steve
3800b34a2b
CI / Test (rest) (pull_request) Successful in 29s
CI / Lint (pull_request) Successful in 32s
CI / Build (windows/amd64) (pull_request) Successful in 22s
CI / Test (store) (pull_request) Successful in 1m22s
CI / Test (server-http) (pull_request) Successful in 1m30s
CI / Build (linux/amd64) (pull_request) Successful in 22s
CI / Build (linux/arm64) (pull_request) Successful in 41s
Smoothes the rough edges that came up exercising a live deployment.
First-run bootstrap UI: /bootstrap renders a username + password form
that uses the in-memory token directly (operator no longer copies it
out of the log); /login redirects there while bootstrap is available.
Agent reliability: failJob synthetic envelopes so command.run early
returns no longer hang the server-side job; runtime probe of restic
restore --help drives --no-ownership instead of version sniffing
(0.18.x had it removed). Server unit re-shaped: ProtectSystem=full
plus ReadWritePaths=/etc/restic-manager, no ProtectHome — restore
can now write anywhere a user might want.
Restore wizard: default target is /root/rm-restore/<job-id>/ with
clearer help text. Re-init confirm input uses .field (was .input,
which doesn't exist — text was invisible).
NS-01 host delete: store DeleteHost, admin-band /hosts/{id}/delete
with hostname-confirm danger zone, audit, FK cascade, live WS close.
NS-02 enrollment-token recovery: outstanding-tokens panel on
/hosts/new, regenerate (preserves attachments) and revoke handlers
+ audit, store-level ListOutstandingEnrollmentTokens and
DeleteEnrollmentToken.
NS-03 repo init / probe surface: migration 0020 adds
hosts.repo_status + repo_status_error; WS handler projects every
init job's outcome onto the host row (idempotent already-initialised
collapses to ready); creds-save resets status and dispatches a fresh
probe; /hosts/{id}/repo/probe retry endpoint with banner.
NS-04 dashboard live + sort + filter: query-string filter
(q/status/repo_status/tag/sort/dir), 5s htmx live poll mirroring the
alerts pattern with a localStorage live toggle, sortable column
headers, filter row + clear.
Alerts page: ack'd-by line resolves user_id ULID to username.
Compose.yaml ignored — host-specific.
88 lines
3.3 KiB
Docker
88 lines
3.3 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ---- Build stage --------------------------------------------------------
|
|
# Cross-compiles:
|
|
# * the server binary for the image's TARGETARCH (linux/amd64 or arm64),
|
|
# * three agent binaries (linux/amd64, linux/arm64, windows/amd64) that
|
|
# the running server hands out via /agent/binary.
|
|
# Pure-Go SQLite (modernc.org/sqlite) means CGO stays off; static binaries
|
|
# run on distroless/static.
|
|
FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS build
|
|
|
|
WORKDIR /src
|
|
|
|
ENV CGO_ENABLED=0 \
|
|
GOFLAGS="-trimpath"
|
|
|
|
# Cache module downloads in a separate layer.
|
|
COPY go.mod go.sum* ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
ARG VERSION=dev
|
|
ARG COMMIT=none
|
|
ARG DATE=unknown
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
|
|
ENV LDFLAGS="-s -w -X main.version=${VERSION} -X main.commit=${COMMIT} -X main.date=${DATE}"
|
|
|
|
# Server: built for the image's runtime arch.
|
|
RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
|
|
go build -ldflags="${LDFLAGS}" \
|
|
-o /out/restic-manager-server \
|
|
./cmd/server
|
|
|
|
# Empty /data skeleton so the runtime image carries an existing,
|
|
# nonroot-owned mount point. Docker copies that ownership onto a
|
|
# named volume the first time it's created, which avoids the
|
|
# "permission denied" trap on /data/secret.key when the operator
|
|
# uses a default `volumes: { rm-data: {} }` declaration.
|
|
RUN mkdir -p /out/data
|
|
|
|
# Agents: identical across image arches — an arm64 server image still
|
|
# ships an amd64 agent binary for amd64 endpoints to download.
|
|
RUN mkdir -p /out/agent-binaries && \
|
|
GOOS=linux GOARCH=amd64 \
|
|
go build -ldflags="${LDFLAGS}" \
|
|
-o /out/agent-binaries/restic-manager-agent-linux-amd64 \
|
|
./cmd/agent && \
|
|
GOOS=linux GOARCH=arm64 \
|
|
go build -ldflags="${LDFLAGS}" \
|
|
-o /out/agent-binaries/restic-manager-agent-linux-arm64 \
|
|
./cmd/agent && \
|
|
GOOS=windows GOARCH=amd64 \
|
|
go build -ldflags="${LDFLAGS}" \
|
|
-o /out/agent-binaries/restic-manager-agent-windows-amd64.exe \
|
|
./cmd/agent
|
|
|
|
# ---- Runtime stage ------------------------------------------------------
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
|
|
LABEL org.opencontainers.image.source="https://gitea.dcglab.co.uk/steve/restic-manager"
|
|
LABEL org.opencontainers.image.licenses="PolyForm-Noncommercial-1.0.0"
|
|
|
|
USER nonroot:nonroot
|
|
WORKDIR /
|
|
|
|
# Server binary on PATH.
|
|
COPY --from=build /out/restic-manager-server /usr/local/bin/restic-manager-server
|
|
|
|
# Image-baked bundled assets (P5-03). Read-only; the /agent/binary and
|
|
# /install/* handlers fall back here when <DataDir>/... is empty, so a
|
|
# fresh container Just Works without first-run staging. Operators can
|
|
# still drop a custom build under <DataDir>/agent-binaries/<name> to
|
|
# override per-host.
|
|
COPY --from=build --chmod=0755 /out/agent-binaries/ /opt/restic-manager/dist/agent-binaries/
|
|
COPY --chmod=0755 deploy/install/install.sh /opt/restic-manager/dist/install/install.sh
|
|
COPY --chmod=0644 deploy/install/install.ps1 /opt/restic-manager/dist/install/install.ps1
|
|
COPY --chmod=0644 deploy/install/restic-manager-agent.service /opt/restic-manager/dist/install/restic-manager-agent.service
|
|
|
|
# Pre-created data dir owned by nonroot so a fresh named volume
|
|
# inherits the right ownership.
|
|
COPY --from=build --chown=nonroot:nonroot /out/data /data
|
|
|
|
EXPOSE 8443
|
|
ENTRYPOINT ["/usr/local/bin/restic-manager-server"]
|