add gitea-CI docker builder

This commit is contained in:
Andrew Dolgov 2023-03-25 22:41:47 +03:00
parent d305532bce
commit 723323d746
No known key found for this signature in database
GPG Key ID: 1A56B4FA25D4AF2A
10 changed files with 512 additions and 0 deletions

79
.docker/app/Dockerfile Normal file
View File

@ -0,0 +1,79 @@
FROM registry.fakecake.org/alpine:3.17
EXPOSE 9000/tcp
ENV SCRIPT_ROOT=/opt/tt-rss
ENV SRC_DIR=/src/tt-rss/
COPY --from=app-src . ${SRC_DIR}
RUN apk add --no-cache dcron php81 php81-fpm php81-phar \
php81-pdo php81-gd php81-pgsql php81-pdo_pgsql php81-xmlwriter \
php81-mbstring php81-intl php81-xml php81-curl php81-simplexml \
php81-session php81-tokenizer php81-dom php81-fileinfo php81-ctype \
php81-json php81-iconv php81-pcntl php81-posix php81-zip php81-exif \
php81-openssl git postgresql-client sudo php81-pecl-xdebug rsync tzdata && \
sed -i 's/\(memory_limit =\) 128M/\1 256M/' /etc/php81/php.ini && \
sed -i -e 's/^listen = 127.0.0.1:9000/listen = 9000/' \
-e 's/;\(clear_env\) = .*/\1 = no/i' \
-e 's/^\(user\|group\) = .*/\1 = app/i' \
-e 's/;\(php_admin_value\[error_log\]\) = .*/\1 = \/tmp\/error.log/' \
-e 's/;\(php_admin_flag\[log_errors\]\) = .*/\1 = on/' \
/etc/php81/php-fpm.d/www.conf && \
mkdir -p /var/www ${SCRIPT_ROOT}/config.d
ADD --chmod=0755 startup.sh ${SCRIPT_ROOT}
ADD --chmod=0755 updater.sh ${SCRIPT_ROOT}
ADD --chmod=0755 dcron.sh ${SCRIPT_ROOT}
ADD --chmod=0755 backup.sh /etc/periodic/weekly/backup
ADD index.php ${SCRIPT_ROOT}
ADD config.docker.php ${SCRIPT_ROOT}
ARG ORIGIN_REPO_MAIN=https://git.tt-rss.org/fox/tt-rss.git
ARG ORIGIN_REPO_XACCEL=https://git.tt-rss.org/fox/ttrss-nginx-xaccel.git
ARG ORIGIN_COMMIT=
ENV ORIGIN_REPO_MAIN=${ORIGIN_REPO_MAIN}
ENV ORIGIN_REPO_XACCEL=${ORIGIN_REPO_XACCEL}
ENV ORIGIN_COMMIT=${ORIGIN_COMMIT}
ENV OWNER_UID=1000
ENV OWNER_GID=1000
ENV PHP_WORKER_MAX_CHILDREN=5
ENV PHP_WORKER_MEMORY_LIMIT=256M
# these are applied on every startup, if set
ENV ADMIN_USER_PASS=""
# see classes/UserHelper.php ACCESS_LEVEL_*
# setting this to -2 would effectively disable built-in admin user
# unless single user mode is enabled
ENV ADMIN_USER_ACCESS_LEVEL=""
# these are applied unless user already exists
ENV AUTO_CREATE_USER=""
ENV AUTO_CREATE_USER_PASS=""
ENV AUTO_CREATE_USER_ACCESS_LEVEL="0"
# TODO: remove prefix from container variables not used by tt-rss itself:
#
# - TTRSS_NO_STARTUP_PLUGIN_UPDATES -> NO_STARTUP_PLUGIN_UPDATES
# - TTRSS_XDEBUG_... -> XDEBUG_...
# don't try to update local plugins on startup
ENV TTRSS_NO_STARTUP_PLUGIN_UPDATES=""
# TTRSS_XDEBUG_HOST defaults to host IP if unset
ENV TTRSS_XDEBUG_ENABLED=""
ENV TTRSS_XDEBUG_HOST=""
ENV TTRSS_XDEBUG_PORT="9000"
ENV TTRSS_DB_TYPE="pgsql"
ENV TTRSS_DB_HOST="db"
ENV TTRSS_DB_PORT="5432"
ENV TTRSS_MYSQL_CHARSET="UTF8"
ENV TTRSS_PHP_EXECUTABLE="/usr/bin/php81"
ENV TTRSS_PLUGINS="auth_internal, note, nginx_xaccel"
CMD ${SCRIPT_ROOT}/startup.sh

31
.docker/app/backup.sh Normal file
View File

@ -0,0 +1,31 @@
#!/bin/sh -e
DST_DIR=/backups
KEEP_DAYS=28
APP_ROOT=/var/www/html/tt-rss
if pg_isready -h $TTRSS_DB_HOST -U $TTRSS_DB_USER; then
DST_FILE=ttrss-backup-$(date +%Y%m%d).sql.gz
echo backing up tt-rss database to $DST_DIR/$DST_FILE...
export PGPASSWORD=$TTRSS_DB_PASS
pg_dump --clean -h $TTRSS_DB_HOST -U $TTRSS_DB_USER $TTRSS_DB_NAME | gzip > $DST_DIR/$DST_FILE
DST_FILE=ttrss-backup-$(date +%Y%m%d).tar.gz
echo backing up tt-rss local directories to $DST_DIR/$DST_FILE...
tar -cz -f $DST_DIR/$DST_FILE $APP_ROOT/*.local \
$APP_ROOT/feed-icons/ \
$APP_ROOT/config.php
echo cleaning up...
find $DST_DIR -type f -name '*.gz' -mtime +$KEEP_DAYS -delete
echo done.
else
echo backup failed: database is not ready.
fi

View File

@ -0,0 +1,8 @@
<?php
$snippets = glob(getenv("SCRIPT_ROOT")."/config.d/*.php");
foreach ($snippets as $snippet) {
require_once $snippet;
}

5
.docker/app/dcron.sh Normal file
View File

@ -0,0 +1,5 @@
#!/bin/sh
# https://github.com/dubiousjim/dcron/issues/13
set -e
/usr/sbin/crond "$@"

3
.docker/app/index.php Normal file
View File

@ -0,0 +1,3 @@
<?php
header("Location: /tt-rss/");
return;

153
.docker/app/startup.sh Normal file
View File

@ -0,0 +1,153 @@
#!/bin/sh -e
while ! pg_isready -h $TTRSS_DB_HOST -U $TTRSS_DB_USER; do
echo waiting until $TTRSS_DB_HOST is ready...
sleep 3
done
# We don't need those here (HTTP_HOST would cause false SELF_URL_PATH check failures)
unset HTTP_PORT
unset HTTP_HOST
if ! id app >/dev/null 2>&1; then
addgroup -g $OWNER_GID app
adduser -D -h /var/www/html -G app -u $OWNER_UID app
fi
update-ca-certificates || true
DST_DIR=/var/www/html/tt-rss
[ -e $DST_DIR ] && rm -f $DST_DIR/.app_is_ready
export PGPASSWORD=$TTRSS_DB_PASS
[ ! -e /var/www/html/index.php ] && cp ${SCRIPT_ROOT}/index.php /var/www/html
if [ ! -d $DST_DIR ]; then
mkdir -p $DST_DIR
chown $OWNER_UID:$OWNER_GID $DST_DIR
sudo -u app rsync -a \
$SRC_DIR/ $DST_DIR/
else
chown -R $OWNER_UID:$OWNER_GID $DST_DIR
sudo -u app rsync -a --delete \
--exclude /cache \
--exclude /lock \
--exclude /feed-icons \
--exclude /plugins/af_comics/filters.local \
--exclude /plugins.local \
--exclude /templates.local \
--exclude /themes.local \
$SRC_DIR/ $DST_DIR/
sudo -u app rsync -a --delete \
$SRC_DIR/plugins.local/nginx_xaccel \
$DST_DIR/plugins.local/nginx_xaccel
fi
for d in cache lock feed-icons plugins.local themes.local; do
sudo -u app mkdir -p $DST_DIR/$d
done
for d in cache lock feed-icons; do
chmod 777 $DST_DIR/$d
find $DST_DIR/$d -type f -exec chmod 666 {} \;
done
sudo -u app cp ${SCRIPT_ROOT}/config.docker.php $DST_DIR/config.php
chmod 644 $DST_DIR/config.php
chown -R $OWNER_UID:$OWNER_GID $DST_DIR \
/var/log/php81
if [ -z "$TTRSS_NO_STARTUP_PLUGIN_UPDATES" ]; then
echo updating all local plugins...
find $DST_DIR/plugins.local -mindepth 1 -maxdepth 1 -type d | while read PLUGIN; do
if [ -d $PLUGIN/.git ]; then
echo updating $PLUGIN...
cd $PLUGIN && \
sudo -u app git config core.filemode false && \
sudo -u app git config pull.rebase false && \
sudo -u app git pull origin master || echo warning: attempt to update plugin $PLUGIN failed.
fi
done
else
echo skipping local plugin updates, disabled.
fi
PSQL="psql -q -h $TTRSS_DB_HOST -U $TTRSS_DB_USER $TTRSS_DB_NAME"
$PSQL -c "create extension if not exists pg_trgm"
RESTORE_SCHEMA=${SCRIPT_ROOT}/restore-schema.sql.gz
if [ -r $RESTORE_SCHEMA ]; then
$PSQL -c "drop schema public cascade; create schema public;"
zcat $RESTORE_SCHEMA | $PSQL
fi
# this was previously generated
rm -f $DST_DIR/config.php.bak
if [ ! -z "${TTRSS_XDEBUG_ENABLED}" ]; then
if [ -z "${TTRSS_XDEBUG_HOST}" ]; then
export TTRSS_XDEBUG_HOST=$(ip ro sh 0/0 | cut -d " " -f 3)
fi
echo enabling xdebug with the following parameters:
env | grep TTRSS_XDEBUG
cat > /etc/php81/conf.d/50_xdebug.ini <<EOF
zend_extension=xdebug.so
xdebug.mode=develop,trace,debug
xdebug.start_with_request = yes
xdebug.client_port = ${TTRSS_XDEBUG_PORT}
xdebug.client_host = ${TTRSS_XDEBUG_HOST}
EOF
fi
sed -i.bak "s/^\(memory_limit\) = \(.*\)/\1 = ${PHP_WORKER_MEMORY_LIMIT}/" \
/etc/php81/php.ini
sed -i.bak "s/^\(pm.max_children\) = \(.*\)/\1 = ${PHP_WORKER_MAX_CHILDREN}/" \
/etc/php81/php-fpm.d/www.conf
sudo -Eu app php81 $DST_DIR/update.php --update-schema=force-yes
if [ ! -z "$ADMIN_USER_PASS" ]; then
sudo -Eu app php81 $DST_DIR/update.php --user-set-password "admin:$ADMIN_USER_PASS"
else
if sudo -Eu app php81 $DST_DIR/update.php --user-check-password "admin:password"; then
RANDOM_PASS=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 16 ; echo '')
echo "*****************************************************************************"
echo "* Setting initial built-in admin user password to '$RANDOM_PASS' *"
echo "* If you want to set it manually, use ADMIN_USER_PASS environment variable. *"
echo "*****************************************************************************"
sudo -Eu app php81 $DST_DIR/update.php --user-set-password "admin:$RANDOM_PASS"
fi
fi
if [ ! -z "$ADMIN_USER_ACCESS_LEVEL" ]; then
sudo -Eu app php81 $DST_DIR/update.php --user-set-access-level "admin:$ADMIN_USER_ACCESS_LEVEL"
fi
if [ ! -z "$AUTO_CREATE_USER" ]; then
sudo -Eu app /bin/sh -c "php81 $DST_DIR/update.php --user-exists $AUTO_CREATE_USER ||
php81 $DST_DIR/update.php --force-yes --user-add \"$AUTO_CREATE_USER:$AUTO_CREATE_USER_PASS:$AUTO_CREATE_USER_ACCESS_LEVEL\""
fi
rm -f /tmp/error.log && mkfifo /tmp/error.log && chown app:app /tmp/error.log
(tail -q -f /tmp/error.log >> /proc/1/fd/2) &
unset ADMIN_USER_PASS
unset AUTO_CREATE_USER_PASS
touch $DST_DIR/.app_is_ready
exec /usr/sbin/php-fpm81 --nodaemonize --force-stderr

33
.docker/app/updater.sh Normal file
View File

@ -0,0 +1,33 @@
#!/bin/sh -e
# We don't need those here (HTTP_HOST would cause false SELF_URL_PATH check failures)
unset HTTP_PORT
unset HTTP_HOST
unset ADMIN_USER_PASS
unset AUTO_CREATE_USER_PASS
# wait for the app container to delete .app_is_ready and perform rsync, etc.
sleep 30
if ! id app; then
addgroup -g $OWNER_GID app
adduser -D -h /var/www/html -G app -u $OWNER_UID app
fi
while ! pg_isready -h $TTRSS_DB_HOST -U $TTRSS_DB_USER; do
echo waiting until $TTRSS_DB_HOST is ready...
sleep 3
done
sed -i.bak "s/^\(memory_limit\) = \(.*\)/\1 = ${PHP_WORKER_MEMORY_LIMIT}/" \
/etc/php81/php.ini
DST_DIR=/var/www/html/tt-rss
while [ ! -s $DST_DIR/config.php -a -e $DST_DIR/.app_is_ready ]; do
echo waiting for app container...
sleep 3
done
sudo -E -u app /usr/bin/php81 /var/www/html/tt-rss/update_daemon2.php

View File

@ -0,0 +1,15 @@
FROM registry.fakecake.org/nginx:alpine
HEALTHCHECK CMD curl --fail http://localhost/tt-rss/index.php || exit 1
COPY nginx.conf /etc/nginx/templates/nginx.conf.template
# By default, nginx will send the php requests to "app" server, but this server
# name can be overridden at runtime by passing an APP_UPSTREAM env var
ENV APP_UPSTREAM=${APP_UPSTREAM:-app}
# It's necessary to set the following NGINX_ENVSUBST_OUTPUT_DIR env var to tell
# nginx to replace the env vars of /etc/nginx/templates/nginx.conf.template
# and put the result in /etc/nginx/nginx.conf (instead of /etc/nginx/conf.d/nginx.conf)
# See https://github.com/docker-library/docs/tree/master/nginx#using-environment-variables-in-nginx-configuration-new-in-119
ENV NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx

View File

@ -0,0 +1,61 @@
worker_processes auto;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
access_log /dev/stdout;
error_log /dev/stderr warn;
sendfile on;
index index.php;
upstream app {
server ${APP_UPSTREAM}:9000;
}
server {
listen 80;
listen [::]:80;
root /var/www/html;
location /tt-rss/cache {
aio threads;
internal;
}
location /tt-rss/backups {
internal;
}
location ~ \.php$ {
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
# Check that the PHP script exists before passing it
try_files $fastcgi_script_name =404;
# Bypass the fact that try_files resets $fastcgi_path_info
# see: http://trac.nginx.org/nginx/ticket/321
set $path_info $fastcgi_path_info;
fastcgi_param PATH_INFO $path_info;
fastcgi_index index.php;
include fastcgi.conf;
fastcgi_pass app;
}
location / {
try_files $uri $uri/ =404;
}
}
}

124
.gitea/workflows/build.yml Normal file
View File

@ -0,0 +1,124 @@
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: build
on:
push:
branches:
- "master"
workflow_dispatch: {}
defaults:
run:
shell: sh
jobs:
build:
runs-on: alpine-3.16
steps:
- uses: https://gitea.com/actions/checkout@v3
- name: npm install
run: npm install
- name: eslint
run: npx eslint js plugins
- name: phpunit
run: php81 ./vendor/bin/phpunit
- name: calculate cache key hash
uses: actions/go-hashfiles@v0.0.1
id: cache-hash
with:
patterns: |
classes/*.php
include/*.php
plugins/**/*.php
- uses: https://github.com/actions/cache/restore@v3
id: cache-phpstan
with:
path: /tmp/phpstan
key: ${{ runner.os }}-phpstan-${{ steps.cache-hash.outputs.hash }}
- name: phpstan
run: php81 -d memory_limit=-1 ./vendor/bin/phpstan --memory-limit=2G
- uses: https://github.com/actions/cache/save@v3
with:
path: /tmp/phpstan
key: ${{ steps.cache-phpstan.outputs.cache-primary-key }}
- run: echo REPO_TIMESTAMP=$(git --git-dir '.git' --no-pager log --pretty='%ct' -n1 HEAD) >> $GITHUB_ENV
- run: echo REPO_COMMIT=$(git --git-dir '.git' --no-pager log --pretty='%h' -n1 HEAD) >> $GITHUB_ENV
- run: echo REPO_COMMIT_FULL=$(git --git-dir '.git' --no-pager log --pretty='%H' -n1 HEAD) >> $GITHUB_ENV
- run: echo BUILD_TAG=$(date -d @${REPO_TIMESTAMP} +%y.%m)-${REPO_COMMIT} >> $GITHUB_ENV
- name: setup buildx
uses: https://github.com/docker/setup-buildx-action@v2
- name: login into registry
run: |
BASE64_AUTH=`echo -n "$REGISTRY_USER:$REGISTRY_PASSWORD" | base64`
mkdir -p ~/.docker
echo "{\"auths\": {\"registry-rw.fakecake.org\": {\"auth\": \"$BASE64_AUTH\"}}}" > ~/.docker/config.json
env:
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
if: ${{ !!secrets.REGISTRY_PUSH_ENABLED }}
- name: build web-nginx image
uses: https://github.com/docker/build-push-action@v4
with:
push: ${{ !!secrets.REGISTRY_PUSH_ENABLED }}
context: .docker/web-nginx
tags: |
registry-rw.fakecake.org/cthulhoo/ttrss-web-nginx:latest
registry-rw.fakecake.org/cthulhoo/ttrss-web-nginx:${{ env.BUILD_TAG }}
provenance: false
- name: build app image
uses: https://github.com/docker/build-push-action@v4
with:
push: ${{ !!secrets.REGISTRY_PUSH_ENABLED }}
context: .docker/app
build-contexts:
app-src=.
tags: |
registry-rw.fakecake.org/cthulhoo/ttrss-fpm-pgsql-static:latest
registry-rw.fakecake.org/cthulhoo/ttrss-fpm-pgsql-static:${{ env.BUILD_TAG }}
provenance: false
- name: login into docker hub
run: |
BASE64_AUTH=`echo -n "$REGISTRY_USER:$REGISTRY_PASSWORD" | base64`
mkdir -p ~/.docker
echo "{\"auths\": {\"$REGISTRY_HOST\": {\"auth\": \"$BASE64_AUTH\"}}}" > ~/.docker/config.json
env:
REGISTRY_USER: ${{ secrets.REGISTRY_GITHUB_USER }}
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_GITHUB_ACCESS_TOKEN }}
REGISTRY_HOST: https://index.docker.io/v1/
if: ${{ !!secrets.REGISTRY_GITHUB_PUSH_ENABLED }}
- name: build web-nginx image
uses: https://github.com/docker/build-push-action@v4
with:
push: ${{ !!secrets.REGISTRY_GITHUB_PUSH_ENABLED }}
context: .docker/web-nginx
tags: |
cthulhoo/ttrss-web-nginx:latest
cthulhoo/ttrss-web-nginx:${{ env.BUILD_TAG }}
provenance: false
- name: build app image
uses: https://github.com/docker/build-push-action@v4
with:
push: ${{ !!secrets.REGISTRY_GITHUB_PUSH_ENABLED }}
context: .docker/app
build-contexts:
app-src=.
tags: |
cthulhoo/ttrss-fpm-pgsql-static:latest
cthulhoo/ttrss-fpm-pgsql-static:${{ env.BUILD_TAG }}
provenance: false