jane remover
Some checks failed
Docker image builds / build (push) Waiting to run
Asset Build Verification / asset_verification (push) Has been cancelled
Docs deploy / build (push) Has been cancelled
Go Mod Tidy Check / go_mod_tidy_check (push) Has been cancelled
Go / go_tests (push) Has been cancelled
Package builds (unstable) / package_builds (push) Has been cancelled
Smoke tests / smoke-test (default-config-macro) (push) Has been cancelled
Smoke tests / smoke-test (docker-registry) (push) Has been cancelled
Smoke tests / smoke-test (double_slash) (push) Has been cancelled
Smoke tests / smoke-test (forced-language) (push) Has been cancelled
Smoke tests / smoke-test (git-clone) (push) Has been cancelled
Smoke tests / smoke-test (git-push) (push) Has been cancelled
Smoke tests / smoke-test (healthcheck) (push) Has been cancelled
Smoke tests / smoke-test (i18n) (push) Has been cancelled
Smoke tests / smoke-test (log-file) (push) Has been cancelled
Smoke tests / smoke-test (nginx) (push) Has been cancelled
Smoke tests / smoke-test (palemoon/amd64) (push) Has been cancelled
Smoke tests / smoke-test (robots_txt) (push) Has been cancelled
Check Spelling / Check Spelling (push) Has been cancelled
SSH CI / ssh (aarch64-16k) (push) Has been cancelled
SSH CI / ssh (aarch64-4k) (push) Has been cancelled
SSH CI / ssh (ppc64le) (push) Has been cancelled
SSH CI / ssh (riscv64) (push) Has been cancelled
zizmor / zizmor latest via PyPI (push) Has been cancelled

This commit is contained in:
Soph :3 2026-02-07 13:08:47 +02:00
parent d2205b11a7
commit 896858e027
332 changed files with 1482 additions and 33742 deletions

View file

@ -1,14 +1,14 @@
:80 {
reverse_proxy http://anubis:3000 {
reverse_proxy http://nuke:3000 {
header_up X-Real-Ip {remote_host}
header_up X-Http-Version {http.request.proto}
}
}
:443 {
tls /etc/techaro/pki/caddy.local.cetacean.club/cert.pem /etc/techaro/pki/caddy.local.cetacean.club/key.pem
tls /etc/sad.ovh/pki/caddy.local.cetacean.club/cert.pem /etc/sad.ovh/pki/caddy.local.cetacean.club/key.pem
reverse_proxy http://anubis:3000 {
reverse_proxy http://nuke:3000 {
header_up X-Real-Ip {remote_host}
header_up X-Http-Version {http.request.proto}
header_up X-Tls-Version {http.request.tls.version}

View file

@ -6,16 +6,16 @@ services:
- 8080:80
- 8443:443
volumes:
- "../pki/caddy.local.cetacean.club:/etc/techaro/pki/caddy.local.cetacean.club/"
- "../pki/caddy.local.cetacean.club:/etc/sad.ovh/pki/caddy.local.cetacean.club/"
anubis:
image: ghcr.io/techarohq/anubis:main
nuke:
image: git.sad.ovh/sophie/nuke:main
environment:
BIND: ":3000"
TARGET: http://httpdebug:3000
POLICY_FNAME: /etc/techaro/anubis/less_paranoid.yaml
POLICY_FNAME: /etc/sad.ovh/nuke/less_paranoid.yaml
volumes:
- ../anubis_configs:/etc/techaro/anubis
- ../nuke_configs:/etc/sad.ovh/nuke
httpdebug:
image: ghcr.io/xe/x/httpdebug

View file

@ -12,7 +12,7 @@ import (
"strings"
"time"
"github.com/TecharoHQ/anubis/test/cmd/cipra/internal"
"git.sad.ovh/sophie/nuke/test/cmd/cipra/internal"
"github.com/facebookgo/flagenv"
)

View file

@ -14,7 +14,7 @@ import (
"strings"
"time"
"github.com/TecharoHQ/anubis/internal"
"git.sad.ovh/sophie/nuke/internal"
"github.com/facebookgo/flagenv"
"github.com/google/uuid"
)

View file

@ -11,7 +11,7 @@ import (
"path/filepath"
"strings"
"github.com/TecharoHQ/anubis/internal"
"git.sad.ovh/sophie/nuke/internal"
"github.com/facebookgo/flagenv"
)

View file

@ -7,24 +7,24 @@ services:
image: ghcr.io/xe/x/relayd
pull_policy: always
environment:
CERT_DIR: /etc/techaro/pki/registry.local.cetacean.club
CERT_DIR: /etc/sad.ovh/pki/registry.local.cetacean.club
CERT_FNAME: cert.pem
KEY_FNAME: key.pem
PROXY_TO: http://anubis:3000
PROXY_TO: http://nuke:3000
ports:
- 3004:3004
volumes:
- ./pki/registry.local.cetacean.club:/etc/techaro/pki/registry.local.cetacean.club
- ./pki/registry.local.cetacean.club:/etc/sad.ovh/pki/registry.local.cetacean.club
anubis:
image: ko.local/anubis
nuke:
image: ko.local/nuke
restart: always
environment:
BIND: ":3000"
TARGET: http://registry:5000
POLICY_FNAME: /etc/techaro/anubis.yaml
POLICY_FNAME: /etc/sad.ovh/nuke.yaml
USE_REMOTE_ADDRESS: "true"
ports:
- 3000
volumes:
- ./anubis.yaml:/etc/techaro/anubis.yaml
- ./nuke.yaml:/etc/sad.ovh/nuke.yaml

View file

@ -9,7 +9,7 @@ set -u
source ../lib/lib.sh
build_anubis_ko
build_nuke_ko
function cleanup() {
docker compose down

View file

@ -11,12 +11,12 @@ trap cleanup EXIT SIGINT
# Build static assets
(cd ../.. && npm ci && npm run assets)
go tool anubis --help 2>/dev/null || :
go tool nuke --help 2>/dev/null || :
go run ../cmd/httpdebug &
go tool anubis \
--policy-fname ./anubis.yaml \
go tool nuke \
--policy-fname ./nuke.yaml \
--use-remote-address \
--target=http://localhost:3923 &

View file

@ -11,12 +11,12 @@ trap cleanup EXIT SIGINT
# Build static assets
(cd ../.. && npm ci && npm run assets)
go tool anubis --help 2>/dev/null ||:
go tool nuke --help 2>/dev/null ||:
go run ../cmd/unixhttpd &
FORCED_LANGUAGE=de go tool anubis \
--policy-fname ./anubis.yaml \
FORCED_LANGUAGE=de go tool nuke \
--policy-fname ./nuke.yaml \
--use-remote-address \
--target=unix://$(pwd)/unixhttpd.sock &

View file

@ -9,8 +9,8 @@ services:
volumes:
- ./var/repos:/srv/git
anubis:
image: ko.local/anubis
nuke:
image: ko.local/nuke
environment:
BIND: ":8005"
TARGET: http://cgit:80

View file

@ -9,7 +9,7 @@ set -u
source ../lib/lib.sh
build_anubis_ko
build_nuke_ko
rm -rf ./var/repos ./var/clones
mkdir -p ./var/repos ./var/clones
@ -22,4 +22,4 @@ sleep 2
(cd ./var/clones && git clone http://localhost:8005/status.git)
exit 0
exit 0

View file

@ -6,8 +6,8 @@ services:
volumes:
- ./var/repos:/git
anubis:
image: ko.local/anubis
nuke:
image: ko.local/nuke
environment:
BIND: ":3000"
TARGET: http://git:80

View file

@ -9,7 +9,7 @@ set -u
source ../lib/lib.sh
build_anubis_ko
build_nuke_ko
rm -rf ./var/repos ./var/foo
mkdir -p ./var/repos
@ -27,8 +27,8 @@ sleep 2
git init &&
touch README &&
git add . &&
git config user.name "Anubis CI" &&
git config user.email "social+anubis-ci@techaro.lol" &&
git config user.name "Nuke CI" &&
git config user.email "nuke-ci@sad.ovh" &&
git commit -sm "initial commit" &&
git push -u http://localhost:3000/git/foo.git master
)

View file

@ -1,11 +1,11 @@
module github.com/TecharoHQ/anubis/test
module git.sad.ovh/sophie/nuke/test
go 1.24.5
replace github.com/TecharoHQ/anubis => ..
replace git.sad.ovh/sophie/nuke => ..
require (
github.com/TecharoHQ/anubis v1.23.1
git.sad.ovh/sophie/nuke v1.23.1
github.com/docker/docker v28.5.2+incompatible
github.com/facebookgo/flagenv v0.0.0-20160425205200-fcd59fca7456
github.com/google/uuid v1.6.0
@ -15,7 +15,6 @@ require (
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20251209175733-2a1774d88802.1 // indirect
cel.dev/expr v0.25.1 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/TecharoHQ/thoth-proto v0.5.0 // indirect
github.com/a-h/templ v0.3.960 // indirect
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
github.com/aws/aws-sdk-go-v2 v1.41.0 // indirect
@ -103,6 +102,6 @@ require (
)
tool (
github.com/TecharoHQ/anubis/cmd/anubis
git.sad.ovh/sophie/nuke/cmd/nuke
github.com/jsha/minica
)

View file

@ -10,8 +10,6 @@ github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg
github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
github.com/TecharoHQ/thoth-proto v0.5.0 h1:Fa663s4soYiURSU8MfW9tZ2wF+LsCRSaYmjUSyagfBM=
github.com/TecharoHQ/thoth-proto v0.5.0/go.mod h1:C/U7FqTxpVn4V/qebC/GcW32I0h9xzsmWehF27KFOJs=
github.com/a-h/templ v0.3.960 h1:trshEpGa8clF5cdI39iY4ZrZG8Z/QixyzEyUnA7feTM=
github.com/a-h/templ v0.3.960/go.mod h1:oCZcnKRf5jjsGpf2yELzQfodLphd2mwecwG4Crk5HBo=
github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=

View file

@ -2,13 +2,13 @@ services:
web:
image: ghcr.io/xe/nginx-micro:v1.29.0
anubis:
image: ko.local/anubis
nuke:
image: ko.local/nuke
environment:
TARGET: http://web:80
USE_REMOTE_ADDRESS: "true"
healthcheck:
test: ["CMD", "anubis", "--healthcheck"]
test: ["CMD", "nuke", "--healthcheck"]
interval: 5s
timeout: 30s
retries: 5

View file

@ -9,7 +9,7 @@ set -u
source ../lib/lib.sh
build_anubis_ko
build_nuke_ko
docker compose up -d
attempt=1
@ -27,4 +27,4 @@ while ! docker compose ps | grep healthy; do
attempt=$(( attempt + 1 ))
done
exit 0
exit 0

View file

@ -1,12 +1,14 @@
async function fetchLanguages() {
return fetch("http://localhost:8923/.within.website/x/cmd/anubis/static/locales/manifest.json")
.then(resp => {
return fetch(
"http://localhost:8923/.within.website/x/cmd/nuke/static/locales/manifest.json",
)
.then((resp) => {
if (resp.status !== 200) {
throw new Error(`wanted status 200, got status: ${resp.status}`);
}
return resp;
})
.then(resp => resp.json());
.then((resp) => resp.json());
}
async function getChallengePage(lang) {
@ -14,15 +16,15 @@ async function getChallengePage(lang) {
headers: {
"Accept-Language": lang,
"User-Agent": "CHALLENGE",
}
},
})
.then(resp => {
.then((resp) => {
if (resp.status !== 200) {
throw new Error(`wanted status 200, got status: ${resp.status}`);
}
return resp;
})
.then(resp => resp.text());
.then((resp) => resp.text());
}
(async () => {
@ -42,7 +44,7 @@ async function getChallengePage(lang) {
console.log(`getting for ${lang}`);
const page = await getChallengePage(lang);
resultSheet[lang] = page.includes(`<html lang="${lang}">`)
resultSheet[lang] = page.includes(`<html lang="${lang}">`);
}
for (const [lang, result] of Object.entries(resultSheet)) {
@ -59,4 +61,4 @@ async function getChallengePage(lang) {
}
process.exit(0);
})();
})();

View file

@ -11,12 +11,12 @@ trap cleanup EXIT SIGINT
# Build static assets
(cd ../.. && npm ci && npm run assets)
go tool anubis --help 2>/dev/null ||:
go tool nuke --help 2>/dev/null ||:
go run ../cmd/unixhttpd &
go tool anubis \
--policy-fname ./anubis.yaml \
go tool nuke \
--policy-fname ./nuke.yaml \
--use-remote-address \
--target=unix://$(pwd)/unixhttpd.sock &

View file

@ -17,7 +17,7 @@ function cleanup() {
trap cleanup EXIT SIGINT
function build_anubis_ko() {
function build_nuke_ko() {
(
cd $REPO_ROOT && npm ci && npm run assets
)
@ -30,7 +30,7 @@ function build_anubis_ko() {
--image-user=1000 \
--image-annotation="" \
--image-label="" \
./cmd/anubis \
./cmd/nuke \
--local
)
}

View file

@ -10,7 +10,7 @@ status_codes:
logging:
sink: file
parameters:
file: "./var/anubis.log"
file: "./var/nuke.log"
maxBackups: 3 # keep at least 3 old copies
maxBytes: 67108864 # each file can have up to 64 Mi of logs
maxAge: 7 # rotate files out every n days

View file

@ -3,16 +3,16 @@ import { statSync } from "fs";
async function getPage(path) {
return fetch(`http://localhost:8923${path}`, {
headers: {
'User-Agent': 'CHALLENGE'
}
"User-Agent": "CHALLENGE",
},
})
.then(resp => {
.then((resp) => {
if (resp.status !== 200) {
throw new Error(`wanted status 200, got status: ${resp.status}`);
}
return resp;
})
.then(resp => resp.text());
.then((resp) => resp.text());
}
async function getFileSize(filePath) {
@ -24,7 +24,7 @@ async function getFileSize(filePath) {
}
(async () => {
const logFilePath = "./var/anubis.log";
const logFilePath = "./var/nuke.log";
// Get initial log file size
const initialSize = await getFileSize(logFilePath);
@ -63,7 +63,9 @@ async function getFileSize(filePath) {
// Verify that log file size increased
if (finalSize <= initialSize) {
console.error("ERROR: Log file size did not increase after making requests!");
console.error(
"ERROR: Log file size did not increase after making requests!",
);
failed = true;
}
@ -79,10 +81,14 @@ async function getFileSize(filePath) {
console.log(`Successful requests: ${successCount}/${requests.length}`);
if (failed) {
console.error("Test failed: Some requests failed or log file size did not increase");
console.error(
"Test failed: Some requests failed or log file size did not increase",
);
process.exit(1);
} else {
console.log("Test passed: All requests succeeded and log file size increased");
console.log(
"Test passed: All requests succeeded and log file size increased",
);
process.exit(0);
}
})();
})();

View file

@ -11,12 +11,12 @@ trap cleanup EXIT SIGINT
# Build static assets
(cd ../.. && npm ci && npm run assets)
go tool anubis --help 2>/dev/null || :
go tool nuke --help 2>/dev/null || :
go run ../cmd/httpdebug &
go tool anubis \
--policy-fname ./anubis.yaml \
go tool nuke \
--policy-fname ./nuke.yaml \
--use-remote-address \
--target=http://localhost:3923 &

View file

@ -11,15 +11,15 @@ server {
auth_request off;
}
location @redirectToAnubis {
location @redirectToNuke {
return 307 /.within.website/?redir=$scheme://$host$request_uri;
auth_request off;
}
location / {
auth_request /.within.website/x/cmd/anubis/api/check;
error_page 401 = @redirectToAnubis;
auth_request /.within.website/x/cmd/nuke/api/check;
error_page 401 = @redirectToNuke;
root /usr/share/nginx/html;
index index.html index.htm;
}
}
}

View file

@ -31,8 +31,8 @@ spec:
- name: config
mountPath: /etc/nginx/conf.d
readOnly: true
- name: anubis
image: ttl.sh/techaro/anubis:latest
- name: nuke
image: git.sad.ovh/sophie/nuke:latest
imagePullPolicy: Always
resources:
limits:

View file

@ -7,8 +7,8 @@ set -euo pipefail
cd ../.. &&
npm ci &&
npm run container -- \
--docker-repo ttl.sh/techaro/anubis \
--docker-tags ttl.sh/techaro/anubis:latest
--docker-repo git.sad.ovh/sophie/nuke \
--docker-tags git.sad.ovh/sophie/nuke:latest
)
kubectl apply -k .

View file

@ -1,8 +1,8 @@
# /etc/nginx/conf-anubis.inc
# /etc/nginx/conf-nuke.inc
# Forward to anubis
# Forward to nuke
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://anubis;
}
proxy_pass http://nuke;
}

View file

@ -6,8 +6,8 @@ server {
listen [::]:443 ssl;
http2 on;
# Slipstream via Anubis
include "conf-anubis.inc";
# Slipstream via Nuke
include "conf-nuke.inc";
server_name mimi.techaro.lol;
@ -26,4 +26,4 @@ server {
# Your normal configuration can go here
# location .php { fastcgi...} etc.
}
}

View file

@ -1,17 +1,17 @@
# /etc/nginx/conf.d/upstream-anubis.conf
# /etc/nginx/conf.d/upstream-nuke.conf
upstream anubis {
zone anubis_zone 64k;
upstream nuke {
zone nuke_zone 64k;
# Make sure this matches the values you set for `BIND` and `BIND_NETWORK`.
# If this does not match, your services will not be protected by Anubis.
# If this does not match, your services will not be protected by Nuke.
# Try anubis first over a UNIX socket
#server unix:/run/anubis/nginx.sock;
server anubis:3000 resolve;
# Try nuke first over a UNIX socket
#server unix:/run/nuke/nginx.sock;
server nuke:3000 resolve;
# Optional: fall back to serving the websites directly. This allows your
# websites to be resilient against Anubis failing, at the risk of exposing
# websites to be resilient against Nuke failing, at the risk of exposing
# them to the raw internet without protection. This is a tradeoff and can
# be worth it in some edge cases.
#server unix:/run/nginx.sock backup;
}
}

View file

@ -1,5 +1,5 @@
# Pale Moon CI tests
Pale Moon has exposed [some pretty bad bugs](https://anubis.techaro.lol/blog/release/v1.21.1#fix-event-loop-thrashing-when-solving-a-proof-of-work-challenge) in Anubis. As such, we're running Pale Moon against Anubis in CI to ensure that it keeps working.
Pale Moon has exposed [some pretty bad bugs](https://nuke.techaro.lol/blog/release/v1.21.1#fix-event-loop-thrashing-when-solving-a-proof-of-work-challenge) in Nuke. As such, we're running Pale Moon against Nuke in CI to ensure that it keeps working.
This test is a fork of [dtinth/xtigervnc-docker](https://github.com/dtinth/xtigervnc-docker) but focused on Pale Moon.

View file

@ -5,15 +5,15 @@ services:
ports:
- 5900:5900
anubis:
image: ko.local/anubis
nuke:
image: ko.local/nuke
environment:
BIND: ":3000"
TARGET: http://$TARGET
POLICY_FNAME: /cfg/anubis.yaml
POLICY_FNAME: /cfg/nuke.yaml
SLOG_LEVEL: DEBUG
volumes:
- ../anubis:/cfg
- ../nuke:/cfg
depends_on:
- relayd
@ -21,12 +21,12 @@ services:
image: ghcr.io/xe/x/relayd
environment:
BIND: :443
CERT_DIR: /techaro/pki
CERT_DIR: /sad.ovh/pki
CERT_FNAME: cert.pem
KEY_FNAME: key.pem
PROXY_TO: http://anubis:3000
PROXY_TO: http://nuke:3000
volumes:
- ./pki/relayd:/techaro/pki:ro
- ./pki/relayd:/sad.ovh/pki:ro
# novnc:
# image: geek1011/easy-novnc
@ -45,6 +45,6 @@ services:
- ./pki:/usr/local/share/ca-certificates/minica:ro
- ../scripts:/hack/scripts:ro
depends_on:
- anubis
- nuke
- relayd
- display

View file

@ -26,7 +26,7 @@ fi
set -euo pipefail
build_anubis_ko
build_nuke_ko
mint_cert relayd
timeout &

View file

@ -5,15 +5,15 @@ services:
ports:
- 5900:5900
anubis:
image: ko.local/anubis
nuke:
image: ko.local/nuke
environment:
BIND: ":3000"
TARGET: http://$TARGET
POLICY_FNAME: /cfg/anubis.yaml
POLICY_FNAME: /cfg/nuke.yaml
SLOG_LEVEL: DEBUG
volumes:
- ../anubis:/cfg
- ../nuke:/cfg
relayd:
image: ghcr.io/xe/x/relayd
@ -22,7 +22,7 @@ services:
CERT_DIR: /techaro/pki
CERT_FNAME: cert.pem
KEY_FNAME: key.pem
PROXY_TO: http://anubis:3000
PROXY_TO: http://nuke:3000
volumes:
- ./pki/relayd:/techaro/pki:ro

View file

@ -21,7 +21,7 @@ fi
set -euo pipefail
build_anubis_ko
build_nuke_ko
mint_cert relayd
go run ../../cmd/cipra/ --compose-name $(basename $(pwd))

View file

@ -11,12 +11,12 @@ trap cleanup EXIT SIGINT
# Build static assets
(cd ../.. && npm ci && npm run assets)
go tool anubis --help 2>/dev/null || :
go tool nuke --help 2>/dev/null || :
go run ../cmd/unixhttpd &
go tool anubis \
--policy-fname ./anubis.yaml \
go tool nuke \
--policy-fname ./nuke.yaml \
--use-remote-address \
--serve-robots-txt \
--target=unix://$(pwd)/unixhttpd.sock &

View file

@ -1,17 +1,20 @@
<!DOCTYPE html>
<!doctype html>
<html>
<head>
<title>Anubis works!</title>
<link rel="stylesheet" href="/.within.website/x/xess/xess.css"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
</head>
<body id="top">
<main>
<h1>Anubis works!</h1>
<head>
<title>Nuke works!</title>
<link rel="stylesheet" href="/.within.website/x/xess/xess.css" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
</head>
<body id="top">
<main>
<h1>Nuke works!</h1>
<p>If you see this, everything has gone according to keikaku.</p>
<p>If you see this, everything has gone according to keikaku.</p>
<img height=128 src="/.within.website/x/cmd/anubis/static/img/happy.webp"/>
</main>
</body>
</html>
<img
height="128"
src="/.within.website/x/cmd/nuke/static/img/happy.webp"
/>
</main>
</body>
</html>

View file

@ -2,4 +2,4 @@ ARG ALPINE_VERSION=3.22
FROM alpine:${ALPINE_VERSION}
RUN apk add -U go nodejs git build-base git npm bash zstd brotli gzip
LABEL org.opencontainers.image.source="https://github.com/TecharoHQ/anubis"
LABEL org.opencontainers.image.source="https://git.sad.ovh/sophie/nuke"

View file

@ -21,6 +21,6 @@ target "ci-runner" {
]
pull = true
tags = [
"ghcr.io/techarohq/anubis/ci-runner:latest"
"git.sad.ovh/sophie/nuke/ci-runner:latest"
]
}
}

View file

@ -9,14 +9,14 @@ fi
declare -A Hosts
Hosts["riscv64"]="ubuntu@riscv64.techaro.lol" # GOARCH=riscv64 GOOS=linux
Hosts["ppc64le"]="ci@ppc64le.techaro.lol" # GOARCH=ppc64le GOOS=linux
Hosts["riscv64"]="ubuntu@riscv64.sad.ovh" # GOARCH=riscv64 GOOS=linux
Hosts["ppc64le"]="ci@ppc64le.sad.ovh" # GOARCH=ppc64le GOOS=linux
Hosts["aarch64-4k"]="rocky@192.168.2.52" # GOARCH=arm64 GOOS=linux 4k page size
Hosts["aarch64-16k"]="ci@192.168.2.28" # GOARCH=arm64 GOOS=linux 16k page size
CIRunnerImage="ghcr.io/techarohq/anubis/ci-runner:latest"
CIRunnerImage="git.sad.ovh/sophie/nuke/ci-runner:latest"
RunID=${GITHUB_RUN_ID:-$(uuidgen)}
RunFolder="anubis/runs/${RunID}"
RunFolder="nuke/runs/${RunID}"
Target="${Hosts["$1"]}"
ssh "${Target}" uname -av >/dev/null
@ -26,15 +26,15 @@ git archive HEAD | ssh "${Target}" tar xC "${RunFolder}"
ssh "${Target}" <<EOF
set -euo pipefail
set -x
mkdir -p anubis/cache/{go,go-build,node}
mkdir -p nuke/cache/{go,go-build,node}
podman pull ${CIRunnerImage}
podman run --rm -it \
-v "\$HOME/${RunFolder}:/app/anubis:z" \
-v "\$HOME/anubis/cache/go:/root/go:z" \
-v "\$HOME/anubis/cache/go-build:/root/.cache/go-build:z" \
-v "\$HOME/anubis/cache/node:/root/.npm:z" \
-w /app/anubis \
-v "\$HOME/${RunFolder}:/app/nuke:z" \
-v "\$HOME/nuke/cache/go:/root/go:z" \
-v "\$HOME/nuke/cache/go-build:/root/.cache/go-build:z" \
-v "\$HOME/nuke/cache/node:/root/.npm:z" \
-w /app/nuke \
${CIRunnerImage} \
sh /app/anubis/test/ssh-ci/in-container.sh
sh /app/nuke/test/ssh-ci/in-container.sh
ssh "${Target}" rm -rf "${RunFolder}"
EOF

View file

@ -33,17 +33,17 @@ fi
# HTTP daemon that listens over a unix socket (implicitly ./unixhttpd.sock)
go run ../cmd/unixhttpd &
# A copy of Anubis, specifically for the current Git checkout
go tool anubis \
--bind=./anubis.sock \
# A copy of Nuke, specifically for the current Git checkout
go tool nuke \
--bind=./nuke.sock \
--bind-network=unix \
--policy-fname=../anubis_configs/aggressive_403.yaml \
--policy-fname=../nuke_configs/aggressive_403.yaml \
--target=unix://$(pwd)/unixhttpd.sock &
# A simple TLS terminator that forwards to Anubis, which will forward to
# A simple TLS terminator that forwards to Nuke, which will forward to
# unixhttpd
go run ../cmd/relayd \
--proxy-to=unix://./anubis.sock \
--proxy-to=unix://./nuke.sock \
--cert-dir=../pki/relayd.local.cetacean.club &
# When you press control c, kill all the child processes to clean things up