flagon-io/g1t

Part of #237.

A full clone of flagon-io/g1t from g1t.sh is 134 MB and takes 38 s. From GitHub it is 34 MB and 3 s, for the same objects. g1t relays Cloudflare Artifacts' packs byte for byte, they are barely deltified, and Artifacts gives us no setting to change that. This serves reads with git's own upload-pack from a well-packed mirror. On the first sync of this repository the mirror ends as one 22 MB pack with a bitmap.

How it fits together

• MODE=gitedge in the runner binary (crates/runner/src/gitedge.rs): a small HTTP server (tiny_http, MIT/Apache, pure Rust).
  • POST /sync fetches from Artifacts into a bare mirror. The token goes through git's environment config and never appears in argv or logs. The fetch is --atomic.
  • After the first fetch it runs repack -adf --write-bitmap-index; after later fetches it repacks when there are more than 8 packs.
  • It serves info/refs and git-upload-pack through git http-backend, only for the exact refs version it is asked about (x-g1t-edge-version), and answers 409 x-g1t-edge: behind otherwise, including while a sync is changing refs. receive-pack is refused with 403.
• GitEdge container class (services/runner): one container per repository, the same image, standard-2, sleepAfter 30 minutes.
  • A cold container answers 503 x-g1t-edge: cold at once and starts in the background.
  • It registers no outbound handlers, so its fetches go straight to Artifacts.
  • The abuse watch is off, since it runs no one's code.
• Routing in the repos service (services/repos/src/git_edge.rs): for the repositories GIT_EDGE names (only flagon-io/g1t to start), upload-pack reads go to the edge after authorization, limits and a clone-cache miss.
  • Anything but a 200 goes to Artifacts exactly as before, and the edge is told to sync. It is also told after every push.
  • Edge answers get the same HEAD and negotiation handling as Artifacts' answers, are filled into the clone cache, and are not metered as store operations.

Artifacts stays the source of truth: pushes are untouched, and the edge never answers for refs older than g1t has recorded.

Tests

• cargo test -p g1t-runner --test gitedge: real git against the server.
  • Clones over protocol v2 and v0 are equal to the source, with fsck; --depth 1 and --filter=blob:none work.
  • An incremental fetch after a second sync sends haves.
  • Wrong or missing versions get 409; receive-pack gets 403.
  • A failed sync keeps serving; syncs queue latest-wins; the token never appears in the output.
  • Passes on Windows and in a Linux container.
• services/runner: npm test 102 pass (10 new), and the typecheck is clean.
• cargo test -p g1t-repos: 373 pass.
• npm run test:deploy: 101 pass; manifest --check is consistent.

Known limits (follow-ups on #237)

• A container that sleeps loses its disk, so its next start re-clones from Artifacts in the background (about 17 s locally for this repository), with reads falling back meanwhile. Keeping the mirror in R2 would make cold starts a download.
• The first sync after a push takes seconds, so a clone that comes right behind it falls back.

Deploy order doesn't matter: without the runner's route, the repos service just falls back.

Dependency review

Passed. 4 dependency changes, none vulnerable.

Cargo.lock

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.