Repository navigation
Gateway origin for dist.ipfs.tech, POST /add on the pinning API - #38
Merged
Merged
Conversation
community.general's yaml stdout callback is deprecated; ansible-core's default callback prints results as YAML with callback_result_format = yaml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ipfs-deploy-action uploads with `ipfs-cluster-ctl add`, which speaks ipfs-cluster's REST API, not the Pinning Service API. Envoy on pin.ipni.io:9443 now routes POST /add, and only that, to the REST API on loopback 9094. - The REST API has no auth of its own, so Envoy checks HTTP basic auth on that route against the same vault_content_pin_users. The role hashes them to htpasswd SHA1 entries on the controller, sorted so an unchanged user list does not restart the proxy; passwords go through the environment only. - Every other route disables basic auth; ipfs-cluster still authenticates them. - The stream idle timeout goes from 60s to 300s and /add has no route timeout, so a slow CAR upload finishes. - Every deploy checks that POST /add without credentials gets 401 and that PUT/DELETE /add, POST /peers and POST /pins/<cid> get 403. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dist.ipfs.tech (~128 GB) is larger than the 100Gi content-repo claim, but the claim is only a label: k3s's local-storage class cannot expand volumes and does not enforce the size, so the NVMe under /data is the real bound (about 820 GB free per box on 2026-10-21). The entry is allowed by name and pinned directly with ipfs-cluster-ctl, not through the playbook's pin timeout. pvc.yaml now says why the size is not raised. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The content kubo's gateway comes on at 127.0.0.1:8181 with NoFetch (it serves only blocks the node already holds) and NoDNSLink. Envoy (k8s/content-gateway) publishes it over TLS on every box as the origin behind the dist.ipfs.tech Cloudflare Worker, passing only GET and HEAD under /ipfs/ and refusing the rest with 403. - 2053 is a port Cloudflare can reach as an origin (8443 is taken on lith-1). - The certificate comes from cert-manager by DNS-01 in the ipfs.io zone, with its own issuers and a new vault secret, vault_cloudflare_dns_token_ipfs_io: the ipni.io token cannot see ipfs.io. The role refuses to deploy without it. - 2053, 8181 and the Envoy admin port 9905 are reserved; 2053/tcp is open. - Every deploy checks from the controller that health answers 200 over TLS and that POST /ipfs/, /ipns/ and /api/ get 403. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…th users k8s/content-pin/envoy.yaml.j2 now lists content_pin_basic_users, which a deploy hashes from the vault. scripts/render-manifests.yml (CI's manifests job) has no vault, so it could not render the template; it now passes one placeholder entry in the same htpasswd SHA1 form. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Claude review failed to run. See https://github.com/ipni/workers/actions/runs/43055174035 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Commits
ansible.cfgreplaces the deprecatedyamlstdout callback withdefault+callback_result_format = yaml.ipfs-cluster-ctl add, which ipfs-deploy-action runs. Envoy sends onlyPOST /addto the cluster REST API on loopback 9094, behind HTTP basic auth.vault_content_pin_users. The role computes their SHA1 htpasswd entries on the controller.POST /addgets 401;PUT/DELETE /add,POST /peersandPOST /pins/<cid>get 403.ipfs-cluster-ctl.dist-origin.ipfs.io:2053. kubo's gateway runs on127.0.0.1:8181withNoFetchandNoDNSLink. A new Envoy (k8s/content-gateway) publishes it on every box as the origin behind the dist.ipfs.tech Cloudflare Worker.GET/HEADunder/ipfs/get through; everything else gets 403.group_vars/managed_boxes; 2053/tcp is opened.scripts/render-manifests.ymlhas no vault, so it gets one placeholder entry forcontent_pin_basic_users.Checked locally
--syntax-checkpasses on every playbook.scripts/render-manifests.ymlrenders all manifests andkubectl kustomizebuilds every directory.envoy --mode validatepasses on the rendered content-pin and content-gateway configs, using the pinneddistroless-v1.39.1image.Before deploying
vault_cloudflare_dns_token_ipfs_io, which is already ingroup_vars/ipfs_nodes/vault.yml. On 2026-11-11 Cloudflare reported the token active and able to see theipfs.iozone. DNS edit permission isn't confirmed yet; the first certificate issuance will show whether it has it.🤖 Generated with Claude Code