-34

scripts/nixtests/README.md

reviewed

··· 1 1 - # Nix-based PDS scripts 2 2 - 3 3 - Run a local ATProto PDS using the `bluesky-pds` package from nixpkgs (no Docker required). 4 4 - 5 5 - ## Prerequisites 6 6 - 7 7 - ```bash 8 8 - nix develop # enters dev shell with `pds` on PATH 9 9 - ``` 10 10 - 11 11 - ## Quick start 12 12 - 13 13 - ```bash 14 14 - ./scripts/nixtests/start.sh # generates secrets on first run, starts PDS 15 15 - ./scripts/nixtests/create-account.sh # creates test.localhost account 16 16 - ./scripts/nixtests/login.sh # prints access token 17 17 - ``` 18 18 - 19 19 - ## Scripts 20 20 - 21 21 - | Script | Description | 22 22 - |--------|-------------| 23 23 - | `setup.sh` | Generate secrets and write `pds.env` (called automatically by `start.sh`) | 24 24 - | `start.sh` | Start the PDS in the background with health checking | 25 25 - | `stop.sh` | Gracefully stop the PDS | 26 26 - | `reset.sh` | Stop and wipe all data for a fresh start | 27 27 - | `create-account.sh` | Create a test account (default: `test.localhost`) | 28 28 - | `login.sh` | Log in and print an access token | 29 29 - 30 30 - ## Notes 31 31 - 32 32 - - Data is stored in `scripts/nixtests/pds-data/` (gitignored) 33 33 - - PDS listens on port 3000 by default 34 34 - - Logs are written to `pds-data/pds.log`

-41

scripts/nixtests/create-account.sh

reviewed

··· 1 1 - #!/usr/bin/env bash 2 2 - # Creates a test account on the local PDS. 3 3 - # 4 4 - # Usage: 5 5 - # ./create-account.sh # defaults: test.localhost / test-password-123 6 6 - # ./create-account.sh myhandle.localhost mypass 7 7 - set -euo pipefail 8 8 - 9 9 - HANDLE="${1:-test.localhost}" 10 10 - PASSWORD="${2:-test-password-123}" 11 11 - PDS_URL="${PDS_URL:-http://localhost:3000}" 12 12 - 13 13 - echo "Creating account: ${HANDLE}" 14 14 - 15 15 - RESPONSE=$(curl -s -X POST \ 16 16 - -H "Content-Type: application/json" \ 17 17 - -d "{ 18 18 - \"email\": \"${HANDLE}@example.com\", 19 19 - \"handle\": \"${HANDLE}\", 20 20 - \"password\": \"${PASSWORD}\" 21 21 - }" \ 22 22 - "${PDS_URL}/xrpc/com.atproto.server.createAccount") 23 23 - 24 24 - # check for error 25 25 - if echo "${RESPONSE}" | grep -q '"error"'; then 26 26 - echo "Failed to create account:" 27 27 - echo "${RESPONSE}" | python3 -m json.tool 2>/dev/null || echo "${RESPONSE}" 28 28 - exit 1 29 29 - fi 30 30 - 31 31 - DID=$(echo "${RESPONSE}" | python3 -c "import sys,json; print(json.load(sys.stdin)['did'])" 2>/dev/null || echo "unknown") 32 32 - ACCESS_JWT=$(echo "${RESPONSE}" | python3 -c "import sys,json; print(json.load(sys.stdin)['accessJwt'])" 2>/dev/null || echo "unknown") 33 33 - 34 34 - echo "" 35 35 - echo "Account created:" 36 36 - echo " Handle: ${HANDLE}" 37 37 - echo " Password: ${PASSWORD}" 38 38 - echo " DID: ${DID}" 39 39 - echo "" 40 40 - echo "Access token (for manual testing):" 41 41 - echo " ${ACCESS_JWT}"

-42

scripts/nixtests/login.sh

reviewed

··· 1 1 - #!/usr/bin/env bash 2 2 - # Logs in to the local PDS and prints the access token. 3 3 - # 4 4 - # Usage: 5 5 - # ./login.sh # defaults: test.localhost / test-password-123 6 6 - # ./login.sh myhandle.localhost mypass 7 7 - # 8 8 - # The access token is printed on its own line for piping: 9 9 - # TOKEN=$(./login.sh) 10 10 - set -euo pipefail 11 11 - 12 12 - HANDLE="${1:-test.localhost}" 13 13 - PASSWORD="${2:-test-password-123}" 14 14 - PDS_URL="${PDS_URL:-http://localhost:3000}" 15 15 - 16 16 - RESPONSE=$(curl -s -X POST \ 17 17 - -H "Content-Type: application/json" \ 18 18 - -d "{ 19 19 - \"identifier\": \"${HANDLE}\", 20 20 - \"password\": \"${PASSWORD}\" 21 21 - }" \ 22 22 - "${PDS_URL}/xrpc/com.atproto.server.createSession") 23 23 - 24 24 - # check for error 25 25 - if echo "${RESPONSE}" | grep -q '"error"'; then 26 26 - echo "Login failed:" >&2 27 27 - echo "${RESPONSE}" | python3 -m json.tool 2>/dev/null >&2 || echo "${RESPONSE}" >&2 28 28 - exit 1 29 29 - fi 30 30 - 31 31 - # if stdout is a terminal, print labels; otherwise just the token 32 32 - if [ -t 1 ]; then 33 33 - DID=$(echo "${RESPONSE}" | python3 -c "import sys,json; print(json.load(sys.stdin)['did'])" 2>/dev/null || echo "unknown") 34 34 - ACCESS_JWT=$(echo "${RESPONSE}" | python3 -c "import sys,json; print(json.load(sys.stdin)['accessJwt'])" 2>/dev/null || echo "unknown") 35 35 - echo "Logged in as ${HANDLE} (${DID})" 36 36 - echo "" 37 37 - echo "Access token:" 38 38 - echo " ${ACCESS_JWT}" 39 39 - else 40 40 - # piped — just the token 41 41 - echo "${RESPONSE}" | python3 -c "import sys,json; print(json.load(sys.stdin)['accessJwt'])" 42 42 - fi

-12

scripts/nixtests/reset.sh

reviewed

··· 1 1 - #!/usr/bin/env bash 2 2 - # Stops the PDS and wipes all data for a fresh start. 3 3 - set -euo pipefail 4 4 - 5 5 - SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" 6 6 - 7 7 - bash "${SCRIPT_DIR}/stop.sh" 8 8 - 9 9 - echo "Removing pds-data/ and pds.env..." 10 10 - rm -rf "${SCRIPT_DIR}/pds-data" 11 11 - rm -f "${SCRIPT_DIR}/pds.env" 12 12 - echo "Reset complete."

-47

scripts/nixtests/setup.sh

reviewed

··· 1 1 - #!/usr/bin/env bash 2 2 - # Generates secrets and writes pds.env for local development. 3 3 - # Run once before starting the PDS for the first time. 4 4 - set -euo pipefail 5 5 - 6 6 - SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" 7 7 - ENV_FILE="${SCRIPT_DIR}/pds.env" 8 8 - DATA_DIR="${SCRIPT_DIR}/pds-data" 9 9 - 10 10 - if [ -f "${ENV_FILE}" ]; then 11 11 - echo "pds.env already exists, skipping setup." 12 12 - echo "Run reset.sh first if you want a fresh environment." 13 13 - exit 0 14 14 - fi 15 15 - 16 16 - echo "Generating secrets..." 17 17 - 18 18 - JWT_SECRET=$(openssl rand --hex 16) 19 19 - ADMIN_PASSWORD=$(openssl rand --hex 16) 20 20 - ROTATION_KEY=$(openssl ecparam -name secp256k1 -genkey -noout -outform DER 2>/dev/null | \ 21 21 - tail -c +8 | head -c 32 | xxd -p -c 32) 22 22 - 23 23 - mkdir -p "${DATA_DIR}" 24 24 - 25 25 - cat > "${ENV_FILE}" <<EOF 26 26 - PDS_HOSTNAME=localhost 27 27 - PDS_JWT_SECRET=${JWT_SECRET} 28 28 - PDS_ADMIN_PASSWORD=${ADMIN_PASSWORD} 29 29 - PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=${ROTATION_KEY} 30 30 - PDS_DATA_DIRECTORY=${DATA_DIR} 31 31 - PDS_BLOBSTORE_DISK_LOCATION=${DATA_DIR}/blocks 32 32 - PDS_DID_PLC_URL=https://plc.directory 33 33 - PDS_BSKY_APP_VIEW_URL=https://api.bsky.app 34 34 - PDS_MOD_SERVICE_URL=https://mod.bsky.app 35 35 - PDS_REPORT_SERVICE_URL=https://mod.bsky.app 36 36 - PDS_CRAWLERS=https://bsky.network 37 37 - PDS_SERVICE_HANDLE_DOMAINS=.localhost 38 38 - PDS_DEV_MODE=true 39 39 - PDS_INVITE_REQUIRED=false 40 40 - PDS_PORT=3000 41 41 - LOG_LEVEL=info 42 42 - EOF 43 43 - 44 44 - echo "pds.env written." 45 45 - echo "" 46 46 - echo "Admin password: ${ADMIN_PASSWORD}" 47 47 - echo "Save this somewhere — you'll need it for admin operations."

-68

scripts/nixtests/start.sh

reviewed

··· 1 1 - #!/usr/bin/env bash 2 2 - # Starts the PDS via the nix-provided `pds` binary. 3 3 - set -euo pipefail 4 4 - 5 5 - SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" 6 6 - DATA_DIR="${SCRIPT_DIR}/pds-data" 7 7 - PID_FILE="${DATA_DIR}/pds.pid" 8 8 - LOG_FILE="${DATA_DIR}/pds.log" 9 9 - ENV_FILE="${SCRIPT_DIR}/pds.env" 10 10 - 11 11 - # run setup if pds.env doesn't exist yet 12 12 - if [ ! -f "${ENV_FILE}" ]; then 13 13 - echo "No pds.env found, running setup.sh first..." 14 14 - bash "${SCRIPT_DIR}/setup.sh" 15 15 - fi 16 16 - 17 17 - # check for already-running process 18 18 - if [ -f "${PID_FILE}" ]; then 19 19 - OLD_PID=$(cat "${PID_FILE}") 20 20 - if kill -0 "${OLD_PID}" 2>/dev/null; then 21 21 - echo "PDS is already running (PID ${OLD_PID})." 22 22 - exit 0 23 23 - else 24 24 - echo "Stale PID file found, cleaning up." 25 25 - rm -f "${PID_FILE}" 26 26 - fi 27 27 - fi 28 28 - 29 29 - mkdir -p "${DATA_DIR}" 30 30 - 31 31 - # export env vars from pds.env 32 32 - set -a 33 33 - source "${ENV_FILE}" 34 34 - set +a 35 35 - 36 36 - echo "Starting PDS..." 37 37 - 38 38 - # start pds in background 39 39 - pds > "${LOG_FILE}" 2>&1 & 40 40 - PDS_PID=$! 41 41 - echo "${PDS_PID}" > "${PID_FILE}" 42 42 - 43 43 - echo "PDS started (PID ${PDS_PID}), waiting for health check..." 44 44 - 45 45 - # health-check loop: 30s timeout 46 46 - TIMEOUT=30 47 47 - ELAPSED=0 48 48 - while [ "${ELAPSED}" -lt "${TIMEOUT}" ]; do 49 49 - # make sure the process is still alive 50 50 - if ! kill -0 "${PDS_PID}" 2>/dev/null; then 51 51 - echo "PDS process died. Last log lines:" 52 52 - tail -20 "${LOG_FILE}" 53 53 - rm -f "${PID_FILE}" 54 54 - exit 1 55 55 - fi 56 56 - 57 57 - if curl -sf "http://localhost:${PDS_PORT:-3000}/xrpc/_health" > /dev/null 2>&1; then 58 58 - echo "PDS is healthy (http://localhost:${PDS_PORT:-3000})." 59 59 - exit 0 60 60 - fi 61 61 - 62 62 - sleep 1 63 63 - ELAPSED=$((ELAPSED + 1)) 64 64 - done 65 65 - 66 66 - echo "Health check timed out after ${TIMEOUT}s. Last log lines:" 67 67 - tail -20 "${LOG_FILE}" 68 68 - exit 1

-41

scripts/nixtests/stop.sh

reviewed

··· 1 1 - #!/usr/bin/env bash 2 2 - # Stops the PDS via PID file. 3 3 - set -euo pipefail 4 4 - 5 5 - SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" 6 6 - PID_FILE="${SCRIPT_DIR}/pds-data/pds.pid" 7 7 - 8 8 - if [ ! -f "${PID_FILE}" ]; then 9 9 - echo "No PID file found — PDS is not running." 10 10 - exit 0 11 11 - fi 12 12 - 13 13 - PDS_PID=$(cat "${PID_FILE}") 14 14 - 15 15 - if ! kill -0 "${PDS_PID}" 2>/dev/null; then 16 16 - echo "Process ${PDS_PID} is not running. Cleaning up stale PID file." 17 17 - rm -f "${PID_FILE}" 18 18 - exit 0 19 19 - fi 20 20 - 21 21 - echo "Stopping PDS (PID ${PDS_PID})..." 22 22 - kill "${PDS_PID}" 23 23 - 24 24 - # wait up to 10s for graceful shutdown 25 25 - TIMEOUT=10 26 26 - ELAPSED=0 27 27 - while [ "${ELAPSED}" -lt "${TIMEOUT}" ]; do 28 28 - if ! kill -0 "${PDS_PID}" 2>/dev/null; then 29 29 - echo "PDS stopped." 30 30 - rm -f "${PID_FILE}" 31 31 - exit 0 32 32 - fi 33 33 - sleep 1 34 34 - ELAPSED=$((ELAPSED + 1)) 35 35 - done 36 36 - 37 37 - # force kill 38 38 - echo "Graceful shutdown timed out, sending SIGKILL..." 39 39 - kill -9 "${PDS_PID}" 2>/dev/null || true 40 40 - rm -f "${PID_FILE}" 41 41 - echo "PDS killed."