wtclaude
f2e59a2426
All checks were successful
PR checks / checks (pull_request) Successful in 9m46s
PLAN.md §13 phase 12, the last one. Four decisions of record, D54–D57, taking the count to fifty-seven; recorded in §6, "How phase 12 delivered it". A two-stage Dockerfile, a pull-only docker-compose.yml carrying both bind mounts, .env.example, the workflow that publishes and deploys, CONTRIBUTING.md, the community-health files this was the only repository of the ten to lack, and DEPLOY.md. D54 — a merge deploys, amending D6. build-image.yml pushes runicgateway-site:latest and :sha-<7>, then rolls the container over on the `rgcom` runner out of /opt/runicgateway.com, and waits for the container's own healthcheck rather than for `up -d` to return. D55 — the site runs on its own host behind a generic reverse proxy, so DEPLOY.md states the four requirements rather than one worked example, and the container binds 127.0.0.1 so the safe configuration is the default. D56 — @astrojs/node derives the request protocol from req.socket.encrypted and never reads x-forwarded-proto, so behind a TLS-terminating proxy the browser sends Origin: https://… while the container computes http://… and Astro's CSRF check compares them for equality. Every beta signup, from every visitor, was answered 403. serve.mjs now normalises both forwarded headers, unconditionally — the image should deploy and work. Two assertions in test/headers.test.mjs hold both halves. D57 — DEPLOY.md rather than a README section; SECURITY.md and CODE_OF_CONDUCT.md are pointers to the org's copies rather than copies, because a copy would hard-code the contact address D13 confines to brand.json. Verified: npm run verify green (eleven checks, 36 unit tests, 7 served tests, astro check 0 errors). The image was built and run with both mounts — a mounted brand reached 51 files and all 50 search pages, /brand/* fell back per file, a proxy-shaped signup reached the store, and the export CLI wrote both Play files to the host mount. docker compose config caught a YAML trap in the healthcheck: a block sequence reads the `: ` in `r.ok ? 0 : 1` as a mapping. Co-Authored-By: Claude <noreply@anthropic.com>
103 lines
5.0 KiB
Docker
103 lines
5.0 KiB
Docker
# runicgateway.com — the one container (PLAN.md §6).
|
|
#
|
|
# Two stages. The first has the whole toolchain and produces `dist/`; the second
|
|
# carries the built site, the pruned runtime dependencies and nothing else.
|
|
#
|
|
# Debian slim rather than Alpine, deliberately. Two of the runtime dependencies
|
|
# are native — `better-sqlite3` (the beta store, §8) and `sharp` (the brand
|
|
# derivations, §7) — and both publish prebuilt binaries for glibc. On musl they
|
|
# are compiled from source instead, which means a C++ toolchain, libvips headers
|
|
# and several minutes in the image build, to save about sixty megabytes on a
|
|
# thing that is pulled a few times a year. A third, `pagefind`, ships a platform
|
|
# binary and is needed at RUN time, not just build time: the boot rewrite
|
|
# re-indexes the site after the brand strings change.
|
|
|
|
# ---------------------------------------------------------------------------------------
|
|
# Stage 1 — build
|
|
# ---------------------------------------------------------------------------------------
|
|
FROM node:22-bookworm-slim AS build
|
|
|
|
WORKDIR /build
|
|
|
|
# Dependencies first, so an edit to a page does not re-resolve the tree.
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci
|
|
|
|
# Then the source. .dockerignore keeps node_modules, dist and BOTH bind mounts out.
|
|
COPY . .
|
|
|
|
# Prerenders every marketing, legal and documentation page, builds the Node
|
|
# server entry for the two routes that run per request, and writes the per-route
|
|
# Content-Security-Policy into dist/_headers.json (D48).
|
|
#
|
|
# No token and no network: everything the build reads is in this context. The
|
|
# checks that DO need the Gitea API — facts, quickstart, reference — run in CI
|
|
# against the pull request, which is the right place for them. An image build
|
|
# that could fail because another repository's server was slow would be an image
|
|
# build people learn to retry rather than read.
|
|
RUN npm run build
|
|
|
|
# Drop the devDependencies from the tree the runtime stage inherits. Pruning
|
|
# here rather than running a second `npm ci --omit=dev` below keeps the native
|
|
# modules exactly as they were resolved and built once.
|
|
RUN npm prune --omit=dev
|
|
|
|
# ---------------------------------------------------------------------------------------
|
|
# Stage 2 — runtime
|
|
# ---------------------------------------------------------------------------------------
|
|
FROM node:22-bookworm-slim AS runtime
|
|
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production \
|
|
HOST=0.0.0.0 \
|
|
PORT=4321
|
|
|
|
# Both bind mounts, named here so the code's own `process.cwd()` defaults are
|
|
# never what a container relies on. See docker-compose.yml.
|
|
ENV BRAND_DIR=/app/brand \
|
|
DATA_DIR=/app/data
|
|
|
|
# The stock brand, baked in and always complete (§7). Every /brand/* URL resolves
|
|
# against the mount first and this second, per file.
|
|
ENV BRAND_DEFAULT_DIR=/app/brand-default
|
|
|
|
# `dist/` is owned by `node` because the boot rewrite WRITES to it: applyBrand.mjs
|
|
# rewrites the prerendered HTML from what it last applied to what the mount now
|
|
# says, records that in dist/.brand-applied.json, and re-indexes dist/client/pagefind
|
|
# so search finds the mounted site name. A read-only dist would make §7's promise
|
|
# — recolour and rename by copying a file — fail at boot with a permission error.
|
|
COPY --from=build --chown=node:node /build/node_modules ./node_modules
|
|
COPY --from=build --chown=node:node /build/dist ./dist
|
|
COPY --from=build --chown=node:node /build/brand-default ./brand-default
|
|
COPY --from=build --chown=node:node /build/scripts ./scripts
|
|
COPY --from=build --chown=node:node /build/package.json ./package.json
|
|
|
|
# `src/` is here for one reason: the tester-list CLI. §8 has no admin page by
|
|
# design, so managing the closed beta is `docker compose exec site node
|
|
# scripts/beta.mjs …`, and that reaches into src/lib/betaStore.mjs. Nothing
|
|
# serving a request reads it — the pages were prerendered in stage 1.
|
|
COPY --from=build --chown=node:node /build/src ./src
|
|
|
|
# Both mount points exist in the image, owned by the runtime user. An operator
|
|
# who forgets a mount then gets a working stock site and an empty store rather
|
|
# than a container that will not start; and `data/` being writable by uid 1000
|
|
# BEFORE Docker creates it is what stops the store failing to open. If the host
|
|
# directory is owned by someone else, `chown 1000:1000 ./data` on the host.
|
|
RUN mkdir -p /app/brand /app/data && chown -R node:node /app/brand /app/data
|
|
|
|
USER node
|
|
|
|
EXPOSE 4321
|
|
|
|
# Cheap, and it tests the thing that actually breaks: `npm start` runs the brand
|
|
# rewrite BEFORE the server, so a container can sit alive for a long moment with
|
|
# nothing listening. A healthcheck that only watched the process would call that
|
|
# healthy.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
|
|
CMD node -e "fetch('http://127.0.0.1:' + (process.env.PORT || 4321) + '/').then((r) => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
|
|
|
|
# applyBrand.mjs, then serve.mjs. Not dist/server/entry.mjs directly — see the
|
|
# header comment in scripts/serve.mjs for the adapter bug that wrapper exists for.
|
|
CMD ["npm", "start"]
|