tben
e859bab294
The installer generates a CA and a 397-day certificate into $COBBLE_HOME/certs (in the app image, with the host's addresses), mounts the certificate, key and CA into the container and serves TLS from Bun on the published port. --no-https opts out; --https-cert/--https-key use a real certificate, --https-host adds names and --https-regen replaces the CA. The installer and the image health check use curl -k when TLS is on. The CA is served at /ca.crt and as an iOS/macOS profile at /ca.mobileconfig for one-tap install. Development picks up certs/ automatically, `bun run dev:phone` generates and starts, and a plain-HTTP listener on PORT + 1 redirects to HTTPS. Port sharing is off, so a stale dev server fails instead of silently answering on the same port.
39 lines
1.3 KiB
Docker
39 lines
1.3 KiB
Docker
FROM oven/bun:1.4.3-debian
|
|
|
|
LABEL org.opencontainers.image.title="Cobble" \
|
|
org.opencontainers.image.description="A self-hosted crew of small AI worker bots." \
|
|
org.opencontainers.image.source="https://github.com/Moduletrace/cobble" \
|
|
org.opencontainers.image.licenses="MIT"
|
|
|
|
# openssl generates the local CA and certificate the installer serves HTTPS
|
|
# with (`src/scripts/generate-local-certs.ts`).
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl bash nano wget zip unzip openssl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ENV NODE_ENV=production
|
|
# Everything that must survive an update lives on the /data volume:
|
|
# the database, media, computers' home directories
|
|
ENV DATA_DIR=/data
|
|
ENV DB_DIR=/data/db
|
|
ENV BUN_FEATURE_FLAG_DISABLE_STREAMING_INSTALL=1
|
|
|
|
WORKDIR /app
|
|
|
|
RUN echo 'alias ll="ls -laF"' >/root/.bashrc
|
|
|
|
COPY package.json bun.lock ./
|
|
# Local packages the lockfile installs from (`file:` dependencies)
|
|
COPY packages ./packages
|
|
RUN bun install --frozen-lockfile
|
|
|
|
COPY . /app/.
|
|
|
|
COPY entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD if [ -n "$TLS_CERT_FILE" ]; then curl -fsSk "https://localhost:${PORT:-7227}/api/health" || exit 1; else curl -fsS "http://localhost:${PORT:-7227}/api/health" || exit 1; fi
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|