gravityfargo/bluesky-pds-docker
1
0
Fork 0
Code Issues 1 Pull requests Packages 1 Activity

Merge pull request 'non-root' (!2) from non-root into main

Browse source 
Reviewed-on: https://forgejo.gravityfargo.dev/gravityfargo/bluesky-pds-docker/pulls/2
This commit is contained in:
Nathan Price 2024-12-10 21:58:03 +00:00
commit 8e0c0485f2
9 changed files with 232 additions and 121 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.dockerignore
View file

@ -6,3 +6,4 @@ config/
.vscode/ .vscode/
Makefile Makefile
README.md README.md
base/

60
Dockerfile
View file

@ -1,50 +1,3 @@
################################################################################
# adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/Dockerfile
################################################################################
FROM node:20.11-bookworm-slim AS pds-build
RUN npm install -g pnpm && apt-get update && apt-get -y install unzip
# Download and extract the PDS archive
WORKDIR /app
ADD https://github.com/bluesky-social/pds/archive/refs/tags/v0.4.74.zip .
RUN unzip v0.4.74.zip && \
mv pds-0.4.74/service/** . && \
mv pds-0.4.74/pdsadmin.sh .
RUN pnpm install --prod=true --frozen-lockfile
################################################################################
# adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/Dockerfile
################################################################################
FROM node:20.11-bookworm-slim AS pds-runtime
RUN apt-get update && apt-get install -y \
dumb-init \
ca-certificates \
curl \
gnupg \
jq \
lsb-release \
openssl \
sqlite3 \
bsdextrautils \
xxd
# bsdextrautils for `column` command in the accounts script
WORKDIR /app
COPY --from=pds-build /app /app
EXPOSE 3000
ENV PDS_PORT=3000
ENV NODE_ENV=production
# potential perf issues w/ io_uring on this version of node
ENV UV_USE_IO_URING=0
LABEL org.opencontainers.image.source="https://github.com/bluesky-social/pds"
LABEL org.opencontainers.image.description="AT Protocol PDS"
LABEL org.opencontainers.image.licenses="MIT"
################################################################################ ################################################################################
# adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/installer.sh # adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/installer.sh
################################################################################ ################################################################################
@ -69,11 +22,22 @@ RUN mv pdsadmin.sh /usr/local/bin/pdsadmin && \
apt-get clean && \ apt-get clean && \
rm -rf /var/lib/apt/lists/* rm -rf /var/lib/apt/lists/*
ENV PUID=1000
ENV PGID=1000
RUN groupadd --gid ${PGID} pds
RUN useradd --home=${PDS_DATADIR} --uid=${PUID} --no-user-group pds
RUN usermod --gid ${PGID} pds
RUN chown -R pds:pds ${PDS_DATADIR}
ENTRYPOINT ["dumb-init", "--"] ENTRYPOINT ["dumb-init", "--"]
COPY entrypoint.sh /entrypoint.sh COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh RUN chmod +x /entrypoint.sh
CMD ["/entrypoint.sh"]
CMD ["sh", "-c", "chown -R ${PUID}:${PGID} /pds && su pds && /entrypoint.sh"]
LABEL org.opencontainers.image.source="https://forgejo.gravityfargo.dev/gravityfargo/bluesky-pds-docker" LABEL org.opencontainers.image.source="https://forgejo.gravityfargo.dev/gravityfargo/bluesky-pds-docker"
LABEL org.opencontainers.image.url="https://github.com/bluesky-social/pds" LABEL org.opencontainers.image.url="https://github.com/bluesky-social/pds"

25
Makefile
View file

@ -1,23 +1,20 @@
REGISTRY = forgejo.gravityfargo.dev REGISTRY = forgejo.gravityfargo.dev
OWNER = gravityfargo OWNER = gravityfargo
IMAGE = bluesky-pds IMAGE = bluesky-pds
TAG=0.4.74 TAG ?= 0.4.74
DOMAIN = sheltersky.social DOMAIN = sheltersky.social
export DOCKER_BUILDKIT=1 export DOCKER_BUILDKIT=1
# export BUILDKIT_PROGRESS=plain export BUILDKIT_PROGRESS=plain
.PHONY: build-base
build-base:
docker build --tag pds-runtime ./base
.PHONY: build-tag .PHONY: build-tag
build-tag: build-tag:
docker build --tag $(REGISTRY)/$(OWNER)/$(IMAGE):$(TAG) . sudo rm -rf config
docker build --no-cache --tag $(REGISTRY)/$(OWNER)/$(IMAGE):$(TAG) .
.PHONY: build
build:
docker build --tag $(REGISTRY)/$(OWNER)/$(IMAGE) .
.PHONY: wsdump
wsdump:
wsdump "wss://$(DOMAIN)/xrpc/com.atproto.sync.subscribeRepos?cursor=0"
.PHONY: generate-env .PHONY: generate-env
generate-env: generate-env:
@ -28,7 +25,11 @@ generate-env:
@echo "PDS_JWT_SECRET=$(PDS_JWT_SECRET)" > .env @echo "PDS_JWT_SECRET=$(PDS_JWT_SECRET)" > .env
@echo "PDS_ADMIN_PASSWORD=$(PDS_ADMIN_PASSWORD)" >> .env @echo "PDS_ADMIN_PASSWORD=$(PDS_ADMIN_PASSWORD)" >> .env
@echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)" >> .env @echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)" >> .env
@echo "PDS_HOSTNAME=$(DOMAIN)" >> .env @echo "PDS_HOSTNAME=" >> .env
@echo "PUID=1000" >> .env
@echo "PGID=1000" >> .env
@echo "URL_NAME:" >> .env
@echo "URL_SUFFIX:" >> .env
.PHONY: run .PHONY: run
run: run:

168
README.md
View file

@ -1,93 +1,121 @@
# bluesky-pds-docker # bluesky-pds-docker
A self-contained Docker image for the [Bluesky PDS (Personal Data Server) ](https://github.com/bluesky-social/pds). This image is pinned to v0.4.74.
It is required to run the instance behind a proxy (like traefik) to generate SSL certificates. This will not work otherwise. The standard pds install includes caddy to handle this. A self-contained Docker image for the [Bluesky PDS (Personal Data Server) ](https://github.com/bluesky-social/pds) for use with Traefik. This image is pinned to v0.4.74.
It is required to run the instance behind a proxy (like traefik) to generate SSL certificates. This will not work otherwise. The standard pds install includes caddy to handle this. A wildcard DNS assignment along with a wildcard SSL certificate is required. I use Cloudflare for this, see the screenshot below.
I can confirm it works behind Cloudflare's DNS Proxy with Full (strict). I can confirm it works behind Cloudflare's DNS Proxy with Full (strict).
This is not intended for production, and I am not responsible for any data loss or security issues. This is a personal project, and I am not affiliated with Bluesky.
## Deployment ## Deployment
Before changing images or upgrading, backup the files made in the volume.
### Reqirements
I haven't verified these are the minimum requirements, but they are what I found to be necessary after starting this readme. I probably had some dependencies installed already.
#### Manjaro/Arch
```bash
sudo pacman -S jq
```
#### Debian/Ubunutu
```bash
sudo apt install make xxd
```
### Setup
Generate secrets and add them to `.env` file. See [example.env](example.env) as an example.
```bash ```bash
# Generate secret environment variables # Generate secret environment variables
echo PDS_ADMIN_PASSWORD: $(openssl rand --hex 16) echo PDS_ADMIN_PASSWORD: $(openssl rand --hex 16)
echo PDS_JWT_SECRET: $(openssl rand --hex 16) echo PDS_JWT_SECRET: $(openssl rand --hex 16)
echo PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: $(openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32) echo PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: $(openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32)
# pull and run the container
docker pull forgejo.gravityfargo.dev/gravityfargo/bluesky-pds
docker-compose up -d
# Create an account
docker exec -it bluesky-pds bash
pdsadmin account create
pdsadmin account list
pdsadmin request-crawl bsky.network # useful if you re-deploy the same instance multiple times
``` ```
In your browser: ### Docker Compose Setup
- Go to https://bsky-debug.app/handle and enter your new user, "HTTP Verification Method" needs to pass. Full list of additional Environment Variables provided by bluesky upstream can be found in the [packages/pds/src/config/env.ts](https://github.com/bluesky-social/atproto/blob/main/packages/pds/src/config/env.ts)
- [websocket-tester](https://piehost.com/websocket-tester) "wss://example.com/xrpc/com.atproto.sync.subscribeRepos?cursor=0" needs to display "Connection Established"
- https://boat.kelinci.net/ has a helpful tool to export your data.
- Log in with your new user and go to https://bsky.app/
By default, the image uses 1000:1000 as the UID:GID for the user. This can be changed by setting the `PUID` and `PGID` environment variables.
### Example Docker Compose The compose element `hostname` must be the same value as `PDS_HOSTNAME`.
Full list of additional Environment Variables can be found in the [packages/pds/src/config/env.ts](https://github.com/bluesky-social/atproto/blob/main/packages/pds/src/config/env.ts) #### Traefik
```yaml ```yaml
# Traefik Proxy
services: services:
bluesky-pds: bluesky-pds:
container_name: bluesky-pds container_name: bluesky-pds
image: forgejo.gravityfargo.dev/gravityfargo/bluesky-pds hostname: example.com
image: gravityfargo/bluesky-pds:0.4.74
networks:
- proxy
environment: environment:
# Define variables here or in a .env file
PDS_JWT_SECRET: ... PDS_JWT_SECRET: ...
PDS_ADMIN_PASSWORD: ... PDS_ADMIN_PASSWORD: ...
PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ... PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ...
PDS_HOSTNAME: ...
PDS_EMAIL_SMTP_URL: ""
PDS_EMAIL_FROM_ADDRESS: ""
volumes:
- ./bluesky-pds:/pds
```
### Example Docker Compose with Traefik
```yaml
services:
bluesky-pds:
container_name: bluesky-pds
image: forgejo.gravityfargo.dev/gravityfargo/bluesky-pds:latest
networks:
- proxy
env_file:
PDS_ADMIN_PASSWORD: ""
PDS_JWT_SECRET: ""
PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ""
PDS_HOSTNAME: example.com PDS_HOSTNAME: example.com
PDS_EMAIL_SMTP_URL: "" PDS_EMAIL_SMTP_URL: ""
PDS_EMAIL_FROM_ADDRESS: "" PDS_EMAIL_FROM_ADDRESS: ""
PUID: 1005
PGID: 1005
volumes: volumes:
- ./bluesky-pds:/pds - ./bluesky-pds:/pds
labels: labels:
traefik.enable: "true" traefik.enable: "true"
traefik.http.routers.bluesky-pds-insecure.entrypoints: http traefik.http.routers.bluesky-pds-insecure.entrypoints: http
traefik.http.routers.bluesky-pds-insecure.rule: HostRegexp(`^.+\.example\.com$`) || Host(`example.social`) traefik.http.routers.bluesky-pds-insecure.rule: HostRegexp(`^.+\.${URL_NAME}\.${URL_SUFFIX}$`) || Host(`${PDS_HOSTNAME}`)
# traefik.http.routers.bluesky-pds-insecure.middlewares: BlueskyHeaders@file
traefik.http.routers.bluesky-pds-secure.entrypoints: https traefik.http.routers.bluesky-pds-secure.entrypoints: https
traefik.http.routers.bluesky-pds-secure.rule: HostRegexp(`^.+\.example\.com$`) || Host(`example.social`) traefik.http.routers.bluesky-pds-secure.rule: HostRegexp(`^.+\.${URL_NAME}\.${URL_SUFFIX}$`) || Host(`${PDS_HOSTNAME}`)
traefik.http.routers.bluesky-pds-secure.tls: "true" traefik.http.routers.bluesky-pds-secure.tls: "true"
traefik.http.services.bluesky-pds.loadbalancer.server.scheme: http traefik.http.services.bluesky-pds.loadbalancer.server.scheme: http
traefik.http.services.bluesky-pds.loadbalancer.server.port: 3000 traefik.http.services.bluesky-pds.loadbalancer.server.port: 3000
traefik.http.routers.bluesky-pds-secure.middlewares: BlueskyHeaders@file # traefik.http.routers.bluesky-pds-secure.middlewares: BlueskyHeaders@file
traefik.http.routers.bluesky-pds-insecure.middlewares: BlueskyHeaders@file ```
#### Standalone
I do not run this, but it should be possible.
```yaml
# Standalone, you'll need to add a proxy in front of this with SSL.
services:
bluesky-pds:
container_name: bluesky-pds
hostname: example.com
image: gravityfargo/bluesky-pds:0.4.74
environment:
# Define variables here or in a .env file
PDS_JWT_SECRET: ...
PDS_ADMIN_PASSWORD: ...
PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ...
PDS_HOSTNAME: example.com
PDS_EMAIL_SMTP_URL: ""
PDS_EMAIL_FROM_ADDRESS: ""
PUID: 1005
PGID: 1005
volumes:
- ./bluesky-pds:/pds
``` ```
#### Middleware #### Middleware
I think file configs are cleaner than having a billion labels. I think file configs are cleaner than having a billion labels. This is not required, but it's nice to have.
```yaml ```yaml
# middleware.yaml
http: http:
middlewares: middlewares:
BlueskyHeaders: BlueskyHeaders:
@ -104,8 +132,54 @@ http:
stsSeconds: 63072000 stsSeconds: 63072000
``` ```
## Development Notes #### Optional Proxy Network
```bash ```bash
pamac install jq docker network create --subnet=192.168.1.0/24 --ipv6 --attachable proxy
# /etc/docker/daemon.json
# {
# "ipv6": true,
# "fixed-cidr-v6": "2001:db8:1::/64"
# }
```
#### Cloudflare DNS
![alt text](assets/image.png)
## Development
The development enviornment must be behind a proxy to generate SSL certificates. This will not work otherwise. In my case, I use Traefik installed on a VPS that's dedicated to development.
I suggest buying a domain name for testing. I have one I use that's for a seperate project, but getting a throwaway domain is also an option. Millage may vary.
```bash
make generate-env
```
Then set the variables
- `PDS_HOSTNAME=example.com`
- `URL_NAME=example`
- `URL_SUFFIX=com`
Build the base image. This will take a while.
```bash
make build-base
```
Make edits as needed. Then build the dev image for testing.
```bash
make build-tag TAG=dev
```
Run the dev image.
```bash
make run
# or
docker-compose up
``` ```

BIN
assets/image.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 46 KiB

48
base/Dockerfile Normal file
View file

@ -0,0 +1,48 @@
################################################################################
# adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/Dockerfile
################################################################################
FROM node:20.11-bookworm-slim AS pds-build
RUN npm install -g pnpm && apt-get update && apt-get -y install unzip
# Download and extract the PDS archive
WORKDIR /app
ADD https://github.com/bluesky-social/pds/archive/refs/tags/v0.4.74.zip .
RUN unzip v0.4.74.zip && \
mv pds-0.4.74/service/** . && \
mv pds-0.4.74/pdsadmin.sh .
RUN pnpm install --prod=true --frozen-lockfile
################################################################################
# adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/Dockerfile
################################################################################
FROM node:20.11-bookworm-slim
RUN apt-get update && apt-get install -y \
dumb-init \
ca-certificates \
curl \
gnupg \
jq \
lsb-release \
openssl \
sqlite3 \
bsdextrautils \
xxd
# bsdextrautils for `column` command in the accounts script
WORKDIR /app
COPY --from=pds-build /app /app
EXPOSE 3000
ENV PDS_PORT=3000
ENV NODE_ENV=production
# potential perf issues w/ io_uring on this version of node
ENV UV_USE_IO_URING=0
RUN userdel node
LABEL org.opencontainers.image.source="https://github.com/bluesky-social/pds"
LABEL org.opencontainers.image.description="AT Protocol PDS"
LABEL org.opencontainers.image.licenses="MIT"

27
docker-compose.yaml
View file

@ -1,11 +1,26 @@
networks:
proxy:
external: true
services: services:
bluesky-pds-dev: bluesky-pds-dev:
container_name: bluesky-pds-dev container_name: bluesky-pds-dev
hostname: sheltersky.social hostname: ${PDS_HOSTNAME}
image: forgejo.gravityfargo.dev/gravityfargo/bluesky-pds:0.4.74 image: forgejo.gravityfargo.dev/gravityfargo/bluesky-pds:dev
ports: networks:
- 3000:3000 - proxy
volumes:
- ./config:/pds
env_file: env_file:
- .env - .env
volumes:
- ./config:/pds
labels:
traefik.enable: "true"
traefik.http.routers.bluesky-pds-insecure.entrypoints: http
traefik.http.routers.bluesky-pds-insecure.rule: HostRegexp(`^.+\.${URL_NAME}\.${URL_SUFFIX}$`) || Host(`${PDS_HOSTNAME}`)
traefik.http.routers.bluesky-pds-insecure.middlewares: BlueskyHeaders@file
traefik.http.routers.bluesky-pds-secure.entrypoints: https
traefik.http.routers.bluesky-pds-secure.rule: HostRegexp(`^.+\.${URL_NAME}\.${URL_SUFFIX}$`) || Host(`${PDS_HOSTNAME}`)
traefik.http.routers.bluesky-pds-secure.tls: "true"
traefik.http.services.bluesky-pds.loadbalancer.server.scheme: http
traefik.http.services.bluesky-pds.loadbalancer.server.port: 3000
traefik.http.routers.bluesky-pds-secure.middlewares: BlueskyHeaders@file

6
entrypoint.sh
View file

@ -20,9 +20,9 @@ function main {
exit 1 exit 1
fi fi
# set PDS_HOSTNAME to hostname if not set # if hostname is not the same as the PDS_HOSTNAME then quit
if [[ -z "${PDS_HOSTNAME}" ]]; then if [[ "${PDS_HOSTNAME}" != "${HOSTNAME}" ]]; then
echo "PDS_HOSTNAME not specified" echo "PDS_HOSTNAME does not match the hostname"
exit 1 exit 1
fi fi

8
example.env Normal file
View file

@ -0,0 +1,8 @@
PDS_JWT_SECRET=
PDS_ADMIN_PASSWORD=
PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=
PDS_HOSTNAME=
PDS_EMAIL_SMTP_URL=
PDS_EMAIL_FROM_ADDRESS=
PUID=1000
PGID=1000