From c9c404aa01f9a0df19ecb05bce1c60c5a5ee7738 Mon Sep 17 00:00:00 2001 From: Steve Dudenhoeffer Date: Sat, 18 Jul 2026 15:35:15 -0400 Subject: [PATCH 1/2] Add Gitea Action to build and push the image for Komodo deploys Multi-stage Dockerfile builds the web bundle, embeds it into the static Go binary (CGO_ENABLED=0), and ships it in a minimal alpine runtime: non-root user, ca-certificates + tzdata, SQLite on a /data volume, healthcheck on /api/v1/healthz, OCI provenance labels. build-image.yml pushes to the Gitea registry on every branch push: * main -> :latest * any other branch -> : (sanitized to valid tag chars) * every build -> :sha- (immutable, for pinning) A push to a PR branch covers the PR, so there is no separate pull_request trigger. README documents the image, tags, and a docker run / Komodo compose snippet. Modeled on mort's CI. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi --- .dockerignore | 26 ++++++++++++ .gitea/workflows/build-image.yml | 73 ++++++++++++++++++++++++++++++++ Dockerfile | 60 ++++++++++++++++++++++++++ README.md | 39 +++++++++++++++++ 4 files changed, 198 insertions(+) create mode 100644 .dockerignore create mode 100644 .gitea/workflows/build-image.yml create mode 100644 Dockerfile diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..29c3b01 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,26 @@ +# VCS / editor / docs — not needed in the image build context. +.git +.gitea +.github +.idea +.vscode +*.md +LICENSE + +# Local build outputs and databases. +/pansy +*.db +*.db-wal +*.db-shm + +# Frontend deps/output are rebuilt inside the image's web stage. +web/node_modules +web/dist + +# The embedded web build is produced fresh in the image (web stage → embed +# directory), so never ship stale local contents. dist.go itself is kept. +internal/webdist/dist + +# Assorted local scratch. +.playwright-mcp +.claude diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml new file mode 100644 index 0000000..1a0448e --- /dev/null +++ b/.gitea/workflows/build-image.yml @@ -0,0 +1,73 @@ +name: Build image + +# Build the single-binary image and push it to the Gitea container registry so +# it can be deployed with Komodo. Tagging: +# * main -> :latest +# * any other branch -> : (sanitized to valid Docker tag chars) +# * every build also -> :sha- (immutable, handy for pinning) +# +# Runs on every branch push (so branch images are always available) and can be +# triggered manually. A push to a PR branch covers the PR too, so there is no +# separate pull_request trigger (avoids double builds). + +on: + push: + branches: ['**'] + workflow_dispatch: + +concurrency: + group: build-image-${{ github.ref }} + cancel-in-progress: true + +env: + IMAGE_NAME: gitea.stevedudenhoeffer.com/steve/pansy + +jobs: + build-and-push: + runs-on: ubuntu-latest + steps: + - name: Checkout + run: | + REPO_URL="https://token:${{ github.token }}@gitea.stevedudenhoeffer.com/${{ github.repository }}.git" + git clone --depth=1 --branch "${{ github.ref_name }}" "$REPO_URL" . + + - name: Set up Docker Buildx + run: docker buildx create --use --name pansy-builder --driver docker-container 2>/dev/null || docker buildx use pansy-builder + + - name: Log in to Gitea registry + env: + REGISTRY_USER: ${{ secrets.REGISTRY_USER }} + REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} + run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin + + - name: Compute tags + id: meta + run: | + SHA_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7) + if [ "${GITHUB_REF_NAME}" = "main" ]; then + PRIMARY="latest" + else + # Normalize the branch name to valid Docker tag chars [a-zA-Z0-9._-]. + PRIMARY=$(echo "${GITHUB_REF_NAME}" | sed 's/[^a-zA-Z0-9._-]/-/g' | sed 's/--*/-/g' | sed 's/^[-.]*//;s/-$//') + fi + TAGS="${IMAGE_NAME}:${PRIMARY},${IMAGE_NAME}:sha-${SHA_SHORT}" + echo "tags=${TAGS}" >> "$GITHUB_OUTPUT" + echo "Building tags: ${TAGS}" + + - name: Build and push (linux/amd64) + run: | + TAG_FLAGS="" + IFS=',' read -ra TAG_ARRAY <<< "${{ steps.meta.outputs.tags }}" + for tag in "${TAG_ARRAY[@]}"; do + TAG_FLAGS="$TAG_FLAGS --tag $tag" + done + + docker buildx build \ + --push \ + --platform linux/amd64 \ + $TAG_FLAGS \ + --build-arg "BUILD_COMMIT=${GITHUB_SHA}" \ + --build-arg "BUILD_BRANCH=${GITHUB_REF_NAME}" \ + --build-arg "BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \ + --file ./Dockerfile \ + . diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..599db53 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,60 @@ +# syntax=docker/dockerfile:1 +# +# pansy ships as one static binary with the web build embedded. This is a +# three-stage build: compile the frontend, embed it into the Go binary, then +# copy that single binary into a minimal runtime image. + +# ---- stage 1: build the web bundle ------------------------------------------ +FROM node:22-alpine AS web +WORKDIR /web +COPY web/package.json web/package-lock.json ./ +RUN npm ci +COPY web/ ./ +RUN npm run build + +# ---- stage 2: build the static Go binary (web bundle embedded) -------------- +FROM golang:1.26-alpine AS build +ENV CGO_ENABLED=0 GOTOOLCHAIN=auto +WORKDIR /src +COPY go.mod go.sum ./ +RUN --mount=type=cache,target=/go/pkg/mod go mod download +COPY . . +# Overlay the freshly built frontend into the embed directory before compiling +# (//go:embed all:dist in internal/webdist). +COPY --from=web /web/dist ./internal/webdist/dist +RUN --mount=type=cache,target=/go/pkg/mod \ + --mount=type=cache,target=/root/.cache/go-build \ + go build -trimpath -ldflags "-s -w" -o /out/pansy ./cmd/pansy + +# ---- stage 3: minimal runtime ----------------------------------------------- +FROM alpine:3.20 +ARG BUILD_COMMIT=unknown +ARG BUILD_BRANCH=unknown +ARG BUILD_TIME=unknown +LABEL org.opencontainers.image.title="pansy" \ + org.opencontainers.image.description="Self-hostable garden planner" \ + org.opencontainers.image.source="https://gitea.stevedudenhoeffer.com/steve/pansy" \ + org.opencontainers.image.revision="${BUILD_COMMIT}" \ + org.opencontainers.image.version="${BUILD_BRANCH}" \ + org.opencontainers.image.created="${BUILD_TIME}" + +# ca-certificates: outbound TLS (OIDC discovery, #5). tzdata: correct local time. +RUN apk add --no-cache ca-certificates tzdata \ + && adduser -D -u 10001 pansy \ + && mkdir -p /data \ + && chown pansy:pansy /data + +COPY --from=build /out/pansy /usr/local/bin/pansy + +USER pansy +# The SQLite database lives on the /data volume so it survives container updates. +ENV PANSY_PORT=8080 \ + PANSY_DB=/data/pansy.db +WORKDIR /data +VOLUME /data +EXPOSE 8080 + +HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ + CMD wget -q -O - "http://127.0.0.1:${PANSY_PORT}/api/v1/healthz" || exit 1 + +ENTRYPOINT ["/usr/local/bin/pansy"] diff --git a/README.md b/README.md index 5711d1c..e4ffd6d 100644 --- a/README.md +++ b/README.md @@ -58,3 +58,42 @@ All configuration is via environment variables; every value has a default, so `. | `PANSY_TRUSTED_PROXIES` | *(none)* | Comma-separated proxy CIDRs/IPs to trust for client-IP resolution. | Auth variables are read at startup now and consumed as the auth features land (issues #4/#5). + +## Docker & deployment + +CI (`.gitea/workflows/build-image.yml`) builds the single-binary image and pushes it to the Gitea registry on every branch push: + +| Ref | Tag | +| --- | --- | +| `main` | `gitea.stevedudenhoeffer.com/steve/pansy:latest` | +| any other branch | `gitea.stevedudenhoeffer.com/steve/pansy:` | +| every build | `gitea.stevedudenhoeffer.com/steve/pansy:sha-` (immutable; use to pin) | + +The image runs as a non-root user, serves on `:8080`, and stores the SQLite database on the `/data` volume. Run it directly: + +```sh +docker run -d --name pansy \ + -p 8080:8080 \ + -v pansy-data:/data \ + gitea.stevedudenhoeffer.com/steve/pansy:latest +``` + +Or as a Komodo/Compose stack: + +```yaml +services: + pansy: + image: gitea.stevedudenhoeffer.com/steve/pansy:${PANSY_TAG:-latest} + ports: + - "8080:8080" + volumes: + - pansy-data:/data + environment: + PANSY_BASE_URL: https://pansy.example.com + # PANSY_OIDC_ISSUER: ... # once auth (#5) lands + restart: unless-stopped +volumes: + pansy-data: +``` + +Pin `PANSY_TAG` to a `sha-` tag for reproducible deploys, or leave it at `latest` to track `main`. From c59688c2a349c19640926b75bbba54d7f5720a0e Mon Sep 17 00:00:00 2001 From: Steve Dudenhoeffer Date: Sat, 18 Jul 2026 15:53:10 -0400 Subject: [PATCH 2/2] Address Gadfly review findings on build-image CI Workflow: - Pass untrusted github.ref_name/repository/sha/token via env instead of inline ${{ }} in run: blocks, closing a branch-name shell-injection vector. - Check out the exact triggering commit (fetch by SHA, branch fallback) so the sha- tag matches what was built. - Guard the tag scheme: a non-main branch named/sanitized to "latest" can't clobber :latest, and an empty sanitized name falls back to branch-. - Build --tag flags as a bash array (no word-splitting), drop the comma-string round-trip, and check-then-create the buildx builder so a real failure isn't swallowed. Dockerfile: - GOWORK=off in the build stage (matches the Makefile convention). - npm ci uses a BuildKit cache mount. - Drop the stale issue-number reference in a comment. .dockerignore: - Add .env/.env.*, go.work/go.work.sum, web/.vite; drop nonexistent .github. Graded all findings in the gadfly store. Deferred/keep-as-is: token-in-clone-URL (Gitea masks the secret in logs), sanitization collisions across branch names (the sha- tag is the collision-proof identifier), and registry build cache (current builds are fast). False positives: alpine ships wget (busybox); docker login is its own step. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi --- .dockerignore | 10 +++++- .gitea/workflows/build-image.yml | 58 ++++++++++++++++++++------------ Dockerfile | 8 +++-- 3 files changed, 50 insertions(+), 26 deletions(-) diff --git a/.dockerignore b/.dockerignore index 29c3b01..2f8c53f 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,21 +1,29 @@ # VCS / editor / docs — not needed in the image build context. .git .gitea -.github .idea .vscode *.md LICENSE +# Secrets and env files must never be baked into an image layer. +.env +.env.* + # Local build outputs and databases. /pansy *.db *.db-wal *.db-shm +# Go workspace files (pansy builds standalone; GOWORK=off). +go.work +go.work.sum + # Frontend deps/output are rebuilt inside the image's web stage. web/node_modules web/dist +web/.vite # The embedded web build is produced fresh in the image (web stage → embed # directory), so never ship stale local contents. dist.go itself is kept. diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml index 1a0448e..2f53d9a 100644 --- a/.gitea/workflows/build-image.yml +++ b/.gitea/workflows/build-image.yml @@ -1,7 +1,7 @@ name: Build image # Build the single-binary image and push it to the Gitea container registry so -# it can be deployed with Komodo. Tagging: +# it can be deployed with Komodo. Tagging (see README for the canonical table): # * main -> :latest # * any other branch -> : (sanitized to valid Docker tag chars) # * every build also -> :sha- (immutable, handy for pinning) @@ -27,12 +27,27 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout + # Untrusted values (branch name) go through env, never inline ${{ }}, so a + # crafted branch name can't inject shell. Check out the exact triggering + # commit so the sha- tag matches the code that was built. + env: + REPO: ${{ github.repository }} + REF_NAME: ${{ github.ref_name }} + SHA: ${{ github.sha }} + GIT_TOKEN: ${{ github.token }} run: | - REPO_URL="https://token:${{ github.token }}@gitea.stevedudenhoeffer.com/${{ github.repository }}.git" - git clone --depth=1 --branch "${{ github.ref_name }}" "$REPO_URL" . + git init -q . + git remote add origin "https://token:${GIT_TOKEN}@gitea.stevedudenhoeffer.com/${REPO}.git" + git fetch -q --depth=1 origin "$SHA" || git fetch -q --depth=1 origin "$REF_NAME" + git checkout -q FETCH_HEAD - name: Set up Docker Buildx - run: docker buildx create --use --name pansy-builder --driver docker-container 2>/dev/null || docker buildx use pansy-builder + # Check first so a genuine create failure surfaces (rather than being + # hidden behind a swallowed "already exists"). + run: | + docker buildx inspect pansy-builder >/dev/null 2>&1 \ + || docker buildx create --name pansy-builder --driver docker-container + docker buildx use pansy-builder - name: Log in to Gitea registry env: @@ -40,34 +55,33 @@ jobs: REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin - - name: Compute tags - id: meta + - name: Build and push (linux/amd64) + env: + REF_NAME: ${{ github.ref_name }} + SHA: ${{ github.sha }} run: | - SHA_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7) - if [ "${GITHUB_REF_NAME}" = "main" ]; then + SHA_SHORT=$(echo "$SHA" | cut -c1-7) + + if [ "$REF_NAME" = "main" ]; then PRIMARY="latest" else # Normalize the branch name to valid Docker tag chars [a-zA-Z0-9._-]. - PRIMARY=$(echo "${GITHUB_REF_NAME}" | sed 's/[^a-zA-Z0-9._-]/-/g' | sed 's/--*/-/g' | sed 's/^[-.]*//;s/-$//') + PRIMARY=$(echo "$REF_NAME" | sed 's/[^a-zA-Z0-9._-]/-/g; s/--*/-/g; s/^[-.]*//; s/-*$//') + # A non-main branch must never clobber :latest, and the tag can't be empty. + [ "$PRIMARY" = "latest" ] && PRIMARY="branch-latest" + [ -z "$PRIMARY" ] && PRIMARY="branch-${SHA_SHORT}" fi - TAGS="${IMAGE_NAME}:${PRIMARY},${IMAGE_NAME}:sha-${SHA_SHORT}" - echo "tags=${TAGS}" >> "$GITHUB_OUTPUT" - echo "Building tags: ${TAGS}" - - name: Build and push (linux/amd64) - run: | - TAG_FLAGS="" - IFS=',' read -ra TAG_ARRAY <<< "${{ steps.meta.outputs.tags }}" - for tag in "${TAG_ARRAY[@]}"; do - TAG_FLAGS="$TAG_FLAGS --tag $tag" - done + # Build the tag flags as an array so no word-splitting/quoting surprises. + TAGS=(--tag "${IMAGE_NAME}:${PRIMARY}" --tag "${IMAGE_NAME}:sha-${SHA_SHORT}") + echo "Building ${IMAGE_NAME}:${PRIMARY} and ${IMAGE_NAME}:sha-${SHA_SHORT}" docker buildx build \ --push \ --platform linux/amd64 \ - $TAG_FLAGS \ - --build-arg "BUILD_COMMIT=${GITHUB_SHA}" \ - --build-arg "BUILD_BRANCH=${GITHUB_REF_NAME}" \ + "${TAGS[@]}" \ + --build-arg "BUILD_COMMIT=${SHA}" \ + --build-arg "BUILD_BRANCH=${REF_NAME}" \ --build-arg "BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \ --file ./Dockerfile \ . diff --git a/Dockerfile b/Dockerfile index 599db53..073c8db 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,13 +8,15 @@ FROM node:22-alpine AS web WORKDIR /web COPY web/package.json web/package-lock.json ./ -RUN npm ci +RUN --mount=type=cache,target=/root/.npm npm ci COPY web/ ./ RUN npm run build # ---- stage 2: build the static Go binary (web bundle embedded) -------------- FROM golang:1.26-alpine AS build -ENV CGO_ENABLED=0 GOTOOLCHAIN=auto +# GOWORK=off matches the Makefile: pansy is a standalone module, built without +# any parent workspace even if one leaks into the build context. +ENV CGO_ENABLED=0 GOTOOLCHAIN=auto GOWORK=off WORKDIR /src COPY go.mod go.sum ./ RUN --mount=type=cache,target=/go/pkg/mod go mod download @@ -38,7 +40,7 @@ LABEL org.opencontainers.image.title="pansy" \ org.opencontainers.image.version="${BUILD_BRANCH}" \ org.opencontainers.image.created="${BUILD_TIME}" -# ca-certificates: outbound TLS (OIDC discovery, #5). tzdata: correct local time. +# ca-certificates: outbound TLS (e.g. OIDC discovery). tzdata: correct local time. RUN apk add --no-cache ca-certificates tzdata \ && adduser -D -u 10001 pansy \ && mkdir -p /data \