From cc1aeb6a009a86347af9b8f2283c5cbc63460ad6 Mon Sep 17 00:00:00 2001 From: Reactorcoremeltdown Date: Mon, 2 Nov 2026 15:52:48 +0100 Subject: [PATCH] Fix the Android release build and tighten the Helm values Every Android release build runs lint, which AGP 8.7 cannot run on JDK 26, the JDK Homebrew's Gradle starts on; make android failed unless JAVA_HOME was set by hand. gradle/gradle-daemon-jvm.properties now runs the Gradle daemon on JDK 17 whatever launches it. The Helm values trusted every private address range as a proxy, which let any client on the LAN choose its own address for the sign-in rate limits. They now name only the nginx host and the k3s pod network. The port gains healthcheckPath, so the pod gets readiness and liveness probes. Co-Authored-By: Claude Opus 5.5 --- android/README.md | 5 +++-- android/gradle/gradle-daemon-jvm.properties | 5 +++++ config/variables/server.values.yaml | 13 ++++++++++--- docs/HANDOVER.md | 7 +++++++ 4 files changed, 25 insertions(+), 5 deletions(-) create mode 100644 android/gradle/gradle-daemon-jvm.properties diff --git a/android/README.md b/android/README.md index 2096dad..e1eb9ff 100644 --- a/android/README.md +++ b/android/README.md @@ -27,8 +27,9 @@ The merge policy in `Mirror.decide` is the same table as the desktop client's ## Building -Requirements: JDK 17 (lint in AGP 8.7 fails on newer JDKs; set `JAVA_HOME` -to a 17 when Gradle defaults to something else), Gradle 8.9 or newer, and an +Requirements: a JDK 17 installed (Gradle 8.9 or newer runs its daemon on it +whatever JDK launches Gradle, per `gradle/gradle-daemon-jvm.properties`: +AGP 8.7's lint, which every release build runs, fails on newer JDKs), and an Android SDK with `platforms;android-35` and `build-tools;35.0.0`. diff --git a/android/gradle/gradle-daemon-jvm.properties b/android/gradle/gradle-daemon-jvm.properties new file mode 100644 index 0000000..4210eb8 --- /dev/null +++ b/android/gradle/gradle-daemon-jvm.properties @@ -0,0 +1,5 @@ +# The Gradle daemon runs on JDK 17 whatever the launcher runs on. AGP 8.7's +# lint, which every release build runs (lintVitalAnalyzeRelease), cannot +# parse the version string of newer JDKs, and a Gradle installed from +# Homebrew launches on the newest one. +toolchainVersion=17 diff --git a/config/variables/server.values.yaml b/config/variables/server.values.yaml index 9496a02..382daaa 100644 --- a/config/variables/server.values.yaml +++ b/config/variables/server.values.yaml @@ -5,10 +5,13 @@ environment: value: "/etc/keeporg/config.txt" - name: "KEEPORG_EXTERNAL_URL" value: "https://keeporg.tiredsysadmin.cc" -# nginx reaches the pod from the cluster's private network; its -# X-Forwarded-For is what the sign-in rate limits count by. +# Only the hops between nginx and the pod: the nginx host itself, and the +# k3s pod network, which kube-proxy's NodePort translation makes the source +# of every connection. Sign-in rate limits count by the address nginx puts +# in X-Forwarded-For; a whole private range here would let any client on it +# claim a fresh address with a header of its own. - name: "KEEPORG_TRUSTED_PROXIES" - value: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" + value: "10.200.1.3,10.42.0.0/16" image: name: "repo.rcmd.space/keeporg" version: "v0.1.0" @@ -18,6 +21,10 @@ network: node: 32970 source: 8765 destination: 8765 + # Readiness keeps traffic away until the server has opened (and, on the + # first start of 0.11, imported) its database; liveness restarts it if + # it stops answering. + healthcheckPath: "/healthz" mounts: - name: "db" source: "/var/lib/keeporg" diff --git a/docs/HANDOVER.md b/docs/HANDOVER.md index 4cc6971..20b5307 100644 --- a/docs/HANDOVER.md +++ b/docs/HANDOVER.md @@ -846,6 +846,13 @@ key arrives as the Kubernetes secret `keeporg-encryption` mounted on at it. `KEEPORG_EXTERNAL_URL=https://keeporg.tiredsysadmin.cc` matches the nginx `server_name`; the image's command passes neither `-config` nor `-url`, so this variable is the only thing that sets it there. +`KEEPORG_TRUSTED_PROXIES` names only the nginx host (10.200.1.3) and the k3s +pod network (10.42.0.0/16, the source address after kube-proxy's NodePort +translation); a wider range would let clients on it choose their own address +for the rate limits. The port's `healthcheckPath: /healthz` gives the pod +readiness and liveness probes. The `keeporg-encryption` secret's +`config.txt` must be the master key itself — base64 of 32 bytes, or 32 raw +bytes — since 0.11 refuses to start without one. `KEEPORG_ADMIN_PASSWORD` is not set there, so the first start logs a generated password once.