Kristian WindandClaude Opus 5
1eb6fd930d
Installing the Rune failed with
create container: Error response from daemon:
No such image: ghcr.io/kristianwind/verdande:latest
which was two things wearing one message. No semver tag had ever been
pushed, so release.yml had never run and the image did not exist. And now
that v0.1.0 is published, the package is private because the repository
is — and an anonymous pull reports that as "no such image" rather than as
a permission error, which sends you looking in the wrong place. The
Docker daemon on the host has to be logged in once, as whichever user
runs it. Said in rune.md, self-hosting.md, the README and the handoff,
because whichever one you are holding is the one that has to say it.
The handoff's seven gaps are down to the ones that need real credentials
and real services: Gmail against an account, Web Push against a push
service, PNG icons for iOS, the AI adapters against a key. Added in their
place are the traps this round cost the most time on — that the embedded
frontend is a copy that npm run build does not touch, that Playwright
re-runs its config in every worker, and that svelte-check is not a gate
in a codebase with no type annotations.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
76 lines
2.8 KiB
Markdown
76 lines
2.8 KiB
Markdown
# Installing as a Rune
|
|
|
|
verdande ships with a Rune manifest for
|
|
[Yggdrasil Panel](https://github.com/kristianwind/yggdrasil).
|
|
|
|
## Before you start: the registry is private
|
|
|
|
The image lives at `ghcr.io/kristianwind/verdande` and the package is **private**,
|
|
so an anonymous pull fails with a message that reads as though the image does not
|
|
exist at all:
|
|
|
|
```
|
|
create container: Error response from daemon:
|
|
No such image: ghcr.io/kristianwind/verdande:latest
|
|
```
|
|
|
|
That is a permission error wearing the wrong hat. The Docker daemon **on the
|
|
Yggdrasil host** has to be logged in once:
|
|
|
|
```bash
|
|
echo "$GHCR_TOKEN" | docker login ghcr.io -u kristianwind --password-stdin
|
|
```
|
|
|
|
`GHCR_TOKEN` is a GitHub personal access token with the **`read:packages`** scope
|
|
and nothing else. The login is stored in `~/.docker/config.json` for whichever
|
|
user runs the daemon — if Yggdrasil runs as root or through systemd, log in as
|
|
that user, not as yourself.
|
|
|
|
!!! tip "Or make the package public"
|
|
Under **Packages → verdande → Package settings → Change visibility**. The
|
|
repository can stay private; only the built image becomes readable. Then no
|
|
login is needed anywhere and this section stops applying.
|
|
|
|
## Installing
|
|
|
|
1. **Runes → Carve a rune (upload)** and pick
|
|
[`rune/verdande.yaml`](https://github.com/kristianwind/verdande/blob/main/rune/verdande.yaml)
|
|
from the repository.
|
|
2. Create a server from it.
|
|
3. Fill in the settings below.
|
|
4. Start it, open the URL, create the first account.
|
|
|
|
## Settings
|
|
|
|
| Setting | What to put |
|
|
|---|---|
|
|
| **Public address** | The address you reach it on. `{{PUBLIC_URL}}` is the default and usually right. |
|
|
| **SMTP host** | Your mail server. Leave blank and invite links are shown in the app instead of emailed. |
|
|
| **SMTP port** | 587 for STARTTLS, 465 for implicit TLS. |
|
|
| **SMTP username / password** | As your mail server expects. |
|
|
| **Sender address** | What invites and reminders come from. |
|
|
| **Use STARTTLS** | On, unless you are on port 465. |
|
|
| **How long a login lasts** | `720h` — thirty days. |
|
|
|
|
!!! note "Why the public address cannot be guessed"
|
|
The host port is not chosen until the server is created, so verdande has no way
|
|
to work out its own address. The panel does, and passes it in as
|
|
`{{PUBLIC_URL}}`.
|
|
|
|
## Reaching it from outside
|
|
|
|
Give the server a **Subdomain** under its settings and enable
|
|
**Cloudflare Tunnel (subdomains)** under **Settings → Network**. No port forwarding
|
|
and no public IP.
|
|
|
|
## Backups
|
|
|
|
The Rune's backup includes the whole `/data` directory, which is what you want —
|
|
see [the warning about copying the database alone](self-hosting.md#what-lives-in-data).
|
|
|
|
## Watchers
|
|
|
|
The manifest ships log watchers for database errors, repeated failed logins and
|
|
HTTP 5xx. They appear under **Settings → Kvasir Watchers** as ordinary per-server
|
|
rules you can edit or turn off.
|