feat/m1-image-distribution #16

Merged

nrupard merged 2 commits from feat/m1-image-distribution into main

2026-05-15 16:46:19 +02:00

nrupard commented

2026-05-15 16:45:30 +02:00

Owner

No description provided.

nrupard added 2 commits

2026-05-15 16:45:30 +02:00

feat(m1): operator compose.yml + update check + multi-arch build fcb323e1cb

Milestone 1 (Foundation) deliverables for image and binary distribution.

- Adds compose.yml at repo root: operator-facing reference deployment that pulls a published image (no local build) and bundles the application Postgres. MOKOSH_VERSION pins a release tag; UPDATE_CHECK_URL is wired through to the server.
- Adds GET /api/v1/version/check. Reads UPDATE_CHECK_URL, queries a Forgejo/GitHub release feed (any JSON with tag_name), compares to the running CARGO_PKG_VERSION, and reports update_available. Result is cached for 10 minutes via Moka. Endpoint is disabled and makes no network calls when UPDATE_CHECK_URL is unset. Operators apply updates manually with docker compose pull && docker compose up --detach.
- Updates the OCI build CI to build and push multi-arch images for linux/amd64 and linux/arm64 via docker buildx, sets up QEMU and a buildx builder in the workflow.
- Updates README with operator deployment quickstart, the update-check endpoint, the manual update workflow, and the tag policy. Extends .env.example with CORS_ORIGIN, MOKOSH_IMAGE, MOKOSH_VERSION, MOKOSH_HOST_BIND_IP, MOKOSH_HOST_PORT, and UPDATE_CHECK_URL.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs(operator): document container registry auth for self-hosters

Create release / Create release from merged PR (pull_request) Has been skipped

Details

36b647e94a

Reviewer flagged that the operator quickstart told self-hosters to run docker compose pull without explaining that the default image lives in a private Forgejo registry. On a fresh box the pull fails with unauthorized and the operator hits a wall.

- Adds a "Container registry access" section under the operator deployment heading covering both options: log in to dev.a8n.run with a read:package PAT, or mirror the image to a registry the operator controls and point MOKOSH_IMAGE at it (the recommended pattern for partner MSPs and air-gapped deploys).
- Inserts a docker login step into the quickstart and renumbers the surrounding steps.
- Calls out the ADMIN_EMAIL / ADMIN_PASSWORD bootstrap-timing footgun in the quickstart so operators know to set them BEFORE first `up`, since the auth bootstrap only fires when the users table is empty.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>