add docker files

This commit is contained in:
c0mmando 2023-05-26 21:33:50 +00:00
parent b422905c91
commit 62218af0bd
7 changed files with 411 additions and 0 deletions

View File

@ -0,0 +1,53 @@
FROM node:14.17.5-alpine AS builder
LABEL maintainer="Andreas Peters <support@aventer.biz>"
#Upstream URL: https://git.aventer.biz/AVENTER/docker-matrix-dimension
WORKDIR /home/node/matrix-dimension
RUN mkdir -p /home/node/matrix-dimension
RUN apk --no-cache add python2 glib-dev make g++ vips-dev libc-dev
COPY . /home/node/matrix-dimension
RUN chown -R node /home/node/matrix-dimension
USER node
ENV CPATH=/usr/include/glib-2.0:/usr/lib/glib-2.0/include/
RUN npm clean-install && \
node /home/node/matrix-dimension/scripts/convert-newlines.js /home/node/matrix-dimension/docker-entrypoint.sh && \
NODE_ENV=production npm run-script build
FROM node:14.17.5-alpine
WORKDIR /home/node/matrix-dimension
COPY --from=builder /home/node/matrix-dimension/docker-entrypoint.sh /
COPY --from=builder /home/node/matrix-dimension/build /home/node/matrix-dimension/build
COPY --from=builder /home/node/matrix-dimension/package* /home/node/matrix-dimension/
COPY --from=builder /home/node/matrix-dimension/config /home/node/matrix-dimension/config
RUN chown -R node /home/node/matrix-dimension
RUN mkdir /data && chown -R node /data
RUN apk --no-cache add python2 glib-dev make g++ vips-dev libc-dev
ENV CPATH=/usr/include/glib-2.0:/usr/lib/glib-2.0/include/
USER node
RUN npm clean-install --production
VOLUME ["/data"]
# Ensure the database doesn't get lost to the container
ENV DIMENSION_DB_PATH=/data/dimension.db
EXPOSE 8184
# CMD ["/bin/sh"]
ENTRYPOINT ["/docker-entrypoint.sh"]

18
images/mjolnir/Dockerfile Normal file
View File

@ -0,0 +1,18 @@
# We can't use alpine anymore because crypto has rust deps.
FROM node:16-slim
COPY . /tmp/src
RUN cd /tmp/src \
&& yarn install \
&& yarn build \
&& mv lib/ /mjolnir/ \
&& mv node_modules / \
&& mv mjolnir-entrypoint.sh / \
&& cd / \
&& rm -rf /tmp/*
ENV NODE_ENV=production
ENV NODE_CONFIG_DIR=/data/config
CMD ["bot"]
ENTRYPOINT ["./mjolnir-entrypoint.sh"]
VOLUME ["/data"]

View File

@ -0,0 +1,27 @@
FROM python:3.8-slim-buster AS builder
RUN mkdir -p /app
RUN apt-get update && apt-get install -y git gcc clang cmake g++ pkg-config python3-dev wget
WORKDIR /app
RUN wget https://gitlab.matrix.org/matrix-org/olm/-/archive/master/olm-master.tar.bz2 \
&& tar -xvf olm-master.tar.bz2 \
&& cd olm-master && make && make PREFIX="/usr" install
RUN pip --no-cache-dir install --upgrade pip setuptools wheel
COPY . /app
RUN pip wheel . --wheel-dir /wheels --find-links /wheels
FROM python:3.8-slim-buster AS run
COPY --from=builder /usr/lib/libolm* /usr/lib/
COPY --from=builder /wheels /wheels
WORKDIR /app
RUN pip --no-cache-dir install --find-links /wheels --no-index pantalaimon
VOLUME /data
ENTRYPOINT ["pantalaimon"]
CMD ["-c", "/data/pantalaimon.conf", "--data-path", "/data"]

View File

@ -0,0 +1,31 @@
ARG PYTHON_VERSION=3.8
FROM docker.io/python:${PYTHON_VERSION} as base
WORKDIR /app
FROM base as builder
ENV POETRY_VERSION=1.2.2
RUN pip install "poetry==$POETRY_VERSION"
RUN python -m venv /venv
COPY pyproject.toml poetry.lock config.sample.yaml matrix_registration ./
RUN . /venv/bin/activate && poetry install --no-dev --no-root
COPY . .
RUN . /venv/bin/activate && poetry build
# Runtime
FROM base as final
COPY --from=builder /venv /venv
COPY --from=builder /app/dist .
RUN . /venv/bin/activate && pip install *.whl
VOLUME ["/data"]
EXPOSE 5000/tcp
ENTRYPOINT ["/venv/bin/matrix-registration", "--config-path=/data/config.yaml"]

View File

@ -0,0 +1,46 @@
server_location: 'http://synapse:8008'
server_name: 'hackliberty.org'
shared_secret: 'REDACTED'
admin_api_shared_secret: 'REDACTED' # to generate tokens via the web api
base_url: '' # e.g. '/element' for https://example.tld/element/register
client_redirect: 'https://element.hackliberty.org'
riot_instace: 'https://element.hackliberty.org'
#riot_instance: 'https://riot.im/app/'
db: 'sqlite:////data/db.sqlite3'
host: '0.0.0.0'
port: 5000
rate_limit: ["10000 per day", "100 per minute"]
allow_cors: false
ip_logging: false
logging:
disable_existing_loggers: False
version: 1
root:
level: DEBUG
handlers: [console, file]
formatters:
brief:
format: '%(name)s - %(levelname)s - %(message)s'
precise:
format: '%(asctime)s - %(name)s - %(levelname)s - %(message)s'
handlers:
console:
class: logging.StreamHandler
level: INFO
formatter: brief
stream: ext://sys.stdout
file:
class: logging.handlers.RotatingFileHandler
formatter: precise
level: INFO
filename: m_reg.log
maxBytes: 10485760 # 10MB
backupCount: 3
encoding: utf8
# password requirements
password:
min_length: 14
# username requirements
username:
validation_regex: [ '[a-zA-Z0-9]' ]
invalidation_regex: [ '(info|admin|null|123456|mail|fuck|webmaster|root|test|guest|adm|mysql|user|administrator|oracle|ftp|pi|puppet|ansible|ec2-user|vagrant|azureuse|mod|moderator|host|postgres|synapse|support)' ]

View File

@ -0,0 +1,86 @@
ARG SYNAPSE_VERSION=1.83
ARG HARDENED_MALLOC_VERSION=11
ARG UID=991
ARG GID=991
### Build Hardened Malloc
FROM alpine:latest as build-malloc
ARG HARDENED_MALLOC_VERSION
ARG CONFIG_NATIVE=false
ARG VARIANT=default
RUN apk --no-cache add build-base git gnupg && cd /tmp \
&& wget -q https://github.com/thestinger.gpg && gpg --import thestinger.gpg \
&& git clone --depth 1 --branch ${HARDENED_MALLOC_VERSION} https://github.com/GrapheneOS/hardened_malloc \
&& cd hardened_malloc && git verify-tag $(git describe --tags) \
&& make CONFIG_NATIVE=${CONFIG_NATIVE} VARIANT=${VARIANT}
### Build Synapse
FROM python:alpine as builder
ARG SYNAPSE_VERSION
RUN apk -U upgrade \
&& apk --force-overwrite add -t build-deps \
build-base \
libffi-dev \
libjpeg-turbo-dev \
libxslt-dev \
linux-headers \
postgresql-dev \
rustup \
zlib-dev \
libressl-dev \
&& rustup-init -y && source $HOME/.cargo/env \
&& pip install --upgrade pip \
&& pip install --prefix="/install" --no-warn-script-location \
matrix-synapse[all]==${SYNAPSE_VERSION}
### Build Production
FROM python:alpine
ARG UID
ARG GID
RUN apk -U upgrade \
&& apk add -t run-deps \
libffi \
libgcc \
libjpeg-turbo \
libressl \
libstdc++ \
libxslt \
libpq \
zlib \
tzdata \
xmlsec \
git \
curl \
icu-libs \
&& adduser -g ${GID} -u ${UID} --disabled-password --gecos "" synapse \
&& rm -rf /var/cache/apk/*
RUN pip install --upgrade pip \
&& pip install -e "git+https://github.com/matrix-org/mjolnir.git#egg=mjolnir&subdirectory=synapse_antispam"
COPY --from=build-malloc /tmp/hardened_malloc/out/libhardened_malloc.so /usr/local/lib/
COPY --from=builder /install /usr/local
COPY --chown=synapse:synapse rootfs /
ENV LD_PRELOAD="/usr/local/lib/libhardened_malloc.so"
USER synapse
VOLUME /data
EXPOSE 8008/tcp 8009/tcp 8448/tcp
ENTRYPOINT ["python3", "start.py"]
HEALTHCHECK --start-period=5s --interval=15s --timeout=5s \
CMD curl -fSs http://localhost:8008/health || exit 1

View File

@ -0,0 +1,150 @@
ARG SYNAPSE_VERSION=1.83
ARG HARDENED_MALLOC_VERSION=11
ARG UID=991
ARG GID=991
### Build Hardened Malloc
FROM alpine:latest as build-malloc
ARG HARDENED_MALLOC_VERSION
ARG CONFIG_NATIVE=false
ARG VARIANT=default
RUN apk --no-cache add build-base git gnupg && cd /tmp \
&& wget -q https://github.com/thestinger.gpg && gpg --import thestinger.gpg \
&& git clone --depth 1 --branch ${HARDENED_MALLOC_VERSION} https://github.com/GrapheneOS/hardened_malloc \
&& cd hardened_malloc && git verify-tag $(git describe --tags) \
&& make CONFIG_NATIVE=${CONFIG_NATIVE} VARIANT=${VARIANT}
### Nginx & Redis
FROM alpine:latest as deps_base
RUN apk --no-cache add nginx redis
### Redis Base
FROM redis:6-alpine AS redis_base
### Build Synapse
FROM python:alpine as builder
ARG SYNAPSE_VERSION
RUN apk -U upgrade \
&& apk --force-overwrite add -t build-deps \
build-base \
libffi-dev \
libjpeg-turbo-dev \
libxslt-dev \
linux-headers \
postgresql-dev \
rustup \
zlib-dev \
libressl-dev \
pcre-dev \
pcre \
jemalloc-dev \
&& rustup-init -y && source $HOME/.cargo/env \
&& pip install --upgrade pip \
&& pip install --prefix="/install" --no-warn-script-location \
matrix-synapse[all]==${SYNAPSE_VERSION}
### Build Production
FROM python:alpine
ARG UID
ARG GID
RUN apk -U upgrade \
&& apk add -t run-deps \
libffi \
libgcc \
libjpeg-turbo \
libressl \
libstdc++ \
libxslt \
libpq \
zlib \
tzdata \
xmlsec \
git \
curl \
icu-libs \
pcre-dev \
pcre \
jemalloc-dev \
&& adduser -g ${GID} -u ${UID} --disabled-password --gecos "" synapse \
&& rm -rf /var/cache/apk/*
RUN set -x ; \
addgroup -g 82 -S www-data ; \
adduser -u 82 -D -S -G www-data www-data && exit 0 ; exit 1
RUN pip install --upgrade pip \
&& pip install -e "git+https://github.com/matrix-org/mjolnir.git#egg=mjolnir&subdirectory=synapse_antispam"
RUN --mount=type=cache,target=/root/.cache/pip \
pip install supervisor~=4.2
#RUN mkdir -p /etc/supervisor/conf.d
RUN pip install Jinja2
RUN mkdir /var/log/nginx /var/lib/nginx
COPY --from=deps_base /usr/sbin/nginx /usr/sbin
COPY --from=deps_base /usr/share/nginx /usr/share/nginx
COPY --from=deps_base /usr/lib/nginx /usr/lib/nginx
COPY --from=deps_base /etc/nginx /etc/nginx
RUN chown -R 991:www-data /var/lib/nginx
RUN mkdir /var/lib/nginx/logs/
RUN chown 991:www-data /var/lib/nginx/logs/
RUN ln -sf /dev/stdout /var/log/nginx/access.log
RUN ln -sf /dev/stderr /var/log/nginx/error.log
COPY --from=build-malloc /tmp/hardened_malloc/out/libhardened_malloc.so /usr/local/lib/
COPY --from=builder /install /usr/local
COPY --chown=synapse:synapse ./rootfs /
COPY --from=redis_base /usr/local/bin/redis-server /usr/local/bin
COPY --chown=synapse:synapse ./rootfs/start.py /start.py
COPY --chown=synapse:synapse ./rootfs/conf-workers/* /conf/
COPY --chown=synapse:synapse ./rootfs/configure_workers_and_start.py /configure_workers_and_start.py
COPY ./prefix-log /usr/local/bin/
RUN chown -R synapse:synapse /conf/
RUN chown -R synapse:www-data /etc/nginx
RUN chown synapse:synapse /usr/local/lib/libhardened_malloc.so
RUN mkdir -p /etc/supervisor/conf.d
RUN mkdir -p /etc/nginx/conf.d
RUN chown -R synapse:www-data /etc/nginx
RUN mkdir -p /health/
RUN chown -R synapse:synapse /health/
RUN chown -R synapse:synapse /etc/supervisor
RUN chmod +x /usr/local/bin/prefix-log
RUN chmod 755 /start.py
RUN chown synapse:synapse /
ENV LD_PRELOAD="/usr/local/lib/libhardened_malloc.so"
USER synapse
VOLUME /data
EXPOSE 8008/tcp
ENTRYPOINT ["/configure_workers_and_start.py"]
#CMD ["python3", "/configure_workers_and_start.py"]
HEALTHCHECK --start-period=5s --interval=15s --timeout=5s \
CMD /bin/sh /healthcheck.sh