e170af29ba
The maintenance page of 10 Feb 2026 replaced / only; /start, /chat, /about kept working. deploy/ builds what mf.toml builds, with the secrets MF had now in fnox.toml (age: Elias + the HEAD VPS key), served at v1.storytellurx.fuckingtech.ch.
26 lines
1.3 KiB
Docker
26 lines
1.3 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# StoryTellurX V1 on the HEAD VPS (head-vps, doco-cd): the build mf.toml runs, in Docker.
|
|
# Secrets come from fnox.toml, decrypted with the host's age key (BuildKit secret at build time,
|
|
# a mounted secret at run time); never in a layer or a Docker env var.
|
|
ARG DENO_IMAGE=docker.io/denoland/deno:debian-2.9.7@sha256:fa335acdf6b72106eda2cb6a8cb5f4187e7630e357467489db4b2e7352d5e432
|
|
|
|
FROM ${DENO_IMAGE} AS fnox
|
|
ADD --checksum=sha256:6f18dfc22f94e9b6cfd9bb5ed6400abd22cdbd319e7188e586cbc2262d031f16 \
|
|
https://github.com/jdx/fnox/releases/download/v1.43.0/fnox-x86_64-unknown-linux-gnu.tar.gz /tmp/fnox.tgz
|
|
RUN tar xzf /tmp/fnox.tgz -C /usr/local/bin fnox && fnox --version
|
|
|
|
FROM ${DENO_IMAGE}
|
|
COPY --from=fnox /usr/local/bin/fnox /usr/local/bin/fnox
|
|
# The RSC build records file:///app/ as the runtime root: the app must run from /app.
|
|
WORKDIR /app
|
|
COPY . .
|
|
ENV DENO_DIR=/app/.deno NODE_ENV=production DENO_CONDITIONS=react-server
|
|
RUN --mount=type=secret,id=age_key,required=true <<'SH'
|
|
set -eu
|
|
export FNOX_AGE_KEY="$(cat /run/secrets/age_key)"
|
|
deno install
|
|
fnox exec -- env RSC_BUILD_BASE_URL=file:///app/ deno run -A --conditions=react-server dev.ts build
|
|
SH
|
|
ENTRYPOINT ["./deploy/entrypoint.sh"]
|
|
CMD ["deno", "serve", "--host", "0.0.0.0", "--port", "8000", "-A", "--conditions=react-server", "main.ts"]
|
|
EXPOSE 8000
|