From 6c457b506a3cf53f8339fed7b509fb6867dc1969 Mon Sep 17 00:00:00 2001
From: infra-bot <infra-bot@git.ziemlichoptimal.de>
Date: Sat, 13 Jun 2026 22:54:45 +0200
Subject: [PATCH] ci: pin each commit to IPFS and republish IPNS for
 random.ziemlichoptimal.de

---
 .forgejo/workflows/pin.yaml | 97 +++++++++++++++++++++++++++++++++++++
 1 file changed, 97 insertions(+)
 create mode 100644 .forgejo/workflows/pin.yaml

diff --git a/.forgejo/workflows/pin.yaml b/.forgejo/workflows/pin.yaml
new file mode 100644
index 0000000..ff18dcc
--- /dev/null
+++ b/.forgejo/workflows/pin.yaml
@@ -0,0 +1,97 @@
+name: Pin to IPFS
+
+# On every push to main: pin the new commit's content to the cluster IPFS node
+# and republish the stable IPNS key 'randomp2p' to the new CID. The Traefik
+# route random.ziemlichoptimal.de -> /ipns/<key> then serves the newest content
+# automatically (no DNS or route changes needed).
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  pin:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install kubectl
+        run: |
+          set -e
+          curl -sSLo /usr/local/bin/kubectl \
+            "https://dl.k8s.io/release/$(curl -sSL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
+          chmod +x /usr/local/bin/kubectl
+          kubectl version --client=true
+
+      - name: Write kubeconfig
+        run: |
+          mkdir -p "$HOME/.kube"
+          echo "${{ secrets.PINNER_KUBECONFIG }}" | base64 -d > "$HOME/.kube/config"
+          chmod 600 "$HOME/.kube/config"
+
+      - name: Pin commit and republish IPNS
+        env:
+          SHA: ${{ github.sha }}
+        run: |
+          set -e
+          JOB="pin-$(echo "$SHA" | cut -c1-8)-${{ github.run_number }}"
+          IPNS=k51qzi5uqu5dkac07gojwychmyf3uy08q2fkw4glpjw5mfovz91j3m8qpchhwo
+
+          # Create a one-off pin Job in the ipfs namespace.
+          kubectl -n ipfs create -f - <<EOF
+          apiVersion: batch/v1
+          kind: Job
+          metadata:
+            name: ${JOB}
+            namespace: ipfs
+            labels: { app: randomp2p-pin }
+          spec:
+            backoffLimit: 1
+            ttlSecondsAfterFinished: 3600
+            template:
+              spec:
+                restartPolicy: Never
+                initContainers:
+                  - name: clone
+                    image: alpine/git:latest
+                    command: [sh, -c]
+                    args:
+                      - |
+                        set -e
+                        git clone https://git.ziemlichoptimal.de/niels/randomp2p.git /work/repo
+                        cd /work/repo
+                        git checkout ${SHA}
+                        rm -rf /work/repo/.git
+                    volumeMounts:
+                      - { name: work, mountPath: /work }
+                containers:
+                  - name: pin
+                    image: ipfs/kubo:v0.34.1
+                    command: [sh, -c]
+                    args:
+                      - |
+                        set -e
+                        API=/dns4/ipfs.ipfs.svc.cluster.local/tcp/5001
+                        CID=\$(ipfs --api=\$API add -Q -r --cid-version 1 /work/repo)
+                        echo "PINNED_CID=\$CID"
+                        ipfs --api=\$API name publish --key=randomp2p --allow-offline "/ipfs/\$CID"
+                        echo "PUBLISHED /ipns/${IPNS} -> /ipfs/\$CID"
+                    volumeMounts:
+                      - { name: work, mountPath: /work }
+                volumes:
+                  - { name: work, emptyDir: {} }
+          EOF
+
+          echo "Waiting for job ${JOB} to complete..."
+          kubectl -n ipfs wait --for=condition=complete "job/${JOB}" --timeout=300s || true
+
+          echo "===== job logs ====="
+          kubectl -n ipfs logs "job/${JOB}" --all-containers=true || true
+
+          # Succeed only if the job completed successfully.
+          if [ "$(kubectl -n ipfs get job "${JOB}" -o jsonpath='{.status.succeeded}')" = "1" ]; then
+            echo "Pin + IPNS publish succeeded."
+            kubectl -n ipfs logs "job/${JOB}" | grep -E "PINNED_CID|PUBLISHED" || true
+          else
+            echo "Pin job did not succeed." >&2
+            exit 1
+          fi