WORKSPACE_GIT_CREDENTIALS_FILE:-./installation-secrets/git-credentials}:/run/secrets/workspace-registry-git-credentials:ro
+      - ${THT_WORKSPACE_GIT_CA_FILE:-./installation-secrets/git-ca.pem}:/run/secrets/workspace-registry-git-ca:ro
+      - ${THT_WORKSPACE_GIT_SSH_KEY_FILE:-./installation-secrets/git-ssh-key}:/run/secrets/workspace-registry-git-ssh-key:ro
+      - ${THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE:-./installation-secrets/git-known-hosts}:/run/secrets/workspace-registry-git-known-hosts:ro
+    restart: "no"
+
+volumes:
+  thoth-local-data: {}
+  workspace-registry: {}
@@ -0,0 +1,47 @@
+# Server registry example. Copy to a reviewed, untracked operator directory and set host paths
+# and Git values in its .env. The core remains non-root (UID 10001) and never receives secrets
+# through the Git checkout.
+name: thothii-workspace-registry-server
+
+services:
+  core:
+    image: thothii-core:local
+    build:
+      context: ../../..
+      dockerfile: docker/core.Dockerfile
+    environment:
+      HOST: 0.0.0.0
+      PORT: "8787"
+      AUTH_MODE: upstream
+      THOTH_PUBLIC_EXPOSURE: "true"
+      THT_HARNESS_DIR: /app/harness
+      THT_BIN: /opt/venv/bin/tht
+      SETTINGS_FILE: /data/settings/settings.json
+      THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry
+      THT_WORKSPACE_GIT_REMOTE: ${THT_WORKSPACE_GIT_REMOTE:-ssh://git@git.example.invalid/platform/thoth-workspaces.git}
+      THT_WORKSPACE_GIT_BRANCH: ${THT_WORKSPACE_GIT_BRANCH:-main}
+      THT_WORKSPACE_INSTALLATION_ID: ${THT_WORKSPACE_INSTALLATION_ID:-production-1}
+      THT_WORKSPACE_GIT_AUTHOR_NAME: ${THT_WORKSPACE_GIT_AUTHOR_NAME:-Thoth Workspace Registry}
+      THT_WORKSPACE_GIT_AUTHOR_EMAIL: ${THT_WORKSPACE_GIT_AUTHOR_EMAIL:-thoth-workspace-registry@localhost}
+      THT_WORKSPACE_SECRET_ROOTS: /run/secrets
+      GIT_CONFIG_COUNT: "2"
+      GIT_CONFIG_KEY_0: credential.helper
+      GIT_CONFIG_VALUE_0: store --file=/run/secrets/workspace-registry-git-credentials
+      GIT_CONFIG_KEY_1: http.sslCAInfo
+      GIT_CONFIG_VALUE_1: /run/secrets/workspace-registry-git-ca
+      GIT_SSH_COMMAND: ssh -i /run/secrets/workspace-registry-git-ssh-key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/run/secrets/workspace-registry-git-known-hosts
+    volumes:
+      - ${THT_HOST_DATA_ROOT:-/srv/thothii/data}:/data
+      - ${THT_WORKSPACE_REGISTRY_HOST_PATH:-/srv/thothii/workspace-registry}:/data/workspace-registry
+      - ${THT_WORKSPACE_GIT_CREDENTIALS_FILE:-/srv/thothii/secrets/git-credentials}:/run/secrets/workspace-registry-git-credentials:ro
+      - ${THT_WORKSPACE_GIT_CA_FILE:-/srv/thothii/secrets/git-ca.pem}:/run/secrets/workspace-registry-git-ca:ro
+      - ${THT_WORKSPACE_GIT_SSH_KEY_FILE:-/srv/thothii/secrets/git-ssh-key}:/run/secrets/workspace-registry-git-ssh-key:ro
+      - ${THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE:-/srv/thothii/secrets/git-known-hosts}:/run/secrets/workspace-registry-git-known-hosts:ro
+    networks:
+      - portal
+    restart: unless-stopped
+
+networks:
+  portal:
+    external: true
+    name: ${THT_PORTAL_NETWORK:-omics_portal_omics_network}