admin
52619e89bd
gates / gates (push) Successful in 47s
Debian 13 ships restic 0.18.0; the off-site engine's measured behaviour is 0.14.0's. The binary stays on Go 1.27.2; the runtime moves to the current Debian 12 point release, pinned by digest. Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
111 lines
4.6 KiB
Docker
111 lines
4.6 KiB
Docker
# =============================================================================
|
|
# felhom-controller Dockerfile
|
|
# Multi-stage build: Go binary + minimal runtime
|
|
# Supports amd64 (N100 mini PCs) and arm64 (Raspberry Pi)
|
|
# =============================================================================
|
|
|
|
# --- Build stage ---
|
|
# R-972 (v0.322.0): a supported, patched Go, pinned by version AND digest (no moving tag). Go 1.24 had no security fixes
|
|
# left (go.dev/doc/devel/release#policy). The builder's Debian does not reach the runtime (a static CGO-free binary).
|
|
FROM golang:1.27.2-trixie@sha256:47667934874913a449b96faa7ef4777fa285d9ec29126ee80ed61c45b7cccf0e AS builder
|
|
|
|
ARG TARGETOS=linux
|
|
ARG TARGETARCH
|
|
|
|
WORKDIR /build
|
|
|
|
# Cache dependencies first
|
|
COPY go.mod ./
|
|
RUN go mod download || true
|
|
|
|
# Copy source
|
|
COPY . .
|
|
|
|
# Generate go.sum and ensure all deps are fetched
|
|
RUN go mod tidy
|
|
|
|
# R-208: the per-build values are declared HERE, just above the only step that reads them. A RUN's
|
|
# cache key includes the stage's ARG environment, so declared above `go mod download` a fresh VERSION
|
|
# re-ran the module download on every build (208 cache records, each used once, ~440 MB apiece).
|
|
# Pinned by TestR208_DockerfileVersionArgsSitBelowModuleDownload.
|
|
ARG VERSION=dev
|
|
ARG GIT_COMMIT=unknown
|
|
|
|
# Build static binary
|
|
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
|
|
-ldflags="-s -w \
|
|
-X main.Version=${VERSION} \
|
|
-X main.BuildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
|
|
-X main.GitCommit=${GIT_COMMIT}" \
|
|
-o /build/felhom-controller \
|
|
./cmd/controller/
|
|
|
|
# --- Runtime stage ---
|
|
# The runtime stays on Debian 12 (its current point release, 12.13, with every fixed package) ON PURPOSE: Debian 13
|
|
# ships restic 0.18.0, and the off-site engine's measured behaviour is restic 0.14.0's (a missing source path is a
|
|
# warning, the --json progress shape, the forget day-buckets, restore without a lock — offbox_*.go). Moving to
|
|
# Debian 13 is its own change with that re-proof (R-1105). The binary itself is built on Go 1.27.2 above.
|
|
FROM debian:12.13-slim@sha256:67b30a61dc87758f0caf819646104f29ecbda97d920aaf5edc834128ac8493d3
|
|
|
|
# Install runtime dependencies:
|
|
# - docker-cli: for "docker compose" commands
|
|
# - ca-certificates: for HTTPS (healthchecks pings, git)
|
|
# - postgresql-client: for pg_dump
|
|
# - default-mysql-client: for mysqldump
|
|
# - sqlite3: for SQLite backup
|
|
# - git: for stack sync from Gitea
|
|
# - curl: for health pings and debugging
|
|
# - util-linux: lsblk, blkid, mount (storage init)
|
|
# - fdisk: sfdisk (partition table writing — separate from util-linux on Debian)
|
|
# - e2fsprogs: mkfs.ext4 (filesystem formatting)
|
|
# - rsync: for data migration between storage paths
|
|
# - parted: partprobe (partition table re-read after sfdisk)
|
|
# - restic: encrypted off-box (NAS) backup over SFTP (Part B; version pinned by the Debian release)
|
|
# - openssh-client: restic's sftp backend shells out to `ssh` (the SFTP transport); also ssh-copy-id/sftp
|
|
# for the SLICE-2 offsite apply-bridge key install
|
|
# - sshpass: feeds the one-time storage-box password to ssh-copy-id -s -f (offsite apply-bridge)
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
gnupg \
|
|
git \
|
|
postgresql-client \
|
|
default-mysql-client \
|
|
sqlite3 \
|
|
util-linux \
|
|
fdisk \
|
|
e2fsprogs \
|
|
rsync \
|
|
parted \
|
|
restic \
|
|
openssh-client \
|
|
sshpass \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install docker-cli (without daemon)
|
|
RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker.gpg \
|
|
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.gpg] \
|
|
https://download.docker.com/linux/debian bookworm stable" > /etc/apt/sources.list.d/docker.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends docker-ce-cli docker-compose-plugin \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Create non-root user (but we'll run as root for Docker socket access)
|
|
# The Docker socket requires root or docker group membership
|
|
RUN mkdir -p /opt/docker/felhom-controller/data
|
|
|
|
COPY --from=builder /build/felhom-controller /usr/local/bin/felhom-controller
|
|
|
|
# Copy baked-in app assets (logos, screenshots)
|
|
# These are synced from the felhom.eu website repo before building.
|
|
# See: make sync-assets
|
|
COPY assets/ /usr/share/felhom/assets/
|
|
|
|
# Health check
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -f http://localhost:8080/api/health || exit 1
|
|
|
|
EXPOSE 8080
|
|
|
|
ENTRYPOINT ["/usr/local/bin/felhom-controller"]
|
|
CMD ["--config", "/opt/docker/felhom-controller/controller.yaml"] |