mirror of
https://github.com/d9pouces/id_configurator.git
synced 2026-11-09 01:47:21 +01:00
d9pouces
47 lines
2.7 KiB
Docker
47 lines
2.7 KiB
Docker
# Minimal Alpine (apk) repository with a signed index, serving one hand-built
|
|
# .apk package over TLS, using the same Test CA as the pypi-repo/apt-repo/
|
|
# yum-repo fixtures, used by tox-docker to exercise the `apk` module
|
|
# integration test (tests/configs/Apk.yaml.j2,
|
|
# tests/dockerfiles/Apk.Dockerfile). The package is signed with the static
|
|
# key pair 040d0af5f97a0a44.rsa / 040d0af5f97a0a44.rsa.pub, whose public
|
|
# half is what the `apk` module configuration is expected to install into
|
|
# /etc/apk/keys.
|
|
#
|
|
# The key's filename matters, not just its content: apk embeds the public
|
|
# key's *filename* (not just a verifiable signature) into the index it
|
|
# signs, and only accepts it if a key file with that exact name is present
|
|
# in /etc/apk/keys - trying other installed keys does not help. The name
|
|
# 040d0af5f97a0a44 is the id_configurator.modules.apk._key_filename() hash
|
|
# of this specific public key's content (see tests/configs/Apk.yaml.tmpl),
|
|
# i.e. the name the `apk` module will actually use when it installs this key
|
|
# from the configuration. Regenerating the key pair requires recomputing
|
|
# that hash and renaming both files (and updating this comment) to match.
|
|
#
|
|
# Built by tox-docker, whose build context is this directory (not the repo
|
|
# root) - every COPY source below must live under tests/dockerfiles/repos/.
|
|
FROM alpine:3.20 AS packagebuild
|
|
RUN apk add --no-cache abuild build-base
|
|
RUN adduser -D builder && addgroup builder abuild
|
|
COPY 040d0af5f97a0a44.rsa 040d0af5f97a0a44.rsa.pub /home/builder/.abuild/
|
|
COPY 040d0af5f97a0a44.rsa.pub /etc/apk/keys/040d0af5f97a0a44.rsa.pub
|
|
RUN printf 'PACKAGER_PRIVKEY="/home/builder/.abuild/040d0af5f97a0a44.rsa"\n' > /home/builder/.abuild/abuild.conf \
|
|
&& chown -R builder:builder /home/builder
|
|
COPY --chown=builder:builder APKBUILD /home/builder/pkg/APKBUILD
|
|
RUN su builder -c 'cd /home/builder/pkg && abuild checksum && abuild -r'
|
|
# apk always appends the *client's* architecture to the repository URL, so
|
|
# the built index/package land in a directory named after whatever
|
|
# architecture this image was actually built for (native to the Docker host
|
|
# unless emulated). A flat copy of the index at the repo root lets the
|
|
# healthcheck probe it without knowing that architecture name in advance.
|
|
RUN arch_dir=$(ls /home/builder/packages/builder) \
|
|
&& mkdir -p /srv \
|
|
&& cp -r "/home/builder/packages/builder/$arch_dir" "/srv/$arch_dir" \
|
|
&& cp "/home/builder/packages/builder/$arch_dir/APKINDEX.tar.gz" /srv/APKINDEX.tar.gz
|
|
|
|
FROM nginx:alpine
|
|
COPY --from=packagebuild /srv /srv
|
|
COPY repo-server.crt.pem /etc/nginx/certs/repo-server.crt.pem
|
|
COPY repo-server.key.pem /etc/nginx/certs/repo-server.key.pem
|
|
COPY apk-repo.nginx.conf /etc/nginx/conf.d/default.conf
|
|
EXPOSE 8443
|