init

2026-08-05 10:46:09 +02:00
parent 99fa56505a
commit d191b871de
44 changed files with 5155 additions and 1 deletions
@@ -0,0 +1,39 @@
+# Compatibility copy. The canonical Dockerfile is located in the repository root.
+# Build with the repository root as context:
+#   docker build -f deploy/Dockerfile .
+# syntax=docker/dockerfile:1
+
+ARG GO_VERSION=1.23
+ARG ALPINE_VERSION=3.21
+
+FROM golang:${GO_VERSION}-alpine AS build
+WORKDIR /src
+COPY go.mod ./
+RUN go mod download
+COPY cmd ./cmd
+COPY internal ./internal
+ARG VERSION=dev
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -trimpath \
+    -ldflags "-s -w -X main.version=${VERSION}" \
+    -o /out/gpo-server \
+    ./cmd/server
+
+FROM alpine:${ALPINE_VERSION} AS runtime
+RUN apk add --no-cache ca-certificates tzdata \
+    && addgroup -S -g 10001 gpo \
+    && adduser -S -D -H -u 10001 -G gpo gpo \
+    && install -d -o gpo -g gpo -m 0750 /data /data/.tmp /app
+COPY --from=build --chown=gpo:gpo /out/gpo-server /app/gpo-server
+ENV GPO_SERVER_LISTEN=:8443 GPO_SERVER_DATA=/data TMPDIR=/data/.tmp
+USER 10001:10001
+WORKDIR /app
+EXPOSE 8443
+VOLUME ["/data"]
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD if [ -n "${GPO_SERVER_TLS_CERT:-}" ]; then \
+        wget -q --no-check-certificate -O /dev/null https://127.0.0.1:8443/healthz; \
+      else \
+        wget -q -O /dev/null http://127.0.0.1:8443/healthz; \
+      fi
+ENTRYPOINT ["/app/gpo-server"]
@@ -0,0 +1,54 @@
+# Compatibility compose file. Prefer running ../compose.yml from the repository root.
+name: gpo-distributor
+
+services:
+  gpo-server:
+    image: "${GPO_SERVER_IMAGE:-gpo-distributor-server:0.2.1}"
+    build:
+      context: ..
+      dockerfile: Dockerfile
+      args:
+        VERSION: "${GPO_SERVER_VERSION:-0.2.1}"
+    restart: unless-stopped
+    init: true
+    stop_grace_period: 25s
+    environment:
+      GPO_SERVER_LISTEN: ":8443"
+      GPO_SERVER_DATA: "/data"
+      GPO_SERVER_ADMIN_TOKEN: "${GPO_SERVER_ADMIN_TOKEN:?Set GPO_SERVER_ADMIN_TOKEN in .env}"
+      GPO_SERVER_CLIENT_TOKEN: "${GPO_SERVER_CLIENT_TOKEN:?Set GPO_SERVER_CLIENT_TOKEN in .env}"
+      GPO_SERVER_SIGNING_KEY: "${GPO_SERVER_SIGNING_KEY:?Set GPO_SERVER_SIGNING_KEY in .env}"
+      GPO_SERVER_TLS_CERT: "${GPO_SERVER_TLS_CERT:-}"
+      GPO_SERVER_TLS_KEY: "${GPO_SERVER_TLS_KEY:-}"
+    command: ["-max-upload", "${GPO_SERVER_MAX_UPLOAD:-536870912}"]
+    ports:
+      - "${GPO_SERVER_BIND_ADDRESS:-0.0.0.0}:${GPO_SERVER_PORT:-8443}:8443"
+    volumes:
+      - gpo-data:/data
+      - ../tls:/tls:ro
+    read_only: true
+    cap_drop: [ALL]
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - >-
+          if [ -n "$${GPO_SERVER_TLS_CERT:-}" ]; then
+            wget -q --no-check-certificate -O /dev/null https://127.0.0.1:8443/healthz;
+          else
+            wget -q -O /dev/null http://127.0.0.1:8443/healthz;
+          fi
+      interval: 30s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "5"
+
+volumes:
+  gpo-data:
+    name: "${GPO_SERVER_DATA_VOLUME:-gpo-distributor-data}"
@@ -0,0 +1,21 @@
+[Unit]
+Description=GPO Distributor Server
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=gpo-distributor
+Group=gpo-distributor
+EnvironmentFile=/etc/gpo-distributor/server.env
+ExecStart=/usr/local/bin/gpo-server -listen :8443 -data /var/lib/gpo-distributor
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/gpo-distributor
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,5 @@
+GPO_SERVER_ADMIN_TOKEN=CHANGE-ME-LONG-RANDOM-ADMIN-TOKEN
+GPO_SERVER_CLIENT_TOKEN=CHANGE-ME-LONG-RANDOM-CLIENT-TOKEN
+GPO_SERVER_SIGNING_KEY=CHANGE-ME-LONG-RANDOM-SIGNING-KEY
+GPO_SERVER_TLS_CERT=/etc/gpo-distributor/tls/server.crt
+GPO_SERVER_TLS_KEY=/etc/gpo-distributor/tls/server.key