jschoubben
facd41806d
gitea, umami, influxdb, icecast and mailu require a secret and keep each of theirs under a local name (novox/hq ADR 0094); the broker account stays their own. The route proxy's recipe starts FROM the bases its manifest declares (ADR 0097).
28 lines
1.4 KiB
Docker
28 lines
1.4 KiB
Docker
ARG ALPINE_BASE=alpine:3.20
|
|
ARG GO_BASE=golang:1.25
|
|
# The route-proxy module's runtime image: the reference reverse proxy compiled into a container.
|
|
#
|
|
# **The proxy source is not vendored here.** The canonical proxy — the contract written as something
|
|
# that runs — lives in the mesh-controller repository at examples/route-proxy (novox/hq 08-connectivity
|
|
# §3). This module ships the *packaging*, not a second copy of the contract, so the build context is
|
|
# the mesh-controller repository root, and this Dockerfile compiles ./examples/route-proxy from it.
|
|
#
|
|
# docker build -f mesh-catalog/modules/route-proxy/Dockerfile \
|
|
# -t mesh-route-proxy:development <path-to>/mesh-controller
|
|
#
|
|
# The mesh pins the digest of what this produces; the committed module.json carries the placeholder
|
|
# digest every mesh-built image does, replaced at publish.
|
|
FROM ${GO_BASE} AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /mesh-route-proxy ./examples/route-proxy
|
|
|
|
# A small runtime with the public CA roots the ACME client needs to reach a real authority, and run
|
|
# as root so it can bind :80 and :443 — the two privileged ports a public front door listens on.
|
|
FROM ${ALPINE_BASE}
|
|
RUN apk add --no-cache ca-certificates
|
|
COPY --from=build /mesh-route-proxy /usr/local/bin/mesh-route-proxy
|
|
ENTRYPOINT ["/usr/local/bin/mesh-route-proxy"]
|