Paul Nothaft
0205c7dcce
Repo transferred from the-luap/picpeak → PicPeak/picpeak. Docker images
publish to ghcr.io/picpeak/picpeak/{backend,frontend} (lowercase, per the
GHCR canonical form computed by docker-build.yml's `${GITHUB_REPOSITORY,,}`).
Sweep covers:
- docker-compose.production.yml + Dockerfiles → new image registry path
- README, CONTRIBUTING, SECURITY, SIMPLE_SETUP, scripts/picpeak-setup.sh
→ new GitHub URLs
- Update-check / release-notes services (updateCheckService,
environmentService, updateNotificationService, adminSystem,
UpdateNotification, githubReleaseUrl) → GitHub API + tag URLs use the
canonical PicPeak/picpeak path
- Issue templates + README-DOCKER + workflow README → updated package URLs
- One commit-context comment in migrations/090 + customerAccountsService
CHANGELOG.md is intentionally untouched (historical release entries are
immutable; GitHub auto-redirects the old URLs indefinitely).
CLAUDE.md keeps the bare `(the-luap)` reference — that's the maintainer's
personal handle, not a repo URL.
22 files, 48/48 line swaps (every change is a 1:1 URL replacement).
83 lines
2.5 KiB
Docker
83 lines
2.5 KiB
Docker
# Build stage
|
|
FROM node:20-alpine AS builder
|
|
|
|
# Add build arguments
|
|
ARG CACHEBUST=1
|
|
ARG BUILD_DATE
|
|
ARG VCS_REF
|
|
ARG VERSION
|
|
|
|
# Add labels for GitHub Container Registry
|
|
LABEL org.opencontainers.image.source="https://github.com/PicPeak/picpeak"
|
|
LABEL org.opencontainers.image.description="PicPeak Frontend Application"
|
|
LABEL org.opencontainers.image.licenses="MIT"
|
|
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
# Copy package files
|
|
COPY package*.json ./
|
|
|
|
# Install dependencies
|
|
RUN npm ci --legacy-peer-deps
|
|
|
|
# Copy source files
|
|
COPY . .
|
|
|
|
# Build the application
|
|
RUN npm run build
|
|
|
|
# Production stage (Alpine 3.23 with OpenSSL 3.5.5, patched libexpat)
|
|
FROM nginx:1.28-alpine
|
|
|
|
# Upgrade all packages to fix security vulnerabilities (OpenSSL, libexpat, BusyBox CVEs)
|
|
RUN apk upgrade --no-cache
|
|
|
|
# Install runtime dependencies. `gettext` provides envsubst, used by
|
|
# docker-entrypoint.sh for the BRAND_TITLE / BRAND_DESCRIPTION runtime
|
|
# substitution into index.html (#521 — runtime fix for self-hosters
|
|
# on the pre-built GHCR image who can't override at build time).
|
|
RUN apk add --no-cache curl gettext
|
|
|
|
# Remove default nginx config
|
|
RUN rm -rf /etc/nginx/conf.d/*
|
|
|
|
# Copy custom nginx config
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
|
|
# Copy built application from builder stage
|
|
COPY --from=builder /app/dist /usr/share/nginx/html
|
|
|
|
# Snapshot index.html as a template so the entrypoint always renders
|
|
# from a known-good source — not from its own previous substitution.
|
|
# Container restarts can change BRAND_TITLE freely; the rendered file
|
|
# is recomputed from the .tpl each time.
|
|
RUN mv /usr/share/nginx/html/index.html /usr/share/nginx/html/index.html.tpl
|
|
|
|
# Runtime entrypoint that envsubsts the template and execs nginx
|
|
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
|
|
|
# Set permissions (nginx user already exists in nginx:alpine)
|
|
RUN chown -R nginx:nginx /usr/share/nginx/html && \
|
|
chown -R nginx:nginx /var/cache/nginx && \
|
|
chown -R nginx:nginx /var/log/nginx && \
|
|
touch /var/run/nginx.pid && \
|
|
chown -R nginx:nginx /var/run/nginx.pid
|
|
|
|
# Expose port
|
|
EXPOSE 80
|
|
|
|
# Health check
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
|
|
CMD curl -f http://localhost/health || exit 1
|
|
|
|
# Switch to non-root user
|
|
USER nginx
|
|
|
|
# Start nginx via the entrypoint so each container start re-renders
|
|
# index.html from the template against the current BRAND_TITLE /
|
|
# BRAND_DESCRIPTION env vars (defaults applied when unset).
|
|
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|
|
CMD ["nginx", "-g", "daemon off;"]
|