alice.pds.demo.boltless.dev
This repository has no description
4.1 kB
77 lines
1Heavily inspired by [frontpage dev environment](https://github.com/frontpagefyi/frontpage/blob/10678df9c3f72cbd82f0856a9f99c74dd22326d8/apps/frontpage/local-infra/README.md).
2Tangled's setup is slightly more involved because services inside the network need to reach the PDS over its **public** hostname with **valid TLS** — federation paths (DID resolution, OAuth, etc.) round-trip through the same URLs an external client would use.
3
4For example, resolving `alice.pds.tngl.boltless.dev` yields an `#atproto_pds` service pointing at `https://pds.tngl.boltless.dev`. Knot and spindle running inside docker must hit that exact URL and trust its cert.
5
6To make that work:
7
8- Caddy's dev root CA is mounted into every container that talks to another service over HTTPS.
9- The Docker network uses an unrouted "public" subnet so the SSRF dialer doesn't reject container IPs as private.
10
11## What's inside:
12
13- [did-method-plc](https://github.com/did-method-plc/did-method-plc) (<https://plc.tngl.boltless.dev>)
14- atproto_pds (<https://pds.tngl.boltless.dev>)
15- jetstream (<https://jetstream.tngl.boltless.dev>)
16- knot (<https://knot.tngl.boltless.dev>)
17- spindle (<https://spindle.tngl.boltless.dev>)
18- knotmirror (<https://knotmirror.tngl.boltless.dev>)
19- appview (<https://tngl.boltless.dev>) (live reloading)
20- [ncps](https://github.com/kalbasit/ncps) nix binary cache (internal, `http://ncps:8501`)
21- pdsls (<https://pdsls.tngl.boltless.dev>)
22- bobbin (<https://bobbin.tngl.boltless.dev>, host `:8090`)
23- hydrant indexer + record/identity resolver feeding bobbin (internal)
24- camo (<https://camo.tngl.boltless.dev>) and avatar
25 (<https://avatar.tngl.boltless.dev>), the workers from `camo/` and `avatar/`
26 under wrangler. avatar resolves against the local plc, so it serves real
27 avatars for accounts that have one and a generated placeholder otherwise
28- web/ sveltekit frontend (host `127.0.0.1:5174`, live reloading)
29- caddy reverse proxy
30
31## Setup
32
331. Generate the dev CA from the repo root:
34 ```bash
35 mkdir -p localinfra/certs &&
36 openssl req -x509 -newkey rsa:2048 \
37 -keyout localinfra/certs/root.key \
38 -out localinfra/certs/root.crt \
39 -days 3650 -nodes \
40 -subj "/CN=Tangled Dev CA" \
41 -addext "basicConstraints=critical,CA:TRUE,pathlen:1" \
42 -addext "keyUsage=critical,keyCertSign,cRLSign" \
43 -addext "nameConstraints=critical,permitted;DNS:tngl.boltless.dev"
44 ```
452. Trust generated `localinfra/certs/root.crt` in your system's trust store.
46 - For example in MacOS, run
47 ```bash
48 sudo security add-trusted-cert -d -r trustRoot \
49 -k /Library/Keychains/System.keychain \
50 ./localinfra/certs/root.crt
51 ```
52 - Depending on your browser you may have to import the certificate into your browser profiles too as some have their own certs do not use your system ones
533. run `./localinfra/scripts/appview-static-files.sh`
544. Prepare the spindle microVM images:
55 ```bash
56 ./localinfra/scripts/prepare-spindle-images.sh
57 ```
58 This writes the image directory under `out/localinfra-spindle-images`.
595. `docker compose up`
606. AppView will be running on `127.0.0.1:3000` with two test users: `alice.pds.tngl.boltless.dev` and `bob.pds.tngl.boltless.dev`. Both with password `password`.
61
62`TANGLED_APPVIEW_HOST` must be a loopback IP with the mapped port (`127.0.0.1:3000`), not `localhost`: atproto's dev OAuth client requires a loopback IP for the redirect URI. If you remap the published appview port, update `TANGLED_APPVIEW_HOST` in `docker-compose.yml` to match.
63
64## bobbin stack
65
66The `web` service runs `vite dev` against the local bobbin on
67`http://127.0.0.1:5174` (port 5174 so it doesn't clash with a host-side
68`pnpm dev` on 5173). For host-side `web/` dev, point the frontend at the
69local bobbin (e.g. in `web/.env`):
70
71```bash
72BOBBIN_URL=http://127.0.0.1:8090
73# leave unset to read repositories directly from their knots
74KNOTMIRROR_URL=https://mirror.tngl.boltless.dev
75VITE_HANDLE_RESOLVER_URL=https://pds.tngl.boltless.dev
76VITE_PLC_DIRECTORY_URL=https://plc.tngl.boltless.dev
77```