17 lines
1.3 KiB
Docker
17 lines
1.3 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# The DNS workflow: OpenTofu + fnox, the .tf files and the provider baked in. doco-cd rebuilds and
|
|
# reruns it whenever something in dns/ changes; the container applies once and exits.
|
|
FROM debian:trixie-slim@sha256:f6b08b09a05725f9431502d3b5714f5c4576e82c1a84fa1debe0c24a7e0c3ec4
|
|
RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
|
|
ADD --checksum=sha256:378ada19d4bc70c43732004e8159be771b23b9a5afdf059e5f8a2b3fa2c70a69 \
|
|
https://github.com/opentofu/opentofu/releases/download/v1.13.1/tofu_1.13.1_linux_amd64.tar.gz /tmp/tofu.tgz
|
|
ADD --checksum=sha256:6f18dfc22f94e9b6cfd9bb5ed6400abd22cdbd319e7188e586cbc2262d031f16 \
|
|
https://github.com/jdx/fnox/releases/download/v1.43.0/fnox-x86_64-unknown-linux-gnu.tar.gz /tmp/fnox.tgz
|
|
RUN tar xzf /tmp/tofu.tgz -C /usr/local/bin tofu && tar xzf /tmp/fnox.tgz -C /usr/local/bin fnox && rm /tmp/*.tgz
|
|
WORKDIR /dns
|
|
COPY . .
|
|
# The provider is mirrored into the image at build (exact version pinned in main.tf); a run installs it
|
|
# from there (-plugin-dir) and never contacts the registry. The placeholder passphrase only satisfies
|
|
# the encryption block while reading the config; nothing is encrypted here.
|
|
RUN TF_VAR_state_passphrase=build-only tofu providers mirror -platform=linux_amd64 /dns/providers
|
|
ENTRYPOINT ["/dns/apply.sh"]
|