+1 -2

.env.sample

reviewed

··· 5 5 6 6 # ATProto DID of the spindle owner (e.g. did:plc:xxxxxxxxxxxxxxxxxxxx) 7 7 # Find yours at: https://bsky.app → Settings → Privacy and Security → Advanced 8 8 - SPINDLE_SERVER_OWNER= 9 9 - is i 8 8 + SPINDLE_SERVER_OWNER=

+2 -2

Dockerfile

reviewed

··· 1 1 # ── Build stage ─────────────────────────────────────────────────────────────── 2 2 - FROM golang:1.23-alpine AS builder 2 2 + FROM golang:1.23.12-alpine3.22@sha256:383395b794dffa5b53012a212365d40c8e37109a626ca30d6151c8348d380b5f AS builder 3 3 4 4 RUN apk add --no-cache git 5 5 ··· 12 12 RUN go build -o /spindle ./cmd/spindle/main.go 13 13 14 14 # ── Runtime stage ───────────────────────────────────────────────────────────── 15 15 - FROM alpine:3.20 15 15 + FROM alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 16 16 17 17 RUN apk add --no-cache ca-certificates docker-cli 18 18

+2 -2

docker-compose.yml

reviewed

··· 2 2 3 3 # ── OpenBao (secrets vault) ──────────────────────────────────────────────── 4 4 openbao: 5 5 - image: quay.io/openbao/openbao:latest 5 5 + image: quay.io/openbao/openbao:2.5.2@sha256:6c75c97223873807260352f269640935a07db0c26b3dbf12a98a36ec43ad9878 6 6 container_name: openbao 7 7 restart: unless-stopped 8 8 command: server ··· 26 26 27 27 # ── OpenBao proxy (AppRole auto-auth sidecar) ────────────────────────────── 28 28 openbao-proxy: 29 29 - image: quay.io/openbao/openbao:latest 29 29 + image: quay.io/openbao/openbao:2.5.2@sha256:6c75c97223873807260352f269640935a07db0c26b3dbf12a98a36ec43ad9878 30 30 container_name: openbao-proxy 31 31 restart: unless-stopped 32 32 command: proxy -config=/openbao/config/proxy.hcl