steve
7cc17813a9
Single public deliverable per tag: a multi-arch server image, with cross-compiled agent binaries + install scripts + the systemd unit baked under /opt/restic-manager/dist/. The /agent/binary and /install/* handlers fall back from <DataDir>/... to that read-only path so a fresh container Just Works without first-run staging; operators can still drop a custom build into <DataDir>/ to override per-host. Architecture rationale: agent distribution already routes through the running server, so the release surface mirrors that — there's no second source of truth to keep in sync. Workflow .gitea/workflows/release.yml triggers on v*.*.* tag-push (fan-out :vX.Y.Z / :X.Y / :X, plus :latest once MAJOR>=1) and workflow_dispatch (snapshot tag only). Pushes to the Gitea container registry on this instance. Both binaries grow main.commit + main.date ldflag targets. Makefile and Dockerfile fill them; release workflow forwards from gitea.sha plus a UTC timestamp. Spec : docs/superpowers/specs/2026-05-05-p5-03-docker-only-release.md Plan : docs/superpowers/plans/2026-05-05-p5-03-docker-only-release.md
77 lines
2.8 KiB
Docker
77 lines
2.8 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ---- Build stage --------------------------------------------------------
|
|
# Cross-compiles:
|
|
# * the server binary for the image's TARGETARCH (linux/amd64 or arm64),
|
|
# * three agent binaries (linux/amd64, linux/arm64, windows/amd64) that
|
|
# the running server hands out via /agent/binary.
|
|
# Pure-Go SQLite (modernc.org/sqlite) means CGO stays off; static binaries
|
|
# run on distroless/static.
|
|
FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS build
|
|
|
|
WORKDIR /src
|
|
|
|
ENV CGO_ENABLED=0 \
|
|
GOFLAGS="-trimpath"
|
|
|
|
# Cache module downloads in a separate layer.
|
|
COPY go.mod go.sum* ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
ARG VERSION=dev
|
|
ARG COMMIT=none
|
|
ARG DATE=unknown
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
|
|
ENV LDFLAGS="-s -w -X main.version=${VERSION} -X main.commit=${COMMIT} -X main.date=${DATE}"
|
|
|
|
# Server: built for the image's runtime arch.
|
|
RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
|
|
go build -ldflags="${LDFLAGS}" \
|
|
-o /out/restic-manager-server \
|
|
./cmd/server
|
|
|
|
# Agents: identical across image arches — an arm64 server image still
|
|
# ships an amd64 agent binary for amd64 endpoints to download.
|
|
RUN mkdir -p /out/agent-binaries && \
|
|
GOOS=linux GOARCH=amd64 \
|
|
go build -ldflags="${LDFLAGS}" \
|
|
-o /out/agent-binaries/restic-manager-agent-linux-amd64 \
|
|
./cmd/agent && \
|
|
GOOS=linux GOARCH=arm64 \
|
|
go build -ldflags="${LDFLAGS}" \
|
|
-o /out/agent-binaries/restic-manager-agent-linux-arm64 \
|
|
./cmd/agent && \
|
|
GOOS=windows GOARCH=amd64 \
|
|
go build -ldflags="${LDFLAGS}" \
|
|
-o /out/agent-binaries/restic-manager-agent-windows-amd64.exe \
|
|
./cmd/agent
|
|
|
|
# ---- Runtime stage ------------------------------------------------------
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
|
|
LABEL org.opencontainers.image.source="https://gitea.dcglab.co.uk/steve/restic-manager"
|
|
LABEL org.opencontainers.image.licenses="PolyForm-Noncommercial-1.0.0"
|
|
|
|
USER nonroot:nonroot
|
|
WORKDIR /
|
|
|
|
# Server binary on PATH.
|
|
COPY --from=build /out/restic-manager-server /usr/local/bin/restic-manager-server
|
|
|
|
# Image-baked bundled assets (P5-03). Read-only; the /agent/binary and
|
|
# /install/* handlers fall back here when <DataDir>/... is empty, so a
|
|
# fresh container Just Works without first-run staging. Operators can
|
|
# still drop a custom build under <DataDir>/agent-binaries/<name> to
|
|
# override per-host.
|
|
COPY --from=build --chmod=0755 /out/agent-binaries/ /opt/restic-manager/dist/agent-binaries/
|
|
COPY --chmod=0755 deploy/install/install.sh /opt/restic-manager/dist/install/install.sh
|
|
COPY --chmod=0644 deploy/install/install.ps1 /opt/restic-manager/dist/install/install.ps1
|
|
COPY --chmod=0644 deploy/install/restic-manager-agent.service /opt/restic-manager/dist/install/restic-manager-agent.service
|
|
|
|
EXPOSE 8443
|
|
ENTRYPOINT ["/usr/local/bin/restic-manager-server"]
|