Community
Chat Logs
Tuesday, June 16, 2026
- * phaleth joined #primate
- bluehi phaleth
- phalethhi blue
- phalethlong list https://freebsdfoundation.github.io/freebsd-laptop-testing/
- nevetFreeBSD Laptop Compatibility
- bluelol
- bluedid I tell you the ssd on my t480 broke down?
- blueI ordered a samsung 990 PRO NVMe M.2, 1TB, should be arriving today
- phalethalready huh
- bluewell it was a used computer
- blueI should have known tbh, to begin with. because when I first put superarch on it, the first install broke down in the middle. and then I had a sudden btrfs remounts root as readonly, once a week
- blueso I was expecting it
- bluethis 990 PRO NVME M.2 is totally an overkill for this computer: its throughput is roughly 4x than what the pci 3.0 x2 port can handle
- phalethok, as long as you don't loose any data it's fine, I also expect mine to break down
- bluebut it's a tlc thing, and it's reliable, I could just put it in the next comptuer
- blueand I prefer 1tb to the 512mb I had. these containers take a lot of room
- bluethe oracle container is like 5gb
- blue512gb*
- blueI've been working on repopack. so good news, I checked how gitea handles ssh, and it's easier than I thought. you have two options. you can have a hugebutt authorized_keys file where for every key, you specify a command and then you essentially have a command that gets the key and runs stuff
- blueor, the better solution is, there's an openssh config variable that does that as well
- blueand inside the run command, the key is available as OPENSSH_KEY or so
- blueso you can derive the user and the acl from that
- blueno need for ssh2 or other shenanigangs, we can keep to openssh
- blueanother thing I've been doing is putting plans into the database (not commited yet)
- blueso I've noticed the primate/node, primate/bun and primate/deno plans all end up having the same yaml
- phalethso there will be a huge openssh config file?
- blueno, we're going with the second option
- phaleththe variable? is there no size limit to that?
- blueit's programmatic
- blueso you have two options
- phalethyeah, I cannot imagine, but if openssh server has some sort of API then great
- bluehugebutt authorized_keys with these lines:
- phalethI can imageine the authorized_keys file
- phalethbut the problem is that it's a file and not a db
- bluecommand="/path/to/repopack serve key-42",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-ed25519 AAAA
- blueor, you put in sshd_config
- blueAuthorizedKeysCommand /usr/local/bin/rp-authorize keys -e git -u %u -t %t -k %k
- blueAuthorizedKeysCommandUser git
- bluesmth like that
- phalethok, well, would be great if all of the data would be stored in the db as well and the application was just able to configure whatever necessary
- blueyes. the pubkeys will be in the db
- blueand this command will just run
- bluequery the db using the %k
- blueand do stuff
- phalethjust imagine you have a problem on PROD system and now you need the data and configs quickly
- blueit's all gonna be in the db
- phalethall the software I know and work with is making the process of debugging a problem very time consuming
- phalethcool
- bluethis rp-authorize or whatever will just query the db. fortunately primate can do that, because random .ts files can just import the db or stores and query in isolation
- phalethok, sounds good
- phalethnow the difficulty may only be in building the entire system, but that's expected
- phalethalso deploying
- bluewell, one of the milestones would be deploying rp locally, on rp
- bluefor that I might need haproxy locally, which is going to be a bit annoying
- blueesp with the subdomains and stuff
- phalethI think rp will just run in a priviledged container and there will only be one subdomain pointing to it
- phalethpriviledged so it can manage the haproxy configuration and connect to podman via localhost and whatnot
- blueya
- blueso as I was saying, I reworked the plans a bit
- phalethactually the repopack.com domain should point to it since it's hosting the website
- bluethey now have variants, which means different Containerfiles (it's a 1:n table)
- blueyes
- blueso the primate plan has node, node-lts, bun and deno variants. the main variant is node-lts, but you can choose another if you want
- phalethok, variants of containerfiles?
- blueyes. plan variants. a deployment_plan_variant table containing deployment_plan_id and containerfile
- phalethok, well, people will wanna run nextjs
- bluethat's a nextjs plan
- blueit's unrelated to the primate plan, and has other conditions (like a next.config.js file, and a next dependency)
- phalethbut if these variants are not difficult to create, as in it's kinda just configuration then why not
- blueyup
- bluehttps://superarch.org/variants.png
- phalethalso if it follows the idea of pre-built images then it may also make deployments fast
- blueyou cannot 100% prebuild the image because we're copying your code into. but you can prebuild some of it
- blueI also added the concept of extensions, to a plan. I don't know if it's going to be widely used but for primate it's super useful
- phalethah, so people should be able to edit those Containerfiles
- blueI was able to a define a go_mod extension for the primate plan, and then I could deploy apps/go (it needs a `go` executable)
- blueso RP can now technically deploy a primate app with go, python and ruby backends, even if combined
- bluewhich I don't think any service on earth can do
- phalethyeah
- phalethI think the idea is to make all nextjs plans paid and primate ones free :)
- blueand yes, people will be able to create their own custom plans, either for their own use, or submit for general use
- bluehaha, YES!
- blueanyway, before I commit those changes, I'll add a preseed step you can execute so you don't have to manually enter the plans I've entered
- bluethe nice thing now is that you can edit a plan, redeploy, and see if it improves/changes anything
- * jreicher joined #primate
- phalethwell, do you think it'd be possible to disallow editing of FROM lines? and also COPY lines
- phalethjust have the person specify where is the src dir in the repo
- bluethat's already done; you specify a path for your app
- phalethand also not allow any fetching of whatever from the interwebz, which is tricky
- phalethonly allow the builder to reach container registries
- phalethfor starters I'd just not allow anybody to edit a plan
- bluestep 1 is just us making plans. step 2 is users submit plans, and we approve them. step 3 are custom plans used by the user in his apps, but that's the most dangerous
- bluefor now we're going to stick to step 1 and if anyone needs anything he can create a support ticket on repopack.com/repopack/support repo
- phalethI think we can just let anybody do whatever but with very limited resources
- blueya
- phalethand if they want their app to run fast then they should not use nextjs or whatever :) just use primate to get all benefits
- phalethcause you know if you let people execute arbitrary code you might as well just let them deploy however they want
- phalethpodman has a bunch of not only resource limits but also rate limits, but it should be tricky to figure out the usage
- blueyes
- phalethsome rate limits will just have to be enforced by repopack
- blueremember that in the future, we're going to segment customers by vps/dedi if they're enterprise
- bluesince you'd need slas for these servers
- blueenterprise clients are gonna be the money cows, anyway
- phalethyeah, windows servers
- bluespeaking of slas, I belive contabo offers them
- bluehaha
- bluephaleth: I pushed out all the changes. I'll send you the json export
- blueyou just go to plans, click on Import JSON, select the file, and run it
- phalethjson
- blueyes
- blueeasiest way for you to seed the db
- phalethso why is not automatic? like on every start it can check if there is a seed script and if it executed that and if not then exec that
- blueit could be, but this was easier for now. we're gonna mess around a lot with those plans
- phalethI guess it's cause WIP :)
- blueexacty
- bluethe import and export are gonna go away anyway
- phalethok, I will have to try later
- bluecool
- bluenow you can also choose 'detect' in the plan configuration of an app
- blueif you choose an app, you will have the option of choosing a variant
- blueand all primate apps under the primate repo /apps, are adapted to be deployable by RP, given the plans I've provided you
- bluethough I think only the primate/bun variant handles extensions, for now
- blueso if you want to test apps/{go,python,ruby}, you'd need to use that variant
- blueif you a plan*, I meant
- blueif you choose a plan*
- bluehttps://github.com/primate-run/primate/commit/a822c25a842d21e2159b2eb8643e466c7f4b4298
- nevetmake all apps deployable · primate-run/primate@a822c25
- bluethis is the commit that adapted them. mostly moved the ports to .env.local instead of hardcoded in the primate config, since RP can't handle that
- blueand I've patched primate to read the PORT env variable if set, and if http.port wasn't explicitly set in the config
- blueso what happens is kinda cool. if you run those apps locally, they're gonna use the port in .env.local. which is great because you want different ports to be able to run them in parallel, with no conflicts
- bluebut if you run those apps through rp, they're isolated and you can just use the default PORT that the primate plan injects, which is 6161
- blueand then rp knows to map this inner port to some random external port 42xxx
- blueanother thing I did with primate is that it reads the HOST env variable if http.host isn't explicitly set
- bluethis was very important for rp, because primate's default is 127.0.0.1, that doesn't work in a container
- blueso the primate plan just injects 0.0.0.0 and everything works
- bluewe skirted around this problem by explicitly setting http.host to 0.0.0.0 in apps/website, if you remember. once we move to rp for deployment we won't need this hack
- bluehttps://github.com/primate-run/primate/blob/master/apps/website/config/app.ts#L9-L11
- bluethese 3 lines will disappear once we use rp to deploy the website
- bluewhich is good: they were only added so it works in podman
- phalethyeah, noone else will be deploying primate website on public intewebz
- phalethanyway, think about only having primate plans then a static plan and then a custom plan and that's it
- phalethcause nowadays people expect magic to happen and not to have to choose a plan
- blueya
