feat(den): self-host Linux tarball with installer, systemd units, and upgrade spec - #3499
feat(den): self-host Linux tarball with installer, systemd units, and upgrade spec#3499benjaminshafii wants to merge 5 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Photo roll — one-native-den-tarball-installs-starts-and-upgrades-without-losing-its-admin — 0/0 frames passed · 6 facts✅ 0/0 frames passed · 6 facts · 6 expectations passed · 0 failed ℹ️ FACT — 1. One platform tarball contains Den API, Den Web, and a bundled Node runtimeopenwork-den-darwin-arm64-0.18.13.tar.gz; openwork-den-0.18.13/bin/node, openwork-den-0.18.13/bin/openwork-den, openwork-den-0.18.13/services/den-api/dist/main.js, openwork-den-0.18.13/services/den-web/.next/BUILD_ID, openwork-den-0.18.13/install.sh
ℹ️ FACT — 2. The native install has no Docker dependency and uses a reachable network MySQL databaseMySQL reachable at 127.0.0.1:3306; install and launch scripts contain no Docker invocation
ℹ️ FACT — 3. install.sh creates the service account contract, config template, two services, and targetInstalled den.env and three units under the isolated prefix; units run as openwork-den
ℹ️ FACT — 4. openwork-den migrate prepares MySQL with the same Den DB bootstrap used by cloudMigration exited 0 and __drizzle_migrations exists in den_selfhost_51143_mseqi7d3_44760f0399f0
ℹ️ FACT — 5. Den API and Web start on configured ports with one private organization and its bootstrap adminAPI /health and Web /api/ready returned 2xx; admin endpoint returned 2xx; outsider signup returned 403
ℹ️ FACT — 6. Upgrade flips current, preserves den.env, migrates before restart, and keeps the existing admincurrent -> versions/0.18.13+1; config bytes and mtime preserved; same admin signed in; wrong password returned 401
Roll created 2026-08-04T14:09:21.333Z · Source: |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
2 participants
What
Community-supported (best effort) native Linux packaging for the self-hosted Den stack, first step for #2084: one downloadable tarball that installs den-api + den-web on a plain Linux box (target: Proxmox LXC, no Docker).
scripts/den/build-selfhost-bundle.mjs(+ root scriptden:selfhost:bundle): builds den-api, den-web, and den-db assets, does a productionpnpm deployper service (patches applied, sharp native install for the target host), bundles a Node 22 runtime (--node-source download|host), and emitsdist-selfhost/openwork-den-<platform>-<arch>-<version>.tar.gz.install.sh: versioned installs under<prefix>/versions/<v>with an atomiccurrentsymlink flip, preservesden.envon upgrade, installs systemd units (--no-systemd/--no-user/--prefix/--config-dir/--systemd-dirfor non-root or test installs), creates theopenwork-densystem user.bin/openwork-den:migrate | start-api | start-weblauncher; migrate runs the same den-dbbootstrap.jsthe Helm migration job uses.openwork-den-api.service(ExecStartPre runs migrate, so migrations always run before start),openwork-den-web.service(After/Wants api),openwork-den.target.den-selfhost-bundlejob inpublish-ee-images.ymlbuilds linux-x64 and uploads the artifact; onv*tags it attaches the tarball to the GitHub release. x64-only for now: sharp needs a native build host and no arm64 runner is used in this repo yet.Validation
Spec:
evals/specs/den-selfhost-tarball.slow.test.ts(testkit, gated onOPENWORK_EVAL_APP_SPECS=1+ local MySQL) encodes the approved demo narration frame by frame: tarball contents incl. bundled node, no-Docker install, installer contract (config template, two services + target, service user),openwork-den migrateagainst an ephemeral MySQL db (__drizzle_migrationswitness), both services healthy on configured ports, bootstrap admin sign-in on a single private org with outsider signup rejected (403), then an upgrade that flipscurrent, preservesden.envbyte-for-byte, re-migrates idempotently, keeps the same admin working, and rejects a wrong password.Commands run (both green, second run on the PR head SHA):
OPENWORK_EVAL_APP_SPECS=1 pnpm --dir evals exec vitest run --config vitest.config.ts den-selfhost-tarball→ 1 passed (366s, and 368s rerun at a207591)node scripts/den/build-selfhost-bundle.mjs --node-source host→ producedopenwork-den-darwin-arm64-0.18.13.tar.gzpnpm evals:typecheck→ cleanEvidence tape published in the sticky PR comment. The CI job itself is config-only and not runtime-proven here.
Notes
packages/types/tsup.config.ts: added existing-source entry points (workspace, desktop-ipc, connect-link, url) because the deployed production bundle resolves built JS instead of workspace TS sources.your-connections-screen.tsx: pre-existing den-web typecheck error (React.Refwithout a React import), fixed minimally because the den-web typecheck is part of this change's verification.