Logan CusanoandClaude Opus 5.5
6c8289f3f3
Nodes checked out v1 code but pulled :latest/:stable images built from main. Each image is now tagged src-<git tree hash of its build directory>: CI adds that tag in every build-*.yml, and scripts/image-tags.sh computes the same value on the node and writes it into .env as DRB_TAG_*, which docker-compose.yml uses (falls back to :latest/:stable for local dev). Tree hashes stay exact even though each image only rebuilds when its own directory changes. - install.sh pins after checkout and fails loudly if a pinned image is missing (compose pull only warns for services with a build: section). - drb-update.sh pulls the target commit's pinned images BEFORE checkout, using the target's own compose file, so a missing image changes nothing (uvicorn --reload would otherwise run new code on old images). It then checks out, writes the pins, recreates, and removes superseded src- tags. - New "Release images" workflow (v* tags + manual dispatch) builds any src- image a release ref is missing; it skips ones already published. The live v1 tag is not moved. Refs #19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
73 lines
2.9 KiB
YAML
73 lines
2.9 KiB
YAML
# Image tags: a provisioned node pins every image to the source tree it has
|
|
# checked out (DRB_TAG_* = src-<git tree hash>, written into .env by install.sh
|
|
# and scripts/drb-update.sh via scripts/image-tags.sh — node-26#19). Unset, as
|
|
# in local dev, they fall back to :latest / :stable, which CI builds from main.
|
|
services:
|
|
icecast:
|
|
image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/icecast:${DRB_TAG_ICECAST:-latest}
|
|
build: ./icecast
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
environment:
|
|
# :? not :- — a missing password must stop the stack, not silently
|
|
# become a credential that is published in this file.
|
|
ICECAST_SOURCE_PASSWORD: ${ICECAST_SOURCE_PASSWORD:?set ICECAST_SOURCE_PASSWORD in .env (run setup.sh, or openssl rand -base64 24)}
|
|
ICECAST_ADMIN_PASSWORD: ${ICECAST_ADMIN_PASSWORD:?set ICECAST_ADMIN_PASSWORD in .env (run setup.sh, or openssl rand -base64 24)}
|
|
|
|
# No `ports:` here — network_mode: host makes it a no-op either way. The
|
|
# control API (:8001) and OP25's HTTP terminal (:8081) are unauthenticated,
|
|
# so they bind 127.0.0.1 by default (see OP25_DEBUG_EXPOSE in .env.example)
|
|
# rather than being exposed. edge-node still reaches both over localhost
|
|
# because it shares this host network namespace.
|
|
op25:
|
|
image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/op25-client:${DRB_TAG_OP25:-stable}
|
|
build: ./op25-container
|
|
restart: unless-stopped
|
|
privileged: true
|
|
network_mode: host
|
|
env_file: .env
|
|
volumes:
|
|
- ./configs:/configs
|
|
- /dev:/dev
|
|
- ./op25-container/app:/app
|
|
- pulse_socket:/run/pulse
|
|
environment:
|
|
PULSE_SERVER: unix:/run/pulse/native
|
|
depends_on:
|
|
- icecast
|
|
|
|
# Claims the node's SECOND physical SDR (op25 always claims the first).
|
|
# Only useful if secondary_sdr_mode is set to adsb|ais via the edge-node
|
|
# config; otherwise it just sits idle answering /secondary/status. See
|
|
# node-26#9. Same network/device access as op25 for the same reason: it
|
|
# needs the raw USB device, not a virtualized one.
|
|
secondary-sdr:
|
|
image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/secondary-sdr:${DRB_TAG_SECONDARY_SDR:-latest}
|
|
build: ./secondary-sdr-container
|
|
restart: unless-stopped
|
|
privileged: true
|
|
network_mode: host
|
|
env_file: .env
|
|
volumes:
|
|
- /dev:/dev
|
|
|
|
edge-node:
|
|
image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/edge-node:${DRB_TAG_EDGE_NODE:-latest}
|
|
build: ./drb-edge-node
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
env_file: .env
|
|
volumes:
|
|
- ./configs:/configs
|
|
- ./recordings:/recordings
|
|
- ./drb-edge-node/app:/app/app
|
|
- pulse_socket:/run/pulse
|
|
environment:
|
|
PULSE_SERVER: unix:/run/pulse/native
|
|
depends_on:
|
|
- icecast
|
|
- op25
|
|
|
|
volumes:
|
|
pulse_socket:
|