feat: edgenode-flower — Holochain + Flower SuperNode variant

docker/Dockerfile.flower

@@ -0,0 +1,132 @@
+# syntax=docker/dockerfile:1
+# Dockerfile for the edge node flower variant.
+# Bundles Holochain conductor with Flower SuperNode and a conductor API bridge
+# for federated learning audit, governance, and coordination via the FL hApp.
+#
+# Deployment modes (FLOWER_DEPLOYMENT_MODE env var):
+#   overlay       - Flower SuperNode connects to an existing SuperLink; bridge
+#                   records a tamper-evident audit trail in the Holochain DHT only.
+#   augmented     - SuperLink still aggregates; bridge checks governance
+#                   ratification before relaying strategy changes.
+#   decentralized - No external SuperLink; full round coordination via Holochain.
+
+FROM cgr.dev/chainguard/wolfi-base
+
+VOLUME ["/data"]
+
+RUN apk update && apk upgrade && apk add --no-cache \
+    bash curl wget htop jq strace tcpdump coreutils \
+    logrotate shadow gosu uuidgen xz libstdc++ \
+    python3 py3-pip
+
+ARG TARGETARCH
+ARG S6_OVERLAY_VERSION=3.2.0.2
+
+RUN case "${TARGETARCH}" in \
+    amd64) S6_ARCH="x86_64" ;; \
+    arm64) S6_ARCH="aarch64" ;; \
+    *) echo "Unsupported architecture: ${TARGETARCH}" && exit 1 ;; \
+    esac && \
+    wget https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz && \
+    wget https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_ARCH}.tar.xz && \
+    tar -C / -Jxpf s6-overlay-noarch.tar.xz && \
+    tar -C / -Jxpf s6-overlay-${S6_ARCH}.tar.xz && \
+    rm -f s6-overlay-*.tar.xz
+
+ARG HOLOCHAIN_VERSION=0.6.1-rc.7
+ARG HC_VERSION=0.6.1-rc.7
+
+RUN case "${TARGETARCH}" in \
+    amd64) HC_ARCH="x86_64-unknown-linux-gnu" ;; \
+    arm64) HC_ARCH="aarch64-unknown-linux-gnu" ;; \
+    *) echo "Unsupported architecture: ${TARGETARCH}" && exit 1 ;; \
+    esac && \
+    wget https://github.com/holochain/holochain/releases/download/holochain-${HOLOCHAIN_VERSION}/holochain-${HC_ARCH} && \
+    wget https://github.com/holochain/holochain/releases/download/holochain-${HC_VERSION}/hc-${HC_ARCH} && \
+    mv holochain-${HC_ARCH} /bin/holochain && \
+    mv hc-${HC_ARCH} /bin/hc && \
+    chmod +x /bin/holochain && \
+    chmod +x /bin/hc
+
+# Install Flower and bridge dependencies
+COPY fl-bridge/requirements.txt /app/requirements.txt
+RUN pip install --no-cache-dir -r /app/requirements.txt
+
+COPY fl-bridge/bridge.py /app/bridge.py
+RUN chmod +x /app/bridge.py
+
+COPY happ_tool /usr/local/bin/happ_tool
+RUN chmod +x /usr/local/bin/happ_tool
+RUN ln -sf /usr/local/bin/happ_tool /usr/local/bin/install_happ && \
+    ln -sf /usr/local/bin/happ_tool /usr/local/bin/uninstall_happ && \
+    ln -sf /usr/local/bin/happ_tool /usr/local/bin/enable_happ && \
+    ln -sf /usr/local/bin/happ_tool /usr/local/bin/disable_happ && \
+    ln -sf /usr/local/bin/happ_tool /usr/local/bin/list_happs && \
+    chmod +x /usr/local/bin/install_happ /usr/local/bin/list_happs \
+              /usr/local/bin/uninstall_happ /usr/local/bin/enable_happ \
+              /usr/local/bin/disable_happ
+
+ARG HAPP_CONFIG_FILE_VERSION=0.3.0
+
+RUN case "${TARGETARCH}" in \
+    amd64) HCF_ARCH="linux-x86_64" ;; \
+    arm64) HCF_ARCH="linux-aarch64" ;; \
+    *) echo "Unsupported architecture: ${TARGETARCH}" && exit 1 ;; \
+    esac && \
+    wget "https://github.com/Holo-Host/edgenode/releases/download/tools%2Fhapp_config_file-v${HAPP_CONFIG_FILE_VERSION}/happ_config_file-${HCF_ARCH}" && \
+    mv "happ_config_file-${HCF_ARCH}" /usr/local/bin/happ_config_file && \
+    chmod +x /usr/local/bin/happ_config_file
+
+RUN mkdir -p /usr/local/share/holochain
+COPY conductor-config-0.6.1.template.yaml /usr/local/share/holochain/conductor-config.template.yaml
+COPY logrotate.d/holochain.conf /etc/logrotate.d/holochain.conf
+COPY logrotate.d/flower.conf /etc/logrotate.d/flower.conf
+RUN chown -R nonroot:nonroot /usr/local/share/holochain
+
+COPY s6-overlay-flower/s6-rc.d/ /etc/s6-overlay/s6-rc.d/
+RUN chmod +x \
+    /etc/s6-overlay/s6-rc.d/setup/init.sh \
+    /etc/s6-overlay/s6-rc.d/conductor/run \
+    /etc/s6-overlay/s6-rc.d/fl-bridge/run \
+    /etc/s6-overlay/s6-rc.d/logrotate-cron/run
+
+# Holochain conductor ports
+ENV HC_ADMIN_PORT=4444
+ENV HC_APP_PORT=4445
+
+# Flower — SuperNode (participant role)
+ENV FLOWER_DEPLOYMENT_MODE=overlay
+# SUPERLINK_URL           - required in overlay/augmented mode, e.g. grpcs://host:9093
+# FLOWER_INSECURE         - set to "true" to skip TLS (development only)
+# FLOWER_ROOT_CERT        - path to root CA certificate for TLS
+
+# Flower — SuperLink (designated aggregator role, Mode C only)
+ENV FLOWER_SUPERLINK_PORT=9093
+
+# Flower — ClientApp (user-provided training code)
+# FL_CLIENT_APP_MODULE    - Python module path, e.g. myapp:FlowerClient
+#                           passed as --clientapp to flwr supernode
+# FL_CLIENT_APP_URL       - pip-installable URL/package; installed at startup
+#                           before the SuperNode is launched
+
+# Machine-level identity (one edgenode per participating machine)
+# FL_MACHINE_NAME         - human-readable name for this machine, e.g. "MRI-Scanner-Ward-3"
+
+# Org-level identity (governance principal; one vote per org regardless of machine count)
+# FL_ORG_NAME             - organisation name for participant registry
+# FL_JURISDICTION         - jurisdiction tag, e.g. "EU", "US"
+
+# pollen hApp
+ENV FL_APP_ID=fl-happ
+ENV HC_NETWORK_SEED=fl-network
+# FL_HAPP_URL             - URL to download the pollen hApp .happ file at startup
+# FL_HAPP_PATH            - path to a baked-in .happ file (alternative to URL)
+
+SHELL ["/bin/sh", "-c"]
+# 4444 - Holochain conductor admin WebSocket
+# 4445 - Holochain conductor app WebSocket
+# 9091 - Flower SuperNode gRPC (connects to SuperLink)
+# 9093 - Flower SuperLink gRPC (aggregator role, Mode C only)
+EXPOSE 4444 4445 9091 9093
+
+ENTRYPOINT ["/init"]