172 lines
9.7 KiB
Docker
172 lines
9.7 KiB
Docker
# Theta42 Proxy — All-in-One Dockerfile
|
|
# OpenResty (front) + Node management app + Redis in a single container, mirroring
|
|
# the bare-metal ops/install.sh layout. Intended for self-contained single-node
|
|
# deployments (home labs / small businesses). Each process is supervised by
|
|
# dumb-init (PID 1); redis + the node app run in the background and OpenResty
|
|
# runs in the foreground as the primary process.
|
|
#
|
|
# Base image: the official openresty/openresty "-fat" variant bundles luarocks
|
|
# preconfigured for OpenResty's luajit, so `luarocks install` places rocks into
|
|
# /usr/local/openresty/lualib (which is on OpenResty's package.path) — no manual
|
|
# --lua-dir/--tree wrangling needed.
|
|
|
|
# ── Git commit hash (build-time only) ────────────────────────────────────────
|
|
# The final image intentionally has no git binary and no .git directory (kept
|
|
# lean, per .dockerignore), so `git rev-parse` always fails at runtime and
|
|
# build_info.js silently fell back to "unknown". Resolve it here instead,
|
|
# where .git IS available (build context), and bake just the short hash into
|
|
# a file — this stage itself is discarded, only /commit.txt survives via the
|
|
# COPY --from below. Reuses the main base image (already pulled for the real
|
|
# build below) rather than a separate one, so this adds no extra image pull.
|
|
#
|
|
# GIT_COMMIT lets a caller override the resolved hash instead of computing it
|
|
# from .git in this build context. Needed when this repo is built as a git
|
|
# submodule (e.g. from theta-env): a submodule's .git is a pointer FILE, not
|
|
# a directory — the real object database lives in the superproject's
|
|
# .git/modules/, outside this repo's own directory and therefore outside
|
|
# Docker's build context entirely, so `git rev-parse` can never resolve it
|
|
# from in here no matter what. theta-env's setup.sh passes
|
|
# --build-arg GIT_COMMIT=$(git -C proxy rev-parse --short HEAD), computed on
|
|
# the host where the submodule resolves correctly.
|
|
ARG GIT_COMMIT=""
|
|
FROM openresty/openresty:1.31.1.1-2-bookworm-fat AS gitinfo
|
|
ARG GIT_COMMIT
|
|
WORKDIR /repo
|
|
COPY .git ./.git
|
|
RUN if [ -n "$GIT_COMMIT" ]; then \
|
|
echo "$GIT_COMMIT" > /commit.txt; \
|
|
else \
|
|
{ apt-get update && apt-get install -y --no-install-recommends git \
|
|
&& git rev-parse --short HEAD > /commit.txt; } 2>/dev/null || echo unknown > /commit.txt; \
|
|
fi
|
|
|
|
FROM openresty/openresty:1.31.1.1-2-bookworm-fat
|
|
|
|
# ── Tooling needed before adding apt repos ──────────────────────────────────
|
|
# The -fat base image lacks gnupg, which the NodeSource keyring setup needs.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl gnupg ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# ── Node.js 22.x (NodeSource) ────────────────────────────────────────────────
|
|
# The management app + its native deps (bcrypt) need Node. Matches
|
|
# ops/install.sh NODE_MAJOR=22.
|
|
RUN install -d -m 0755 /etc/apt/keyrings \
|
|
&& curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
|
|
| gpg --dearmor --yes -o /etc/apt/keyrings/nodesource.gpg \
|
|
&& echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" \
|
|
> /etc/apt/sources.list.d/nodesource.list
|
|
|
|
# ── System packages ──────────────────────────────────────────────────────────
|
|
# build-essential g++ make python3 : native addon build for bcrypt
|
|
# libpam0g-dev : native build for linux-sys-user
|
|
# redis-server : bundled Redis (the app + lua-resty-auto-ssl
|
|
# + targetinfo.lua all reach 127.0.0.1:6379)
|
|
# dumb-init : PID 1 zombie reaping + signal forwarding
|
|
# openssl lsb-release wget : tooling
|
|
# nodejs : Node 22.x runtime
|
|
# luarocks ships in the -fat base image (configured for OpenResty's luajit).
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
build-essential g++ make python3 \
|
|
libpam0g-dev \
|
|
redis-server \
|
|
dumb-init \
|
|
openssl lsb-release wget \
|
|
nodejs \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# ── Lua modules ──────────────────────────────────────────────────────────────
|
|
# lua-resty-auto-ssl : Let's Encrypt automation (certs stored in the bundled redis)
|
|
# luasocket : socket helpers used by auto-ssl
|
|
# lua-resty-ipmatcher: CIDR matching for per-host IP allow/deny (hostfeatures.lua)
|
|
# resty.limit.req is bundled with OpenResty, so no rock is needed for it.
|
|
RUN luarocks install lua-resty-auto-ssl \
|
|
&& luarocks install luasocket \
|
|
&& luarocks install lua-resty-ipmatcher
|
|
|
|
# ── Node app ─────────────────────────────────────────────────────────────────
|
|
WORKDIR /app
|
|
|
|
# Install production deps first (layer cache: only rebuilds when package*.json
|
|
# changes). .dockerignore excludes nodejs/node_modules.
|
|
COPY nodejs/package*.json ./
|
|
RUN npm ci --omit=dev
|
|
|
|
# App source (mirror sso-manager's layout — flattened into /app).
|
|
COPY nodejs/app.js ./
|
|
COPY nodejs/bin ./bin
|
|
COPY nodejs/conf ./conf
|
|
COPY nodejs/controller ./controller
|
|
COPY nodejs/middleware ./middleware
|
|
COPY nodejs/migrations ./migrations
|
|
COPY nodejs/models ./models
|
|
COPY nodejs/routes ./routes
|
|
COPY nodejs/services ./services
|
|
COPY nodejs/utils ./utils
|
|
COPY nodejs/views ./views
|
|
COPY nodejs/public ./public
|
|
COPY nodejs/api.md ./api.md
|
|
|
|
# Documentation, served in-app at /docs (routes/docs.js) so it's readable
|
|
# without internet access. README.md/DEPLOYMENT.md land one level above the
|
|
# flattened /app (mirrors sso-manager-node's tos.md -> /tos.md convention);
|
|
# docs/ mirrors the repo's own top-level docs/ folder.
|
|
COPY README.md /README.md
|
|
COPY DEPLOYMENT.md /DEPLOYMENT.md
|
|
COPY docs /docs
|
|
|
|
# Baked commit hash from the gitinfo stage (see build_info.js).
|
|
COPY --from=gitinfo /commit.txt ./.build_commit
|
|
|
|
# ── OpenResty config (mirrors ops/install.sh symlink targets) ─────────────────
|
|
# The default OpenResty config lives at /usr/local/openresty/nginx/conf/nginx.conf
|
|
# (the prefix conf dir); relative `include` directives resolve there. We place:
|
|
# nginx.conf -> prefix conf dir (overwrites the stock config)
|
|
# autossl.conf -> prefix conf dir (included by proxy.conf)
|
|
# proxy.conf -> prefix conf dir/sites-enabled/000-proxy (included by nginx.conf)
|
|
# *.lua -> /usr/local/openresty/lualib (on OpenResty's package.path)
|
|
# The entrypoint sed-substitutes the env-specific real_ip/resolver values into
|
|
# the copied files at runtime, so the committed confs (which carry the bare-metal
|
|
# home-LAN values) are left untouched for bare-metal use.
|
|
RUN install -d /usr/local/openresty/nginx/conf/sites-enabled
|
|
COPY ops/nginx_conf/nginx.conf /usr/local/openresty/nginx/conf/nginx.conf
|
|
COPY ops/nginx_conf/autossl.conf /usr/local/openresty/nginx/conf/autossl.conf
|
|
COPY ops/nginx_conf/proxy.conf /usr/local/openresty/nginx/conf/sites-enabled/000-proxy
|
|
COPY ops/nginx_conf/targetinfo.lua /usr/local/openresty/lualib/targetinfo.lua
|
|
COPY ops/nginx_conf/hostfeatures.lua /usr/local/openresty/lualib/hostfeatures.lua
|
|
|
|
# ── Runtime dirs ─────────────────────────────────────────────────────────────
|
|
# nginx.conf writes access/error logs to /var/log/nginx and uses a response
|
|
# cache at /var/cache/nginx/proxy. OpenResty workers run as `nobody` (the
|
|
# compiled-in default — nginx.conf leaves `user` commented), so the cache dir
|
|
# must be owned by nobody:nogroup for proxy_cache_path to write to it. The node
|
|
# app creates /var/run/proxy_lookup.socket and chmods it 777 so the nobody
|
|
# workers can connect (see utils/unix_socket_json.js).
|
|
RUN install -d -m 0755 -o nobody -g nogroup /var/cache/nginx/proxy \
|
|
&& install -d /var/log/nginx /var/run /etc/ssl
|
|
|
|
# ── Entrypoint ───────────────────────────────────────────────────────────────
|
|
COPY docker-entrypoint.sh /usr/local/bin/
|
|
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
|
|
|
# 80/443/4443 : public proxy listeners (autossl.conf)
|
|
# 3000 : node management API + web UI (internal; the OpenResty front
|
|
# proxies /api/* and the UI. Expose it for first-run access /
|
|
# healthcheck — bind to localhost only in production via compose.)
|
|
EXPOSE 80 443 4443 3000
|
|
|
|
# Healthcheck: the node app's /health (added in routes/render.js). Confirms the
|
|
# management process is up and routing; OpenResty liveness is implied because it
|
|
# proxies /api/auth -> the node app.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
|
|
CMD curl -fsS http://localhost:3000/health || exit 1
|
|
|
|
# dumb-init reaps zombies and forwards SIGTERM to the OpenResty process the
|
|
# entrypoint execs into, so `docker stop` shuts down cleanly instead of hitting
|
|
# the 10s kill timeout.
|
|
ENTRYPOINT ["dumb-init", "/usr/local/bin/docker-entrypoint.sh"]
|
|
|
|
# The entrypoint starts redis + the node app in the background, then execs
|
|
# `openresty -g 'daemon off;'` in the foreground as the primary process.
|
|
CMD ["openresty", "-g", "daemon off;"] |