collin/anvil · 04186540

Run locally in Docker at https://anvil.localhost

Collin Richards · 2026-08-18 09:42 UTC · 04186540960d06c008741d226edddf2c7e127666 · parent 31844800 · browse files

modifiedCargo.lock+587 −87

modifiedCargo.toml+9 −1

modifiedDockerfile+5 −1

modifiedcrates/anvil-cli/src/secret.rs+20 −3

modifiedcrates/anvil-core/src/config.rs+98 −4

addeddeploy/anvil.dev.toml+36 −0

addeddeploy/dev.sh+114 −0

⋯ 56 unchanged lines
57	57		# cross-compile, ring does not. anvil-git installs the provider at use time.
58	58		# Used for the CD deploy webhook (anvil-ci) and HTTPS push mirroring
59	59		# (anvil-git).
60		-	reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots-no-provider"] }
	60	+	# Native (system) roots rather than the bundled webpki set: `anvild secret`
	61	+	# talks to whatever anvil you self-host, including one behind a private or
	62	+	# local CA — portless's `.localhost` certificates being the everyday case. The
	63	+	# deploy image installs ca-certificates, so the server side is unaffected.
	64	+	reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots-no-provider"] }
61	65		rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] }
62	66		# Used directly only for idempotent schema shims on existing databases; the
63	67		# version tracks what toasty-driver-sqlite already pulls in.
64	68		rusqlite = "0.39"
65	69		# `anvild secret` prompts for an ssh key passphrase / an account password.
66	70		rpassword = "7"
	71	+	# WebAuthn/passkey sign-in, relying-party side. Pure Rust on purpose: the
	72	+	# better-known webauthn-rs pulls in OpenSSL, which the static-musl deploy build
	73	+	# (deploy/build.sh) cannot link.
	74	+	webauthn_rp = { version = "0.3", features = ["serde_relaxed"] }
67	75		serde = { version = "1", features = ["derive"] }
68	76		serde_json = "1"
69	77		serde_yaml = "0.9"
⋯ 25 unchanged lines

⋯ 18 unchanged lines
19	19
20	20		# Prebuilt static binary staged by deploy/build.sh.
21	21		COPY deploy/anvild /usr/local/bin/anvild
22		-	COPY deploy/anvil.toml /etc/anvil/anvil.toml
23	22
	23	+	# Which baked config to ship: production's by default, the committed local one
	24	+	# when deploy/dev.sh builds the image.
	25	+	ARG CONFIG=deploy/anvil.toml
	26	+	COPY ${CONFIG} /etc/anvil/anvil.toml
	27	+
24	28		EXPOSE 3000 2222
25	29		VOLUME /data
26	30		USER anvil
⋯ 3 unchanged lines

⋯ 275 unchanged lines
276	276		let key = ssh_key::PrivateKey::read_openssh_file(&path)
277	277		.with_context(\|\| format!("reading ssh key {}", path.display()))?;
278	278		let key = if key.is_encrypted() {
279		-	let passphrase =
280		-	rpassword::prompt_password(format!("passphrase for {}: ", path.display()))?;
	279	+	// ssh-agent is no help here: the agent protocol only signs, and opening
	280	+	// an envelope needs the scalar itself for key agreement. So the key file
	281	+	// has to be decrypted in this process.
	282	+	let passphrase = match std::env::var("ANVIL_KEY_PASSPHRASE") {
	283	+	Ok(passphrase) => passphrase,
	284	+	Err(_) => prompt_passphrase(&path)?,
	285	+	};
281	286		key.decrypt(passphrase)
282		-	.with_context(\|\| format!("decrypting {}", path.display()))?
	287	+	.with_context(\|\| format!("decrypting {} (wrong passphrase?)", path.display()))?
283	288		} else {
284	289		key
285	290		};
286	291		Ok(Identity::from_private_key(&key)?)
287	292		}
288	293
	294	+	/// Ask for the key's passphrase, explaining the way out when there is no
	295	+	/// terminal to ask on (a cron job, a pipeline, an agent's shell).
	296	+	fn prompt_passphrase(path: &std::path::Path) -> Result<String> {
	297	+	rpassword::prompt_password(format!("passphrase for {}: ", path.display())).map_err(\|e\| {
	298	+	anyhow!(
	299	+	"{} is passphrase-protected and there is no terminal to prompt on ({e}). \
	300	+	Set ANVIL_KEY_PASSPHRASE, or point --identity at an unencrypted key.",
	301	+	path.display()
	302	+	)
	303	+	})
	304	+	}
	305	+
289	306		// --- HTTP client -----------------------------------------------------------
290	307
291	308		struct Client {
⋯ 215 unchanged lines

⋯ 247 unchanged lines
248	248		toml::from_str(&text).map_err(\|e\| Error::Config(format!("parsing {}: {e}", path.display())))
249	249		}
250	250
251		-	/// Load from `path` if it exists, otherwise return defaults.
	251	+	/// Load from `path` if it exists, otherwise return defaults. Environment
	252	+	/// overrides are applied either way — see [`Config::apply_env`].
252	253		pub fn load_or_default(path: impl AsRef<Path>) -> Result<Self> {
253	254		let path = path.as_ref();
254		-	if path.exists() {
255		-	Self::load(path)
	255	+	let mut config = if path.exists() {
	256	+	Self::load(path)?
256	257		} else {
257		-	Ok(Self::default())
	258	+	Self::default()
	259	+	};
	260	+	config.apply_env(\|key\| std::env::var(key).ok());
	261	+	Ok(config)
	262	+	}
	263	+
	264	+	/// Overlay environment variables onto a loaded config, so a supervisor can
	265	+	/// place anvil wherever it likes without a config file.
	266	+	///
	267	+	/// - `ANVIL_LISTEN`, or `HOST`/`PORT` — the bind address. `PORT` (with
	268	+	/// `HOST` defaulting to `127.0.0.1`) is the convention process managers
	269	+	/// and local proxies use; portless, for one, hands the app a free port in
	270	+	/// 4000-4999 and reverse-proxies a `.localhost` name to it.
	271	+	/// - `ANVIL_BASE_URL`, or `PORTLESS_URL` — the externally visible URL that
	272	+	/// clone commands and links are built from. Getting this right is what
	273	+	/// makes the UI usable behind a proxy: the bind port is an implementation
	274	+	/// detail, `https://anvil.localhost` is the address users see.
	275	+	///
	276	+	/// Explicit `ANVIL_*` wins over the generic name, and both win over the
	277	+	/// file, on the usual "closest to the invocation" principle.
	278	+	pub fn apply_env(&mut self, env: impl Fn(&str) -> Option<String>) {
	279	+	if let Some(listen) = env("ANVIL_LISTEN") {
	280	+	self.http.listen = listen;
	281	+	} else if let Some(port) = env("PORT").filter(\|p\| p.parse::<u16>().is_ok()) {
	282	+	let host = env("HOST").unwrap_or_else(\|\| "127.0.0.1".to_string());
	283	+	self.http.listen = format!("{host}:{port}");
	284	+	}
	285	+	if let Some(base) = env("ANVIL_BASE_URL").or_else(\|\| env("PORTLESS_URL")) {
	286	+	self.http.base_url = base.trim_end_matches('/').to_string();
258	287		}
	288	+	if let Some(dir) = env("ANVIL_DATA_DIR") {
	289	+	self.data_dir = dir.into();
	290	+	}
259	291		}
260	292
261	293		/// Filesystem path to the SQLite database file.
⋯ 58 unchanged lines
320	352		mod tests {
321	353		use super::*;
322	354
	355	+	/// Look up from a fixed list, standing in for the process environment.
	356	+	fn env_of<'a>(pairs: &'a [(&'a str, &'a str)]) -> impl Fn(&str) -> Option<String> + 'a {
	357	+	move \|key\| {
	358	+	pairs
	359	+	.iter()
	360	+	.find(\|(k, _)\| *k == key)
	361	+	.map(\|(_, v)\| v.to_string())
	362	+	}
	363	+	}
	364	+
	365	+	#[test]
	366	+	fn port_and_host_set_the_bind_address() {
	367	+	let mut config = Config::default();
	368	+	config.apply_env(env_of(&[("PORT", "4738")]));
	369	+	assert_eq!(config.http.listen, "127.0.0.1:4738");
	370	+
	371	+	let mut config = Config::default();
	372	+	config.apply_env(env_of(&[("PORT", "4738"), ("HOST", "0.0.0.0")]));
	373	+	assert_eq!(config.http.listen, "0.0.0.0:4738");
	374	+	}
	375	+
	376	+	#[test]
	377	+	fn anvil_listen_wins_over_port() {
	378	+	let mut config = Config::default();
	379	+	config.apply_env(env_of(&[
	380	+	("PORT", "4738"),
	381	+	("ANVIL_LISTEN", "0.0.0.0:9000"),
	382	+	]));
	383	+	assert_eq!(config.http.listen, "0.0.0.0:9000");
	384	+	}
	385	+
	386	+	#[test]
	387	+	fn a_nonsense_port_leaves_the_configured_address_alone() {
	388	+	let mut config = Config::default();
	389	+	config.apply_env(env_of(&[("PORT", "not-a-port")]));
	390	+	assert_eq!(config.http.listen, "127.0.0.1:3000");
	391	+	}
	392	+
	393	+	#[test]
	394	+	fn proxy_url_becomes_the_base_url() {
	395	+	let mut config = Config::default();
	396	+	config.apply_env(env_of(&[("PORTLESS_URL", "https://anvil.localhost/")]));
	397	+	assert_eq!(config.http.base_url, "https://anvil.localhost");
	398	+	// …and drives the Secure cookie attribute, since it is https.
	399	+	assert!(config.secure_cookies());
	400	+
	401	+	let mut config = Config::default();
	402	+	config.apply_env(env_of(&[
	403	+	("PORTLESS_URL", "https://anvil.localhost"),
	404	+	("ANVIL_BASE_URL", "https://forge.example.com"),
	405	+	]));
	406	+	assert_eq!(config.http.base_url, "https://forge.example.com");
	407	+	}
	408	+
	409	+	#[test]
	410	+	fn an_empty_environment_changes_nothing() {
	411	+	let mut config = Config::default();
	412	+	config.apply_env(env_of(&[]));
	413	+	assert_eq!(config.http.listen, HttpConfig::default().listen);
	414	+	assert_eq!(config.http.base_url, HttpConfig::default().base_url);
	415	+	}
	416	+
323	417		#[test]
324	418		fn image_allowlist_semantics() {
325	419		let mut ci = CiConfig::default();
⋯ 18 unchanged lines

1	+	# Config for the local Docker instance started by deploy/dev.sh.
2	+	#
3	+	# Committed on purpose (unlike deploy/anvil.toml, which is gitignored because it
4	+	# holds production's deploy secret): nothing here is sensitive, and a working
5	+	# local instance should be one command away.
6	+
7	+	data_dir = "/data"
8	+
9	+	[http]
10	+	# Inside the container; deploy/dev.sh publishes it to 127.0.0.1 on the host.
11	+	listen = "0.0.0.0:3000"
12	+	# What the browser sees. dev.sh also passes ANVIL_BASE_URL, which wins — so a
13	+	# differently named instance (ANVIL_DEV_NAME=anvil2) still gets correct links.
14	+	base_url = "https://anvil.localhost"
15	+
16	+	[ssh]
17	+	enabled = true
18	+	listen = "0.0.0.0:2222"
19	+	# The published host port, i.e. dev.sh's $SSH_PORT (default: web port + 1).
20	+	# portless proxies HTTP only, so SSH clone URLs point straight at localhost.
21	+	clone_host = "localhost"
22	+	clone_port = 20641
23	+	clone_user = "git"
24	+
25	+	[ci]
26	+	# The job container is a sibling on the host's Docker daemon, as in production.
27	+	memory_mb = 2048
28	+	cpus = 2.0
29	+	timeout_secs = 600
30	+
31	+	[periodic]
32	+	# Local instances are small; scanning every 10 minutes keeps language stats and
33	+	# preview images fresh while you poke at things.
34	+	language_detection_interval_secs = 600
35	+	preview_image_interval_secs = 600
36	+	disk_usage_interval_secs = 600

1	+	#!/usr/bin/env bash
2	+	# Run anvil locally in Docker, reachable at https://anvil.localhost.
3	+	#
4	+	# The same image shape as production (deploy/build.sh + run.sh), but built and
5	+	# run on this machine: a container publishing 3000 to a fixed host port, with
6	+	# portless reverse-proxying a stable `.localhost` name onto it. Running in
7	+	# Docker rather than `cargo run` is what makes CI testable — the runner drives
8	+	# the host's Docker socket, which is mounted in.
9	+	#
10	+	# Usage:
11	+	# ./deploy/dev.sh build + (re)start, then print the URL
12	+	# ./deploy/dev.sh --release optimized binary (slower build, faster server)
13	+	# ./deploy/dev.sh --stop stop and remove the container
14	+	# ./deploy/dev.sh --logs follow the container log
15	+	#
16	+	# State lives in the `anvil-dev-data` volume and survives restarts;
17	+	# `docker volume rm anvil-dev-data` starts over.
18	+	set -euo pipefail
19	+
20	+	cd "$(dirname "$0")/.."
21	+
22	+	NAME="${ANVIL_DEV_NAME:-anvil}"
23	+	IMAGE="anvil-dev:latest"
24	+	TARGET="x86_64-unknown-linux-musl"
25	+	VOLUME="anvil-dev-data"
26	+	# A stable, collision-resistant port for this project (see `devport -h`), so the
27	+	# published port does not wander between runs. portless maps a name onto it.
28	+	PORT="${ANVIL_DEV_PORT:-$(command -v devport >/dev/null && devport \|\| echo 20640)}"
29	+	SSH_PORT="${ANVIL_DEV_SSH_PORT:-$((PORT + 1))}"
30	+	PROFILE=debug
31	+	CARGO_FLAGS=()
32	+
33	+	for arg in "$@"; do
34	+	case "$arg" in
35	+	--release)
36	+	PROFILE=release
37	+	CARGO_FLAGS+=(--release)
38	+	;;
39	+	--stop)
40	+	docker rm -f "$NAME" >/dev/null 2>&1 \|\| true
41	+	portless alias --remove "$NAME" >/dev/null 2>&1 \|\| true
42	+	echo "stopped $NAME"
43	+	exit 0
44	+	;;
45	+	--logs)
46	+	exec docker logs -f "$NAME"
47	+	;;
48	+	*)
49	+	echo "unknown flag: $arg" >&2
50	+	exit 2
51	+	;;
52	+	esac
53	+	done
54	+
55	+	echo "==> building anvild ($PROFILE, static musl)"
56	+	# Static musl, exactly as in production: the runtime image is debian-slim and a
57	+	# binary linked against Fedora's glibc would not run there.
58	+	cargo zigbuild --target "$TARGET" --bin anvild "${CARGO_FLAGS[@]}"
59	+	cp "target/$TARGET/$PROFILE/anvild" deploy/anvild
60	+	trap 'rm -f deploy/anvild' EXIT
61	+
62	+	echo "==> building $IMAGE"
63	+	docker build --quiet --platform linux/amd64 \
64	+	--build-arg CONFIG=deploy/anvil.dev.toml -t "$IMAGE" . >/dev/null
65	+
66	+	echo "==> (re)starting container $NAME"
67	+	docker rm -f "$NAME" >/dev/null 2>&1 \|\| true
68	+	# The CI runner is a Docker client, so it needs the socket and the group that
69	+	# owns it. `label=disable` rather than a `:z` relabel: :z would rewrite the
70	+	# label on the host's socket, which every other container also uses.
71	+	docker run -d --name "$NAME" --restart unless-stopped \
72	+	-p "127.0.0.1:$PORT:3000" \
73	+	-p "127.0.0.1:$SSH_PORT:2222" \
74	+	-v "$VOLUME:/data" \
75	+	-v /var/run/docker.sock:/var/run/docker.sock \
76	+	--security-opt label=disable \
77	+	--group-add "$(stat -c '%g' /var/run/docker.sock)" \
78	+	-e "ANVIL_BASE_URL=https://$NAME.localhost" \
79	+	"$IMAGE" >/dev/null
80	+
81	+	# Wait for the server to answer before handing over a URL that would 502.
82	+	for _ in $(seq 1 50); do
83	+	if curl -fsS -o /dev/null "http://127.0.0.1:$PORT/-/healthz" 2>/dev/null; then
84	+	break
85	+	fi
86	+	sleep 0.2
87	+	done
88	+
89	+	if command -v portless >/dev/null; then
90	+	echo "==> routing https://$NAME.localhost -> 127.0.0.1:$PORT"
91	+	portless alias "$NAME" "$PORT" >/dev/null
92	+	URL="https://$NAME.localhost"
93	+	else
94	+	echo "==> portless not installed; skipping the .localhost route"
95	+	URL="http://127.0.0.1:$PORT"
96	+	fi
97	+
98	+	cat <<EOF
99	+
100	+	anvil is up.
101	+
102	+	web $URL
103	+	ssh ssh://git@localhost:$SSH_PORT/<owner>/<repo>.git
104	+	direct http://127.0.0.1:$PORT
105	+
106	+	First run? Create an account and a repo:
107	+
108	+	docker exec $NAME anvild -c /etc/anvil/anvil.toml \\
109	+	user create <you> --password '<password>' --admin
110	+	docker exec -i $NAME anvild -c /etc/anvil/anvil.toml \\
111	+	user add-key <you> --title laptop --key "\$(cat ~/.ssh/id_ed25519.pub)"
112	+
113	+	Logs: ./deploy/dev.sh --logs Stop: ./deploy/dev.sh --stop
114	+	EOF

⋯ 165 unchanged lines
166	166		"argon2 0.5.3",
167	167		"async-trait",
168	168		"base64",
169		-	"curve25519-dalek",
	169	+	"curve25519-dalek 5.0.0-rc.0",
170	170		"gix",
171	171		"hmac 0.12.1",
172	172		"pulldown-cmark",
⋯ 9 unchanged lines
182	182		"tokio",
183	183		"toml",
184	184		"tracing",
	185	+	"webauthn_rp",
185	186		]
186	187
187	188		[[package]]
⋯ 18 unchanged lines
206	207		dependencies = [
207	208		"anvil-core",
208	209		"anvil-git",
209		-	"rand",
	210	+	"rand 0.10.1",
210	211		"russh",
211	212		"tokio",
212	213		"tracing",
⋯ 23 unchanged lines
236	237		"tokio-util",
237	238		"tower-http",
238	239		"tracing",
	240	+	"webauthn_rp",
239	241		]
240	242
241	243		[[package]]
⋯ 141 unchanged lines
383	385
384	386		[[package]]
385	387		name = "base16ct"
	388	+	version = "0.2.0"
	389	+	source = "registry+https://github.com/rust-lang/crates.io-index"