tegwick
8be281025b
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
123 lines
4.8 KiB
Docker
123 lines
4.8 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
#
|
|
# Build:
|
|
# docker build \
|
|
# --secret id=forgejo_pypi_user,env=FORGEJO_PYPI_USER \
|
|
# --secret id=forgejo_pypi_password,env=FORGEJO_PYPI_TOKEN \
|
|
# -t forgejo.coulomb.social/coulomb/vergabe-teilnahme:<tag> .
|
|
#
|
|
# Optional secrets authenticate to the Forgejo Python package registry
|
|
# when resolving issue-core.
|
|
|
|
|
|
# ─── Stage 1 ─── Vite + Tailwind asset build ────────────────────────────────
|
|
FROM node:22-alpine AS assets
|
|
WORKDIR /build
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci --no-audit --no-fund
|
|
COPY vite.config.js ./
|
|
COPY static/src ./static/src
|
|
# Tailwind v4 scans these for utility-class usage at build time. They must be
|
|
# present or the generated CSS omits every utility class (broken layout, giant
|
|
# SVG icons). Paths mirror the @source directive in static/src/main.css.
|
|
COPY vergabe_teilnahme/templates ./vergabe_teilnahme/templates
|
|
RUN npm run build
|
|
# Output: /build/static/dist/main.css
|
|
|
|
|
|
# ─── Stage 2 ─── Python deps via uv ─────────────────────────────────────────
|
|
FROM python:3.12-slim-bookworm AS python-deps
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
UV_LINK_MODE=copy \
|
|
UV_PYTHON_DOWNLOADS=never
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential libpq-dev curl ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.5.11 /uv /usr/local/bin/uv
|
|
|
|
WORKDIR /app
|
|
COPY pyproject.toml uv.lock ./
|
|
RUN --mount=type=secret,id=forgejo_pypi_user,required=false \
|
|
--mount=type=secret,id=forgejo_pypi_password,required=false \
|
|
sh -eu -c '\
|
|
if [ -f /run/secrets/forgejo_pypi_user ]; then \
|
|
export UV_INDEX_FORGEJO_USERNAME="$(cat /run/secrets/forgejo_pypi_user)"; \
|
|
fi; \
|
|
if [ -f /run/secrets/forgejo_pypi_password ]; then \
|
|
export UV_INDEX_FORGEJO_PASSWORD="$(cat /run/secrets/forgejo_pypi_password)"; \
|
|
fi; \
|
|
uv sync --frozen --no-dev --no-install-project \
|
|
'
|
|
|
|
|
|
# Application acceptance gate. This stage is required by CI before publication;
|
|
# test tooling and test credentials are absent from the final runtime stage.
|
|
FROM python-deps AS application-tests
|
|
RUN --mount=type=secret,id=forgejo_pypi_user,required=false \
|
|
--mount=type=secret,id=forgejo_pypi_password,required=false \
|
|
sh -eu -c '\
|
|
if [ -f /run/secrets/forgejo_pypi_user ]; then \
|
|
export UV_INDEX_FORGEJO_USERNAME="$(cat /run/secrets/forgejo_pypi_user)"; \
|
|
fi; \
|
|
if [ -f /run/secrets/forgejo_pypi_password ]; then \
|
|
export UV_INDEX_FORGEJO_PASSWORD="$(cat /run/secrets/forgejo_pypi_password)"; \
|
|
fi; \
|
|
uv sync --frozen --no-install-project \
|
|
'
|
|
COPY manage.py conftest.py ./
|
|
COPY vergabe_teilnahme ./vergabe_teilnahme
|
|
COPY static ./static
|
|
COPY --from=assets /build/static/dist ./static/dist
|
|
ENV DATABASE_URL=sqlite:///:memory: \
|
|
SECRET_KEY=application-test-only \
|
|
DJANGO_SETTINGS_MODULE=vergabe_teilnahme.settings.dev
|
|
RUN .venv/bin/python manage.py collectstatic --noinput \
|
|
&& .venv/bin/python -m pytest \
|
|
&& .venv/bin/python manage.py makemigrations --check --dry-run
|
|
|
|
# ─── Stage 3 ─── Runtime image ──────────────────────────────────────────────
|
|
FROM python:3.12-slim-bookworm AS runtime
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
DJANGO_SETTINGS_MODULE=vergabe_teilnahme.settings.prod \
|
|
PATH=/app/.venv/bin:$PATH \
|
|
PORT=8000
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libpq5 curl ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd -r app && useradd -r -g app -d /app -s /sbin/nologin app
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=python-deps /app/.venv ./.venv
|
|
|
|
COPY --chown=app:app manage.py pyproject.toml ./
|
|
COPY --chown=app:app vergabe_teilnahme ./vergabe_teilnahme
|
|
COPY --chown=app:app static/src ./static/src
|
|
COPY --chown=app:app static/vendor ./static/vendor
|
|
COPY --from=assets --chown=app:app /build/static/dist ./static/dist
|
|
|
|
RUN mkdir -p ./media ./staticfiles ./.issue-facade && chown -R app:app /app
|
|
|
|
# collectstatic needs SECRET_KEY + ALLOWED_HOSTS but no DB; provide placeholders.
|
|
RUN SECRET_KEY=build-only ALLOWED_HOSTS=localhost \
|
|
python manage.py collectstatic --noinput
|
|
|
|
USER app
|
|
EXPOSE 8000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD curl -fsS http://127.0.0.1:8000/health/ || exit 1
|
|
|
|
CMD ["gunicorn", "vergabe_teilnahme.wsgi:application", \
|
|
"--bind", "0.0.0.0:8000", \
|
|
"--workers", "3", \
|
|
"--access-logfile", "-", \
|
|
"--access-logformat", "%(h)s %(m)s %(U)s %(s)s %(L)s", \
|
|
"--error-logfile", "-"]
|