UCash container images

Build and publish the Spark payment processor and the operator with opt-in persistent processor storage. This repository has no cluster credentials or deployment steps. Publishing an image does not deploy it or prove a safe migration of an existing mint.

Image	Pinned source
git.cashu.dev/asmo/ucash-spark	cashubtc/cdk-payment-processors commit d7244e261506b51d5b309a558bf19cd4ffc32f13, Spark crate and its lockfile
git.cashu.dev/asmo/ucash-operator	asmo/cashu-operator v0.4.2 commit b9d6ac39362840cda88d3c12b5b1bd1dbb2fbe18, plus the included persistence patch

CI

Build and publish images runs when build files change on main, or by manual dispatch. Both jobs target linux/amd64. Spark runs its locked unit tests before the release build and an offline TLS startup rejection check. The operator runs targeted persistence and reconciliation tests before compiling. Build concurrency is limited for the existing Forgejo runners.

The repository requires a protected Actions secret REGISTRY_TOKEN, containing an asmo token with write:package scope. The token is used only in the publish step, passed through stdin to Docker, and temporary credential files are removed on exit. No PR-triggered publishing is configured.

Each successful job publishes sha-<full repository commit> and then verifies an anonymous pull and matching image content. The immutable registry digest is printed in the job log and summary. Use image@sha256:... in Kubernetes. Public images require no registry pull Secret. There is deliberately no latest tag.

Example after a successful run (replace the commit):

docker pull git.cashu.dev/asmo/ucash-spark:sha-<commit>
docker pull git.cashu.dev/asmo/ucash-operator:sha-<commit>

Verified first publication

Both jobs passed in run 1, attempt 2 for build commit 81eca9733aec09bd17a08ba0a673e9f94425b020. Tests, image pushes, anonymous pulls and image-content checks passed. Immutable pull references are recorded in the initial publication history. The operator was subsequently rebuilt on v0.4.2 in run 2 to retain existing initialization and FakeWallet safeguards. Its operator job passed tests, publication and anonymous pull verification. Current per-image build commits and digests are recorded in published-images.json. These are candidate images; no deployment was performed.

Runtime and migration

Spark uses SPARK_MNEMONIC, SPARK_NETWORK, SPARK_DATA_DIR, SERVER_ADDRESS and SERVER_PORT. Configure TLS, or explicitly opt into plaintext for same-pod loopback communication with ALLOW_INSECURE=true. Never put a seed or wallet state in a build context or CI.

The operator patch opts a mint into persistent processor storage using mint.cashu.asmogo.github.io/persist-processor-data: "true". It uses a PVC even with PostgreSQL, uses Recreate, and rejects multiple replicas. Preserve any existing emptyDir state before activating it. Retain the existing mint signing seed, Spark identity, PostgreSQL ledger and quote mappings. Do not run two wallet instances with the same seed. Mainnet payment recovery needs its own authorized maintenance and verification procedure.

Upstream projects retain their licenses. Build recipes, workflow and the operator patch are Apache-2.0; see LICENSE.