Alphaeus Mote
300866d5cf
Add internal/tlsmgr: on startup, load-or-generate the CA, issue/reuse the leaf, export the chain under <data>/tls, and hot-swap the cert on renewal via GetCertificate. The server listens HTTPS when a manager is present. TLS is on by default for the standalone binary/service (tls.enabled setting or ORCHESTRAD_TLS_ENABLED, UI wins over env); the container image defaults it off so it runs plain HTTP behind a TLS-terminating proxy. Startup logs a clickable URL. Verified end to end: HTTPS serves, plain HTTP rejected, disable serves HTTP. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
96 lines
3.3 KiB
Docker
96 lines
3.3 KiB
Docker
# OrchestrAD Docker Image
|
|
# Three-stage build: (1) compile the Next.js static export, (2) embed it into
|
|
# the Go binary, (3) ship a minimal Alpine runtime. The single resulting binary
|
|
# serves the full product UI plus the API on one port.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 1: build the frontend (Next.js static export -> frontend/out)
|
|
# Debian base avoids musl/sharp native-module friction; this stage is discarded.
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-bookworm-slim AS frontend
|
|
WORKDIR /frontend
|
|
|
|
# Install deps first for better layer caching. .npmrc carries
|
|
# legacy-peer-deps=true, which npm ci needs to resolve the React 19 RC peer
|
|
# graph, so it must be present before the install runs.
|
|
COPY frontend/package.json frontend/package-lock.json frontend/.npmrc ./
|
|
RUN npm ci --no-audit --no-fund
|
|
|
|
COPY frontend/ ./
|
|
RUN npm run build
|
|
# next.config.mjs sets output:"export", so the static site lands in ./out
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 2: build the Go binary with the UI embedded
|
|
# ---------------------------------------------------------------------------
|
|
FROM golang:1.25-alpine AS builder
|
|
|
|
# Pure-Go SQLite (modernc.org/sqlite) means no C toolchain is needed.
|
|
RUN apk add --no-cache git
|
|
|
|
WORKDIR /build
|
|
|
|
# Cache modules first.
|
|
COPY backend/go.mod backend/go.sum* ./
|
|
RUN go mod download
|
|
|
|
# Copy source, then drop the staged UI into the embed directory. webui.go does
|
|
# //go:embed all:dist, so the compiled binary carries the real UI instead of
|
|
# the placeholder page.
|
|
COPY backend/ ./
|
|
COPY --from=frontend /frontend/out/ ./internal/webui/dist/
|
|
|
|
# Build with version info injected via ldflags.
|
|
ARG VERSION=dev
|
|
ARG BUILD_TIME=unknown
|
|
ARG GIT_COMMIT=unknown
|
|
|
|
RUN CGO_ENABLED=0 go build \
|
|
-ldflags "-s -w \
|
|
-X github.com/Grace-Solutions/OrchestrAD/internal/version.Version=${VERSION} \
|
|
-X github.com/Grace-Solutions/OrchestrAD/internal/version.BuildTime=${BUILD_TIME} \
|
|
-X github.com/Grace-Solutions/OrchestrAD/internal/version.GitCommit=${GIT_COMMIT}" \
|
|
-o /orchestrad ./cmd/orchestrad
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 3: minimal runtime
|
|
# ---------------------------------------------------------------------------
|
|
FROM alpine:3.19
|
|
|
|
RUN apk add --no-cache ca-certificates tzdata wget
|
|
|
|
# Create non-root user
|
|
RUN addgroup -g 1000 orchestrad && \
|
|
adduser -u 1000 -G orchestrad -D orchestrad
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy binary
|
|
COPY --from=builder /orchestrad /app/orchestrad
|
|
|
|
# Create data directories
|
|
RUN mkdir -p /data/logs /data/backups && \
|
|
chown -R orchestrad:orchestrad /data
|
|
|
|
# Default environment
|
|
ENV ORCHESTRAD_DATA_PATH=/data
|
|
ENV ORCHESTRAD_LOG_LEVEL=info
|
|
# Containers typically sit behind an ingress/proxy that terminates TLS, so the
|
|
# image serves plain HTTP by default and the healthcheck below is HTTP. Set
|
|
# ORCHESTRAD_TLS_ENABLED=true to have the container manage its own certificate.
|
|
ENV ORCHESTRAD_TLS_ENABLED=false
|
|
|
|
# Expose port
|
|
EXPOSE 18090
|
|
|
|
# Health check
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider http://localhost:18090/health || exit 1
|
|
|
|
# Switch to non-root user
|
|
USER orchestrad
|
|
|
|
# Default to foreground mode
|
|
ENTRYPOINT ["/app/orchestrad"]
|
|
CMD ["run"]
|