mikkel/debate
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
38 commits 1 branch 0 tags 325 KiB
Commit graph

11 commits

Author SHA1 Message Date
Mikkel Georgsen
cd54310129 feat(01-05): ISO build verified end-to-end on build VM 
- Sandbox auto-detects podman/docker and handles sudo requirement
- Podman needs sudo for mkarchiso (loop devices, chroot)
- Docker runs privileged via daemon (no sudo needed)
- Test profile updated for UEFI-only boot (modern approach)
- Build VM (debate-builder) successfully produced 432MB ISO

Architecture:
- Dev LXC: FastAPI, PostgreSQL, code
- Build VM: Podman + archiso for ISO generation
- SSH triggers builds remotely

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-25 21:47:32 +00:00
Mikkel Georgsen
4c472d0827 chore: prefer docker over podman for LXC compatibility 
Podman rootless mode requires complex uid/gid mapping in LXC
containers. Docker works out of the box with nesting enabled.

Podman still supported as fallback if docker unavailable.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-25 20:55:38 +00:00
Mikkel Georgsen
77a5aaa0f5 fix(01-05): use container-based builds instead of systemd-nspawn 
Replace systemd-nspawn (Arch-only) with Podman/Docker containers:
- Works on any Linux host (Debian, Ubuntu, Fedora, etc.)
- Prefers Podman for rootless security, falls back to Docker
- Uses archlinux:latest image with archiso installed
- Network isolation via --network=none
- Resource limits: 8GB RAM, 4 CPUs
- Deterministic builds via SOURCE_DATE_EPOCH

This allows ISO builds from any development/production environment
rather than requiring an Arch-based build server.

LXC/Proxmox users: enable nesting on the container.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-25 20:41:36 +00:00
Mikkel Georgsen
c01b4cbf54 feat(01-05): add build orchestration service 
- Implement BuildService for coordinating ISO build lifecycle
- Integrate sandbox and deterministic config for reproducible builds
- Add cache lookup before build execution (same hash = return cached)
- Handle build status transitions: pending -> building -> completed/failed
 2026-01-25 20:20:57 +00:00
Mikkel Georgsen
c49aee7b0a feat(01-05): add deterministic build configuration service 
- Implement DeterministicBuildConfig class for reproducible builds
- Compute config hash with normalized JSON and sorted inputs
- Derive SOURCE_DATE_EPOCH from config hash (no wall clock dependency)
- Create archiso profile with fixed locale, timezone, compression settings
- Add tests verifying hash determinism and order independence
 2026-01-25 20:20:11 +00:00
Mikkel Georgsen
0d1a008d2f feat(01-03): apply security middleware stack and database health check 
- Add TrustedHostMiddleware for Host header validation
- Add CORSMiddleware with configurable origins
- Add rate limiting with RateLimitExceeded handler
- Add custom middleware for security headers (HSTS, X-Frame-Options, etc.)
- Add /health/db endpoint that checks database connectivity
- Mark health endpoints as rate limit exempt
- Fix linting issues in migration file (Rule 3 - Blocking)
 2026-01-25 20:20:00 +00:00
Mikkel Georgsen
cd94d99c62 feat(01-05): add systemd-nspawn sandbox for isolated ISO builds 
- Create scripts/setup-sandbox.sh to bootstrap Arch base environment
- Add BuildSandbox class for container management and build execution
- Configure sandbox with network isolation, read-only root, 8GB/4core limits
- Add sandbox_root and iso_output_root settings to config
 2026-01-25 20:19:02 +00:00
Mikkel Georgsen
81486fc4f8 feat(01-03): configure rate limiting and CSRF protection 
- Add slowapi limiter with 100/minute default limit
- Create CsrfSettings Pydantic model for fastapi-csrf-protect
- Add deps.py with get_db re-export and validate_csrf dependency
- Configure secure cookie settings (httponly, samesite=lax)
 2026-01-25 20:17:49 +00:00
Mikkel Georgsen
c261664784 feat(01-02): configure Alembic and create Build model 
- Configure Alembic for async migrations with SQLAlchemy 2.0
- Create Build model with UUID primary key, config_hash, status enum
- Add indexes on status (queue queries) and config_hash (cache lookups)
- Generate and apply initial migration creating builds table

Build model fields: id, config_hash, status, iso_path, error_message,
build_log, started_at, completed_at, created_at, updated_at.
 2026-01-25 20:11:55 +00:00
Mikkel Georgsen
fbcd2bbb8e feat(01-02): set up PostgreSQL with Docker and async session factory 
- Add docker-compose.yml with PostgreSQL 16 container (port 5433)
- Create async database session factory with connection pooling
- Configure SQLAlchemy 2.0 DeclarativeBase for models
- Update .env.example with correct database URL

Connection pool settings from research: pool_size=10, max_overflow=20,
pool_recycle=1800 (30 min), pool_pre_ping=True for validation.
 2026-01-25 20:10:18 +00:00
Mikkel Georgsen
519333e598 feat(01-01): create FastAPI application structure with health endpoint 
- Add FastAPI app with title 'Debate API' v1.0.0
- Configure pydantic-settings for environment-based configuration
- Create /health endpoint at root level
- Create /api/v1/health and /api/v1/health/ready endpoints
- Disable docs/redoc in production environment
 2026-01-25 20:09:21 +00:00