c1566ca033
deploy/Dockerfile is mf.toml's build in Docker: pnpm install, Vite, deno compile, with NODE_AUTH_TOKEN from fnox decrypted by the host's age key (BuildKit secret). deploy/compose.yaml runs db apply once, then the server behind Caddy labels. fnox.toml holds the 7 secrets MF had, encrypted for Elias's key; the VPS's recipient is added once its key exists.
38 lines
1.9 KiB
Docker
38 lines
1.9 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# StoryTellurX for the HEAD VPS (head-vps, doco-cd): the build mf.toml runs, in Docker. Secrets come
|
|
# from fnox.toml, decrypted with the host's age key (a BuildKit secret, never in a layer).
|
|
ARG DENO_IMAGE=docker.io/denoland/deno:debian-2.9.7@sha256:fa335acdf6b72106eda2cb6a8cb5f4187e7630e357467489db4b2e7352d5e432
|
|
|
|
FROM ${DENO_IMAGE} AS fnox
|
|
ADD --checksum=sha256:6f18dfc22f94e9b6cfd9bb5ed6400abd22cdbd319e7188e586cbc2262d031f16 \
|
|
https://github.com/jdx/fnox/releases/download/v1.43.0/fnox-x86_64-unknown-linux-gnu.tar.gz /tmp/fnox.tgz
|
|
RUN tar xzf /tmp/fnox.tgz -C /usr/local/bin fnox && fnox --version
|
|
|
|
FROM ${DENO_IMAGE} AS build
|
|
COPY --from=fnox /usr/local/bin/fnox /usr/local/bin/fnox
|
|
WORKDIR /src
|
|
COPY . .
|
|
# NODE_AUTH_TOKEN (private @bureaudouble packages) is the only secret the build reads.
|
|
RUN --mount=type=secret,id=age_key,required=true <<'SH'
|
|
set -eu
|
|
export FNOX_AGE_KEY="$(cat /run/secrets/age_key)" DENO_DIR="$PWD/.deno"
|
|
deno eval 'const r = await fetch("https://registry.npmjs.org/@pnpm/exe.linux-x64/-/exe.linux-x64-12.6.0.tgz"); if (!r.ok) throw new Error(String(r.status)); await Deno.writeFile("/tmp/pnpm.tgz", new Uint8Array(await r.arrayBuffer()));'
|
|
tar xzf /tmp/pnpm.tgz -C /tmp
|
|
fnox exec -- sh -c 'NPM_CONFIG_USERCONFIG=.npmrc /tmp/package/pnpm install --frozen-lockfile --ignore-scripts'
|
|
deno task build:deploy
|
|
deno task deploy:prune
|
|
cat > entry.ts <<'TS'
|
|
import app from "./dist/server/server.js";
|
|
Deno.serve({ hostname: "0.0.0.0", port: 8000 }, (request: Request, info: Deno.ServeHandlerInfo) => app.fetch(request, info));
|
|
TS
|
|
deno compile -A --no-check --node-modules-dir=none --include dist -o /server entry.ts
|
|
SH
|
|
|
|
FROM ${DENO_IMAGE}
|
|
COPY --from=fnox /usr/local/bin/fnox /usr/local/bin/fnox
|
|
WORKDIR /app
|
|
COPY --from=build /server ./server
|
|
COPY fnox.toml deploy/entrypoint.sh ./
|
|
ENTRYPOINT ["./entrypoint.sh"]
|
|
CMD ["./server"]
|
|
EXPOSE 8000
|