diff --git a/.gitea/workflows/build-and-push.yaml b/.gitea/workflows/build-and-push.yaml index 6391ffe..8b50a83 100644 --- a/.gitea/workflows/build-and-push.yaml +++ b/.gitea/workflows/build-and-push.yaml @@ -1,7 +1,18 @@ on: push: branches: - - 'main' + - 'dev' + paths-ignore: + - 'README.md' + - 'Dockerfile*' + - 'packages.txt' + - 'VERSION.history' + - 'docker-compose.yml' + - 'buildargs.env' + - 'entrypoint.sh' + - '*.md' + - '.gitignore' + - '.gitea/workflows/build-and-push.yaml' tags: - '*' schedule: @@ -27,33 +38,34 @@ jobs: id: prep run: | export TZ=Europe/Berlin - - # FIX 1: Stellt sicher, dass die Datei mit einem Zeilenumbruch endet. - # Das verhindert, dass Bash die letzte Zeile beim Einlesen verschluckt. sed -i -e '$a\' buildargs.env - set -a source <(grep -v '^#' buildargs.env | sed 's/\r$//') set +a - + echo "push_targets=$PUSH" >> $GITHUB_OUTPUT ARGS_HASH=$(grep "^BUILD_" buildargs.env | sha256sum | cut -d' ' -f1) echo "build_args_hash=$ARGS_HASH" >> $GITHUB_OUTPUT echo "event_name=${{ gitea.event_name }}" >> $GITHUB_OUTPUT - - # FIX 2: Kugelsicheres Auslesen des Tags direkt aus der Datei. - # Trimm-Befehle (tr) entfernen eventuelle unsichtbare Zeichen oder Anführungszeichen. - SAFE_BUILD_TAG=$(grep "^BUILD_TAG=" buildargs.env | cut -d'=' -f2 | tr -d '\r' | tr -d '"' | xargs) - if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then CLEAN_TAG=${{ gitea.ref_name }} - echo "docker_tag=${CLEAN_TAG#v}" >> $GITHUB_OUTPUT + FINAL_TAG="${CLEAN_TAG#v}" else - # Nutzt jetzt garantiert den direkt extrahierten Wert - echo "docker_tag=${SAFE_BUILD_TAG:-latest}" >> $GITHUB_OUTPUT + BASE_TAG="${BUILD_TAG:-${DEBIAN_CODENAME}-${BUILD_COUNTRY}}" + if [[ "${{ gitea.ref_name }}" == "dev" ]]; then + if [[ "$BASE_TAG" != *-dev ]]; then + FINAL_TAG="${BASE_TAG}-dev" + else + FINAL_TAG="$BASE_TAG" + fi + else + FINAL_TAG="${BASE_TAG%-dev}" + fi fi + + echo "docker_tag=${FINAL_TAG:-latest}" >> $GITHUB_OUTPUT OWNER=$(echo "${{ gitea.repository }}" | cut -d'/' -f1 | tr '[:upper:]' '[:lower:]') REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2 | tr '[:upper:]' '[:lower:]') @@ -120,7 +132,7 @@ jobs: with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - + - name: Build and Push Docker Image if: steps.check_changes.outputs.should_build == 'true' run: | @@ -143,26 +155,40 @@ jobs: BASE_SHA=$(docker buildx imagetools inspect $BASE --format '{{json .Manifest.Digest}}' 2>/dev/null | tr -d '"' || echo "unknown") - # Bereite die Tags für den initialen Build vor (Gitea immer, Docker Hub optional) AMD_TAGS=("-t" "$IMAGE_GITEA:tmp-amd64") - ARM_TAGS=("-t" "$IMAGE_GITEA:tmp-arm64") + GITEA_SOURCES=("$IMAGE_GITEA:tmp-amd64") if [[ "$PUSH" == *"dockerhub"* ]]; then AMD_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-amd64") - ARM_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-arm64") + DH_SOURCES=("$DOCKERHUB_REPO:tmp-amd64") fi - # Build AMD64 & Push zu allen Zielen docker buildx build "${DOCKER_ARGS[@]}" "${AMD_TAGS[@]}" \ + --cache-from "type=registry,ref=$IMAGE_GITEA:buildcache-amd64" \ + --cache-to "type=registry,ref=$IMAGE_GITEA:buildcache-amd64,mode=max" \ --pull --platform linux/amd64 -f Dockerfile \ --label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push . - - # Build ARM64 & Push zu allen Zielen - docker buildx build "${DOCKER_ARGS[@]}" "${ARM_TAGS[@]}" \ - --pull --platform linux/arm64 -f Dockerfile.aarch64 \ - --label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push . - - # 1. Manifest auf Gitea erstellen (aus Gitea Temp-Tags) + + if [ -f "Dockerfile.aarch64" ]; then + echo "⚙️ Dockerfile.aarch64 gefunden. Baue ARM64 Image..." + + ARM_TAGS=("-t" "$IMAGE_GITEA:tmp-arm64") + GITEA_SOURCES+=("$IMAGE_GITEA:tmp-arm64") + + if [[ "$PUSH" == *"dockerhub"* ]]; then + ARM_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-arm64") + DH_SOURCES+=("$DOCKERHUB_REPO:tmp-arm64") + fi + + docker buildx build "${DOCKER_ARGS[@]}" "${ARM_TAGS[@]}" \ + --cache-from "type=registry,ref=$IMAGE_GITEA:buildcache-arm64" \ + --cache-to "type=registry,ref=$IMAGE_GITEA:buildcache-arm64,mode=max" \ + --pull --platform linux/arm64 -f Dockerfile.aarch64 \ + --label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push . + else + echo "Keine Dockerfile.aarch64 gefunden. ARM64 Build wird übersprungen." + fi + GITEA_MANIFEST_TAGS=("-t" "$IMAGE_GITEA:$TAG") if [[ "$BUILD_TAG_LATEST" == "y" ]]; then GITEA_MANIFEST_TAGS+=("-t" "$IMAGE_GITEA:latest") @@ -170,7 +196,7 @@ jobs: docker buildx imagetools create \ --annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \ - "${GITEA_MANIFEST_TAGS[@]}" $IMAGE_GITEA:tmp-amd64 $IMAGE_GITEA:tmp-arm64 + "${GITEA_MANIFEST_TAGS[@]}" "${GITEA_SOURCES[@]}" # 2. Manifest auf Docker Hub erstellen (aus Docker Hub Temp-Tags!) if [[ "$PUSH" == *"dockerhub"* ]]; then @@ -182,248 +208,260 @@ jobs: # WICHTIG: Hier werden jetzt als Quelle die Docker Hub Temp-Tags genutzt! docker buildx imagetools create \ --annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \ - "${DH_MANIFEST_TAGS[@]}" $DOCKERHUB_REPO:tmp-amd64 $DOCKERHUB_REPO:tmp-arm64 + "${DH_MANIFEST_TAGS[@]}" "${DH_SOURCES[@]}" fi - name: Update Documentation and Compose id: update_doc if: steps.check_changes.outputs.should_build == 'true' run: | - set -x - - export TZ=Europe/Berlin - CURRENT_TIME=$(date '+%d.%m.%Y %H:%M') - BUILD_TAG="${{ steps.prep.outputs.docker_tag }}" - FULL_URL="${{ steps.prep.outputs.image_name }}" - REPO_PURE="${{ steps.prep.outputs.repo_pure }}" - BASE_IMAGE="${{ steps.prep.outputs.base_image }}" - - if [ ! -f "buildargs.env" ]; then echo "❌ buildargs.env missing!"; exit 1; fi - - grep -v '^#' buildargs.env | sed 's/\r$//' > cleaned_env.sh - set -a - source ./cleaned_env.sh - set +a - - if [ -f "Dockerfile.aarch64" ]; then ARM_STATUS="✅ Active"; else ARM_STATUS="❌ Not supported"; fi - - cat << 'EOF' > commit_msg.txt - ${{ gitea.event.head_commit.message }} - EOF - COMMIT_MSG=$(sed 's/\[skip ci\]//g' commit_msg.txt | xargs) - - # 1. Authentifizierter Download der Templates via curl (-f bricht bei HTTP-Fehlern ab) - TOKEN="${{ secrets.RUNNER_TOKEN }}" - curl -sSLf -H "Authorization: token $TOKEN" \ - "https://git.pi-farm.de/pi-farm/templates/raw/branch/main/README.template" \ - -o README.template || echo "Warnung: README Template konnte nicht geladen werden" - - curl -sSLf -H "Authorization: token $TOKEN" \ - "https://git.pi-farm.de/pi-farm/templates/raw/branch/main/docker-compose.template" \ - -o docker-compose.template || echo "Warnung: Compose Template konnte nicht geladen werden" - - # 2. Sicherheitsprüfung: Falls Gitea trotz -f eine HTML-Login-Seite ausgibt, Datei sofort verwerfen - for t_file in README.template docker-compose.template; do - if [ -f "$t_file" ] && grep -qi "" "$t_file"; then - echo "❌ FEHLER: $t_file ist eine HTML-Loginseite! Download verworfen." - rm -f "$t_file" + set -x + + export TZ=Europe/Berlin + CURRENT_TIME=$(date '+%d.%m.%Y %H:%M') + FULL_URL="${{ steps.prep.outputs.image_name }}" + REPO_PURE="${{ steps.prep.outputs.repo_pure }}" + BASE_IMAGE="${{ steps.prep.outputs.base_image }}" + + if [ ! -f "buildargs.env" ]; then echo "❌ buildargs.env missing!"; exit 1; fi + + grep -v '^#' buildargs.env | sed 's/\r$//' > cleaned_env.sh + set -a + source ./cleaned_env.sh + set +a + + BUILD_TAG="${{ steps.prep.outputs.docker_tag }}" + + if [ -f "Dockerfile.aarch64" ]; then ARM_STATUS="✅ Active"; else ARM_STATUS="❌ Not supported"; fi + + RAW_COMMIT_MSG="${{ gitea.event.head_commit.message }}" + COMMIT_MSG=$(echo "$RAW_COMMIT_MSG" | sed 's/\[skip ci\]//g' | tr -d '\r\n' | xargs) + + TOKEN="${{ secrets.RUNNER_TOKEN }}" + curl -sSLf -H "Authorization: token $TOKEN" \ + "https://git.pi-farm.de/pi-farm/templates/raw/branch/main/README.template" \ + -o README.template || echo "Warnung: README Template konnte nicht geladen werden" + + curl -sSLf -H "Authorization: token $TOKEN" \ + "https://git.pi-farm.de/pi-farm/templates/raw/branch/main/docker-compose.template" \ + -o docker-compose.template || echo "Warnung: Compose Template konnte nicht geladen werden" + + for t_file in README.template docker-compose.template; do + if [ -f "$t_file" ] && grep -qi "" "$t_file"; then + echo "❌ FEHLER: $t_file ist eine HTML-Loginseite! Download verworfen." + rm -f "$t_file" + fi + done + + NEW_ROW="| **$BUILD_TAG** | $CURRENT_TIME | $COMMIT_MSG ✅ |" + if [ -f "VERSION.history" ]; then + grep -v "| **$BUILD_TAG** |" VERSION.history > VERSION.history.tmp || true + echo "$NEW_ROW" > VERSION.history + cat VERSION.history.tmp >> VERSION.history + rm VERSION.history.tmp + else + echo "$NEW_ROW" > VERSION.history + fi + HISTORY_CONTENT=$(cat VERSION.history) + + ENV_BLOCK_CONTENT="" + env_vars=$(grep '^ENV_' buildargs.env | grep -v '^#' | tr -d '\r' || true) + if [ -n "$env_vars" ]; then + ENV_BLOCK_CONTENT=" environment:\n" + while read -r line; do + [ -z "$line" ] && continue + key=$(echo "$line" | cut -d= -f1); val=$(echo "$line" | cut -d= -f2-); clean_key=${key#ENV_} + ENV_BLOCK_CONTENT="${ENV_BLOCK_CONTENT} - ${clean_key}=${val}\n" + done <<< "$env_vars" + fi + + PORTS_BLOCK_CONTENT="" + port_vars=$(grep '^PORT_' buildargs.env | grep -v '^#' | tr -d '\r' || true) + if [ -n "$port_vars" ]; then + PORTS_BLOCK_CONTENT=" ports:\n" + while read -r line; do + [ -z "$line" ] && continue + val=$(echo "$line" | cut -d= -f2-); PORTS_BLOCK_CONTENT="${PORTS_BLOCK_CONTENT} - ${val}\n" + done <<< "$port_vars" + fi + + VOL_BLOCK_CONTENT="" + vol_vars=$(grep '^VOL_' buildargs.env | grep -v '^#' | tr -d '\r' || true) + if [ -n "$vol_vars" ]; then + VOL_BLOCK_CONTENT=" volumes:\n" + while read -r line; do + [ -z "$line" ] && continue + val=$(echo "$line" | cut -d= -f2-); VOL_BLOCK_CONTENT="${VOL_BLOCK_CONTENT} - ${val}\n" + done <<< "$vol_vars" + fi + + { + echo "docker run -d \\" + echo " --name $REPO_PURE \\" + echo " --restart unless-stopped \\" + + all_params=$(grep -E '^(PORT_|ENV_|VOL_)' buildargs.env | grep -v '^#' | sed 's/\r$//' || true) + if [ -n "$all_params" ]; then + while read -r line; do + [ -z "$line" ] && continue + if [[ "$line" =~ ^PORT_ ]]; then + val=$(echo "$line" | cut -d= -f2-) + echo " -p ${val} \\" + elif [[ "$line" =~ ^ENV_ ]]; then + key=$(echo "$line" | cut -d= -f1); clean_key=${key#ENV_}; val=$(echo "$line" | cut -d= -f2-) + echo " -e ${clean_key}=${val} \\" + elif [[ "$line" =~ ^VOL_ ]]; then + val=$(echo "$line" | cut -d= -f2-) + echo " -v ${val} \\" fi - done - - NEW_ROW="| **$BUILD_TAG** | $CURRENT_TIME | $COMMIT_MSG ✅ |" - if [ -f "VERSION.history" ]; then - grep -v "| **$BUILD_TAG** |" VERSION.history > VERSION.history.tmp || true - echo "$NEW_ROW" > VERSION.history - cat VERSION.history.tmp >> VERSION.history - rm VERSION.history.tmp - else - echo "$NEW_ROW" > VERSION.history - fi - HISTORY_CONTENT=$(cat VERSION.history) - - ENV_BLOCK_CONTENT="" - env_vars=$(grep '^ENV_' buildargs.env | grep -v '^#' | tr -d '\r' || true) - if [ -n "$env_vars" ]; then - ENV_BLOCK_CONTENT=" environment:\n" - while read -r line; do - [ -z "$line" ] && continue - key=$(echo "$line" | cut -d= -f1); val=$(echo "$line" | cut -d= -f2-); clean_key=${key#ENV_} - ENV_BLOCK_CONTENT="${ENV_BLOCK_CONTENT} - ${clean_key}=${val}\n" - done <<< "$env_vars" - fi - - PORTS_BLOCK_CONTENT="" - port_vars=$(grep '^PORT_' buildargs.env | grep -v '^#' | tr -d '\r' || true) - if [ -n "$port_vars" ]; then - PORTS_BLOCK_CONTENT=" ports:\n" - while read -r line; do - [ -z "$line" ] && continue - val=$(echo "$line" | cut -d= -f2-); PORTS_BLOCK_CONTENT="${PORTS_BLOCK_CONTENT} - ${val}\n" - done <<< "$port_vars" - fi - - VOL_BLOCK_CONTENT="" - vol_vars=$(grep '^VOL_' buildargs.env | grep -v '^#' | tr -d '\r' || true) - if [ -n "$vol_vars" ]; then - VOL_BLOCK_CONTENT=" volumes:\n" - while read -r line; do - [ -z "$line" ] && continue - val=$(echo "$line" | cut -d= -f2-); VOL_BLOCK_CONTENT="${VOL_BLOCK_CONTENT} - ${val}\n" - done <<< "$vol_vars" - fi - - { - echo "docker run -d \\" - echo " --name $REPO_PURE \\" - echo " --restart unless-stopped \\" - - all_params=$(grep -E '^(PORT_|ENV_|VOL_)' buildargs.env | grep -v '^#' | sed 's/\r$//' || true) - if [ -n "$all_params" ]; then - while read -r line; do - [ -z "$line" ] && continue - if [[ "$line" =~ ^PORT_ ]]; then - val=$(echo "$line" | cut -d= -f2-) - echo " -p ${val} \\" - elif [[ "$line" =~ ^ENV_ ]]; then - key=$(echo "$line" | cut -d= -f1); clean_key=${key#ENV_}; val=$(echo "$line" | cut -d= -f2-) - echo " -e ${clean_key}=${val} \\" - elif [[ "$line" =~ ^VOL_ ]]; then - val=$(echo "$line" | cut -d= -f2-) - echo " -v ${val} \\" - fi - done <<< "$all_params" - fi - echo " $FULL_URL:$BUILD_TAG" - } > docker_run_block.txt - - DOCKERHUB_LINK_CONTENT="" - if [[ "${{ steps.prep.outputs.push_targets }}" == *"dockerhub"* ]]; then - DH_USER="${{ secrets.DOCKERHUB_USERNAME }}" - DOCKERHUB_LINK_CONTENT="[![Docker Hub](https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white)](https://hub.docker.com/r/${DH_USER}/${REPO_PURE})" - fi - - # Template-Verarbeitung via Python (verhindert awk-Abstürze bei Zeilenumbrüchen) - process_template() { - local template=$1; local output=$2 - [ ! -f "$template" ] && return - cp "$template" "$output" - - export REPO_PURE FULL_URL BUILD_TAG BASE_IMAGE ARM_STATUS CURRENT_TIME \ - HISTORY_CONTENT DOCKERHUB_LINK_CONTENT ENV_BLOCK_CONTENT \ - PORTS_BLOCK_CONTENT VOL_BLOCK_CONTENT DESCRIPTION - - python3 -c ' - import os, sys - - output = sys.argv[1] - - with open(output, "r", encoding="utf-8") as f: - content = f.read() - - content = content.replace("__REPO_NAME__", os.environ.get("REPO_PURE", "")) - content = content.replace("__FULL_URL__", os.environ.get("FULL_URL", "")) - content = content.replace("__BUILD_TAG__", os.environ.get("BUILD_TAG", "")) - content = content.replace("__BASE_IMAGE__", os.environ.get("BASE_IMAGE", "")) - content = content.replace("__ARM_STATUS__", os.environ.get("ARM_STATUS", "")) - content = content.replace("__CURRENT_DATE__", os.environ.get("CURRENT_TIME", "")) - content = content.replace("__HISTORY_CONTENT__", os.environ.get("HISTORY_CONTENT", "")) - content = content.replace("__DOCKERHUB_LINK__", os.environ.get("DOCKERHUB_LINK_CONTENT", "")) - content = content.replace("__ENV_BLOCK__", os.environ.get("ENV_BLOCK_CONTENT", "").replace("\\n", "\n")) - content = content.replace("__PORTS_BLOCK__", os.environ.get("PORTS_BLOCK_CONTENT", "").replace("\\n", "\n")) - content = content.replace("__VOL_BLOCK__", os.environ.get("VOL_BLOCK_CONTENT", "").replace("\\n", "\n")) - content = content.replace("__DESCRIPTION__", os.environ.get("DESCRIPTION", "Keine Beschreibung.")) + done <<< "$all_params" + fi + echo " $FULL_URL:$BUILD_TAG" + } > docker_run_block.txt + + DOCKERHUB_LINK_CONTENT="" + if [[ "${{ steps.prep.outputs.push_targets }}" == *"dockerhub"* ]]; then + DH_USER="${{ secrets.DOCKERHUB_USERNAME }}" + DOCKERHUB_LINK_CONTENT='Docker Hub' + fi + + if ! command -v python3 &> /dev/null; then + echo "📦 python3 fehlt und wird installiert..." + (apt-get update && apt-get install -y python3) || (apk add --no-cache python3) || true + fi + + # Python-Skript sauber als eigene Datei erstellen (vermeidet YAML-Syntaxfehler) + cat << 'EOF' > update_script.py + import os, sys + + def process(output_file): + if not os.path.exists(output_file.replace('.md', '.template').replace('.yml', '.template')): + return + + template_name = output_file.replace('.md', '.template').replace('.yml', '.template') + with open(template_name, "r", encoding="utf-8") as f: + content = f.read() + + content = content.replace("__REPO_NAME__", os.environ.get("REPO_PURE", "")) + content = content.replace("__FULL_URL__", os.environ.get("FULL_URL", "")) + content = content.replace("__BUILD_TAG__", os.environ.get("BUILD_TAG", "")) + content = content.replace("__BASE_IMAGE__", os.environ.get("BASE_IMAGE", "")) + content = content.replace("__ARM_STATUS__", os.environ.get("ARM_STATUS", "")) + content = content.replace("__CURRENT_DATE__", os.environ.get("CURRENT_TIME", "")) + content = content.replace("__HISTORY_CONTENT__", os.environ.get("HISTORY_CONTENT", "")) + content = content.replace("__DOCKERHUB_LINK__", os.environ.get("DOCKERHUB_LINK_CONTENT", "")) + content = content.replace("__ENV_BLOCK__", os.environ.get("ENV_BLOCK_CONTENT", "").replace("\\n", "\n")) + content = content.replace("__PORTS_BLOCK__", os.environ.get("PORTS_BLOCK_CONTENT", "").replace("\\n", "\n")) + content = content.replace("__VOL_BLOCK__", os.environ.get("VOL_BLOCK_CONTENT", "").replace("\\n", "\n")) + content = content.replace("__DESCRIPTION__", os.environ.get("DESCRIPTION", "Keine Beschreibung.")) + + if "__DOCKER_RUN__" in content and os.path.exists("docker_run_block.txt"): + with open("docker_run_block.txt", "r", encoding="utf-8") as f: + content = content.replace("__DOCKER_RUN__", f.read()) + + if "__COMPOSE_BLOCK__" in content and os.path.exists("docker-compose.yml"): + with open("docker-compose.yml", "r", encoding="utf-8") as f: + content = content.replace("__COMPOSE_BLOCK__", f.read()) + + with open(output_file, "w", encoding="utf-8") as f: + f.write(content) + + process("docker-compose.yml") + process("README.md") + EOF + + export REPO_PURE FULL_URL BUILD_TAG BASE_IMAGE ARM_STATUS CURRENT_TIME \ + HISTORY_CONTENT DOCKERHUB_LINK_CONTENT ENV_BLOCK_CONTENT \ + PORTS_BLOCK_CONTENT VOL_BLOCK_CONTENT DESCRIPTION + + python3 update_script.py + rm -f update_script.py + + echo "FINAL_MSG=$COMMIT_MSG" >> $GITHUB_ENV + { + echo "DESCRIPTION<> $GITHUB_ENV - if "__DOCKER_RUN__" in content and os.path.exists("docker_run_block.txt"): - with open("docker_run_block.txt", "r", encoding="utf-8") as f: - content = content.replace("__DOCKER_RUN__", f.read()) - - if "__COMPOSE_BLOCK__" in content and os.path.exists("docker-compose.yml"): - with open("docker-compose.yml", "r", encoding="utf-8") as f: - content = content.replace("__COMPOSE_BLOCK__", f.read()) - - with open(output, "w", encoding="utf-8") as f: - f.write(content) - ' "$output" - } - - process_template "docker-compose.template" "docker-compose.yml" - process_template "README.template" "README.md" - - echo "FINAL_MSG=$COMMIT_MSG" >> $GITHUB_ENV - echo "DESCRIPTION<> $GITHUB_ENV - echo -e "$DESCRIPTION" >> $GITHUB_ENV - echo "EOF" >> $GITHUB_ENV - - - name: Push README to Docker Hub - if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub') - run: | - if ! command -v jq &> /dev/null; then - apt-get update && apt-get install -y jq || apk add --no-cache jq || true - fi - - echo "🚀 Starting update README on Docker Hub..." - - TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \ - -H "Content-Type: application/json" \ - -d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token) - - if [ "$TOKEN" == "null" ] || [ -z "$TOKEN" ]; then - echo "❌ Error: No login-token available. Check your credentials!" - exit 1 - fi - - REPO_PURE="${{ steps.prep.outputs.repo_pure }}" - DH_USER="${{ secrets.DOCKERHUB_USERNAME }}" - - SHORT_DESC=$(echo -e "${{ env.DESCRIPTION }}" | head -n 1 | cut -c 1-100) - [ -z "$SHORT_DESC" ] && SHORT_DESC="Docker Image for $REPO_PURE" - - echo "📦 Processing README.md (${REPO_PURE})..." - - jq -n \ - --arg desc "$SHORT_DESC" \ - --rawfile full_desc README.md \ - '{description: $desc, full_description: $full_desc}' > payload.json - - echo "📤 Sending data to Docker Hub API..." - RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \ - "https://hub.docker.com/v2/repositories/${DH_USER}/${REPO_PURE}/" \ - -H "Authorization: JWT ${TOKEN}" \ - -H "Content-Type: application/json" \ - -d @payload.json) - - HTTP_STATUS=$(echo "$RESPONSE" | tail -n 1) - BODY=$(echo "$RESPONSE" | head -n -1) - - if [ "$HTTP_STATUS" -eq 200 ]; then - echo "✅ README update successfull (HTTP 200)." - else - echo "❌ Error on update! HTTP Status: $HTTP_STATUS" - echo "Answer from Docker Hub: $BODY" - exit 1 - fi - - - name: Commit, Tag and Push Changes - if: steps.check_changes.outputs.should_build == 'true' - run: | - git config --local user.email "action@pi-farm.de" - git config --local user.name "Gitea Action" - - git add VERSION.history README.md docker-compose.yml - - git diff --quiet && git diff --staged --quiet || git commit -m "${{ env.FINAL_MSG }} [skip ci]" - - TARGET_TAG="${{ steps.prep.outputs.docker_tag }}" - git tag -f "$TARGET_TAG" - - if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then - echo "🏷️ Build aus Tag getriggert: $TARGET_TAG" - git push -f origin "$TARGET_TAG" - else - echo "🌿 Build aus Branch/Schedule getriggert: ${{ gitea.ref_name }}" - git push origin HEAD:${{ gitea.ref_name }} - git push -f origin "$TARGET_TAG" - fi + - name: Push README to Docker Hub + if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub') + run: | + if ! command -v jq &> /dev/null; then + apt-get update && apt-get install -y jq || apk add --no-cache jq || true + fi + + echo "🚀 Starting update README on Docker Hub..." + + TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \ + -H "Content-Type: application/json" \ + -d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token) + + if [ "$TOKEN" == "null" ] || [ -z "$TOKEN" ]; then + echo "❌ Error: No login-token available. Check your credentials!" + exit 1 + fi + + REPO_PURE="${{ steps.prep.outputs.repo_pure }}" + DH_USER="${{ secrets.DOCKERHUB_USERNAME }}" + GITEA_URL="${{ steps.prep.outputs.image_name }}" + DH_URL="${DH_USER}/${REPO_PURE}" + + SHORT_DESC=$(echo -e "${{ env.DESCRIPTION }}" | head -n 1 | cut -c 1-100) + [ -z "$SHORT_DESC" ] && SHORT_DESC="Docker Image for $REPO_PURE" + + echo "📦 Processing README.md for Docker Hub (${DH_URL})..." + + # Ersetzt die Image-URL NUR dann, wenn kein http:// oder https:// davor steht + export GITEA_URL DH_URL + python3 -c 'import os, re; content = open("README.md", "r", encoding="utf-8").read(); new_content = re.sub(r"(? payload.json + + echo "📤 Sending data to Docker Hub API..." + RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \ + "https://hub.docker.com/v2/repositories/${DH_USER}/${REPO_PURE}/" \ + -H "Authorization: JWT ${TOKEN}" \ + -H "Content-Type: application/json" \ + -d @payload.json) + + HTTP_STATUS=$(echo "$RESPONSE" | tail -n 1) + BODY=$(echo "$RESPONSE" | head -n -1) + + if [ "$HTTP_STATUS" -eq 200 ]; then + echo "✅ README update successful (HTTP 200)." + else + echo "❌ Error on update! HTTP Status: $HTTP_STATUS" + echo "Answer from Docker Hub: $BODY" + exit 1 + fi + + rm -f README_DH.md + + - name: Commit, Tag and Push Changes + if: steps.check_changes.outputs.should_build == 'true' + run: | + git config --local user.email "action@pi-farm.de" + git config --local user.name "Gitea Action" + + git add VERSION.history README.md docker-compose.yml + + git diff --quiet && git diff --staged --quiet || git commit -m "${{ env.FINAL_MSG }} [skip ci]" + + TARGET_TAG="${{ steps.prep.outputs.docker_tag }}" + git tag -f "$TARGET_TAG" + + if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then + echo "🏷️ Build aus Tag getriggert: $TARGET_TAG" + git push -f origin "$TARGET_TAG" + else + echo "🌿 Build aus Branch/Schedule getriggert: ${{ gitea.ref_name }}" + git push origin HEAD:${{ gitea.ref_name }} + git push -f origin "$TARGET_TAG" + fi - name: Cleanup Temporary Tags on Docker Hub if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub') @@ -436,17 +474,22 @@ jobs: TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \ -H "Content-Type: application/json" \ - -d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token) + -d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token || echo "") if [ "$TOKEN" != "null" ] && [ -n "$TOKEN" ]; then REPO_PURE=${{ steps.prep.outputs.repo_pure }} DH_USER="${{ secrets.DOCKERHUB_USERNAME }}" - for t in tmp-amd64 tmp-arm64; do + CLEAN_TAGS=("tmp-amd64") + if [ -f "Dockerfile.aarch64" ]; then + CLEAN_TAGS+=("tmp-arm64") + fi + + for t in "${CLEAN_TAGS[@]}"; do echo "Deleting tag $t..." STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE \ "https://hub.docker.com/v2/repositories/${DH_USER}/${REPO_PURE}/tags/$t/" \ - -H "Authorization: JWT ${TOKEN}") + -H "Authorization: JWT ${TOKEN}" || echo "000") echo "Status: $STATUS" done echo "✅ Temp. tags deleted." @@ -455,13 +498,18 @@ jobs: - name: Cleanup Temporary Registry Tags (Gitea) if: steps.check_changes.outputs.should_build == 'true' run: | - TOKEN="${{ secrets.GIT_TOKEN }}" + TOKEN="${{ secrets.RUNNER_TOKEN }}" ORG_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f1) REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2) - for t in tmp-amd64 tmp-arm64; do - curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/$ORG_NAME/container/$REPO_NAME/$t" -H "Authorization: token $TOKEN" - curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/${ORG_NAME,,}/container/${REPO_NAME,,}/$t" -H "Authorization: token $TOKEN" + CLEAN_TAGS=("tmp-amd64") + if [ -f "Dockerfile.aarch64" ]; then + CLEAN_TAGS+=("tmp-arm64") + fi + + for t in "${CLEAN_TAGS[@]}"; do + curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/$ORG_NAME/container/$REPO_NAME/$t" -H "Authorization: token $TOKEN" || true + curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/${ORG_NAME,,}/container/${REPO_NAME,,}/$t" -H "Authorization: token $TOKEN" || true done - name: Cleanup Docker Artifacts diff --git a/Dockerfile b/Dockerfile index 6c35377..0f212f2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -ARG BUILD_BASE_IMAGE=debian:bookworm +ARG BUILD_BASE_IMAGE FROM ${BUILD_BASE_IMAGE} @@ -20,38 +20,13 @@ ENV LC_ALL=${BUILD_LC_ALL} ENV COUNTRY=${BUILD_COUNTRY} ENV DEBIAN_FRONTEND=noninteractive +COPY packages.txt /tmp/packages.txt + RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources && \ - apt-get update && apt-get install -y \ - xrdp \ - sssd \ - sssd-tools \ - libpam-sss \ - libnss-sss \ - libsss-sudo \ - ldap-utils \ - ca-certificates \ - dbus-x11 \ - xfce4 \ - xfce4-terminal \ - sudo \ - firefox-esr \ - firefox-esr-l10n-${COUNTRY} \ - thunderbird \ - thunderbird-l10n-${COUNTRY} \ - locales \ - tzdata \ - keyboard-configuration \ - x11-xkb-utils \ - pulseaudio \ - build-essential \ - dpkg-dev \ - git \ - libpulse-dev \ - meson \ - ninja-build \ - pkg-config \ - autoconf \ - libtool && \ + apt-get update && apt-get install -y --no-install-recommends \ + $(cat /tmp/packages.txt) \ + firefox-esr-l10n-${BUILD_COUNTRY} \ + thunderbird-l10n-${BUILD_COUNTRY} && \ apt-get build-dep -y pulseaudio && \ cd /tmp && \ apt-get source pulseaudio && \ @@ -79,12 +54,9 @@ RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.s ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime && \ dpkg-reconfigure -f noninteractive tzdata && \ printf 'XKBMODEL="pc105"\nXKBLAYOUT="%s"\nXKBVARIANT=""\nXKBOPTIONS=""\nBACKSPACE="guess"\n' "${COUNTRY}" > /etc/default/keyboard && \ - dpkg-reconfigure -f noninteractive keyboard-configuration + dpkg-reconfigure -f noninteractive keyboard-configuration && \ + rm -rf /var/lib/apt/lists/* /tmp/packages.txt -# NEU: Systemweite statische Konfigurationen für LDAP/PAM/Sudo -# 1. Entfernt die gefährliche %users Regel -# 2. Sagt nsswitch, dass Sudoers auch im SSS (LDAP) gesucht werden sollen -# 3. Aktiviert das automatische Erstellen von Home-Verzeichnissen (mkhomedir) RUN sed -i '/%users/s/^/# /' /etc/sudoers && \ echo "sudoers: files sss" >> /etc/nsswitch.conf && \ echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0022" >> /etc/pam.d/common-session diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64 index 6c35377..f89b7e1 100644 --- a/Dockerfile.aarch64 +++ b/Dockerfile.aarch64 @@ -1,4 +1,4 @@ -ARG BUILD_BASE_IMAGE=debian:bookworm +ARG BUILD_BASE_IMAGE FROM ${BUILD_BASE_IMAGE} @@ -20,38 +20,13 @@ ENV LC_ALL=${BUILD_LC_ALL} ENV COUNTRY=${BUILD_COUNTRY} ENV DEBIAN_FRONTEND=noninteractive +COPY packages.txt /tmp/packages.txt + RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources && \ - apt-get update && apt-get install -y \ - xrdp \ - sssd \ - sssd-tools \ - libpam-sss \ - libnss-sss \ - libsss-sudo \ - ldap-utils \ - ca-certificates \ - dbus-x11 \ - xfce4 \ - xfce4-terminal \ - sudo \ - firefox-esr \ - firefox-esr-l10n-${COUNTRY} \ - thunderbird \ - thunderbird-l10n-${COUNTRY} \ - locales \ - tzdata \ - keyboard-configuration \ - x11-xkb-utils \ - pulseaudio \ - build-essential \ - dpkg-dev \ - git \ - libpulse-dev \ - meson \ - ninja-build \ - pkg-config \ - autoconf \ - libtool && \ + apt-get update && apt-get install -y --no-install-recommends \ + $(cat /tmp/packages.txt) \ + firefox-esr-l10n-${BUILD_COUNTRY} \ + thunderbird-l10n-${BUILD_COUNTRY} && \ apt-get build-dep -y pulseaudio && \ cd /tmp && \ apt-get source pulseaudio && \ @@ -79,7 +54,8 @@ RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.s ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime && \ dpkg-reconfigure -f noninteractive tzdata && \ printf 'XKBMODEL="pc105"\nXKBLAYOUT="%s"\nXKBVARIANT=""\nXKBOPTIONS=""\nBACKSPACE="guess"\n' "${COUNTRY}" > /etc/default/keyboard && \ - dpkg-reconfigure -f noninteractive keyboard-configuration + dpkg-reconfigure -f noninteractive keyboard-configuration && \ + rm -rf /var/lib/apt/lists/* /tmp/packages.txt # NEU: Systemweite statische Konfigurationen für LDAP/PAM/Sudo # 1. Entfernt die gefährliche %users Regel diff --git a/README.md b/README.md index 157d22b..398d526 100644 --- a/README.md +++ b/README.md @@ -1,32 +1,37 @@ # base-image-debian-rdp-ldap -Debian Desktop with LDAP-Authentication and Pulse-Audio. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop. +Debian Desktop with LDAP Authentication and PulseAudio. To use behind Guacamole with LDAP Authentication and pass-through to Debian Desktop. -[![Build Status](https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions/workflows/build-and-push.yaml/badge.svg)](https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions) -[![Gitea Repo](https://img.shields.io/badge/gitea-repository-blue?logo=gitea&logoColor=white)](__REPO_URL__) + + Build Status + + + Gitea Repository + This repository is built and pushed automatically. -[![Docker Hub](https://img.shields.io/badge/docker-hub-blue?logo=docker__DOCKERHUB_LINK__logoColor=white)](https://hub.docker.com/r/pifarm/base-image-debian-rdp-ldap) +Docker Hub ### 🏗️ Platform Support | Architecture | Status | Base Image | Build Date | | :--- | :--- | :--- | :--- | -| x86_64 (amd64) | ✅ Active | debian:trixie | 09.08.2026 07:29 | -| aarch64 (arm64) | ✅ Active | debian:trixie | 09.08.2026 07:29 | +| x86_64 (amd64) | ✅ Active | debian:trixie | 08.10.2026 22:15 | +| aarch64 (arm64) | ✅ Active | debian:trixie | 08.10.2026 22:15 | -### 🚀 Docker Pull -```bash -docker pull git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de -``` -### 🚀 Docker Compose +--- + +## 🐙 Method 1: Docker Compose (Recommended) + +### 🚀 1. Create `docker-compose.yml` ```yaml services: base-image-debian-rdp-ldap: - image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de + image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de-dev container_name: base-image-debian-rdp-ldap restart: unless-stopped ports: - - 3889 + - 3389:3389 + environment: - SSSD_DEBUG_LEVEL=5 - LDAP_URI=ldap://YOUR-LDAP-SERVER:389 @@ -34,10 +39,28 @@ services: - LDAP_BIND_DN=cn=YOUR-BIND-USER,dc=YOUR-DOMAIN,dc=LOC - LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD - LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP + volumes: - ./YOUR-PERSISTENT-FOLDER:/home + ``` -### 🚀 Docker Run +### 🚀 2. Pull & start the container +### Pull or update the image +```bash +docker compose pull +``` +### Start container in background +```bash +docker compose up -d +``` +--- + +## 🐳 Method 2: Standalone Container (Docker Run / CLI) +### 🚀 1. Pull the image manually +```bash +docker pull git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de-dev +``` +### 🚀 2. Run the container directly ```bash docker run -d \ --name base-image-debian-rdp-ldap \ @@ -49,26 +72,27 @@ docker run -d \ -e LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD \ -e LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP \ -v ./YOUR-PERSISTENT-FOLDER:/home \ - -p 3889 \ - git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de + -p 3389:3389 \ + git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de-dev + ``` -*Last updated on: 09.08.2026 07:29* +*Last updated on: 08.10.2026 22:15* ### 📜 Version History | Version | Date | Status | | :--- | :--- | :--- | -| **trixie-de** | 09.08.2026 07:29 | ✅ | -| **trixie-de** | 19.07.2026 07:26 | ✅ | -| **trixie-de** | 28.06.2026 07:27 | ✅ | -| **trixie-de** | 14.06.2026 07:25 | ✅ | -| **trixie-de** | 04.06.2026 13:41 | build trixie-de latest ✅ | -| **trixie-de** | 04.06.2026 12:25 | Trixie build ✅ | -| **bookworm-de** | 02.06.2026 18:17 | .gitea/workflows/build-and-push.yaml aktualisiert ✅ | -| **bookworm-de** | 02.06.2026 17:04 | ✅ | -| **bookworm-de** | 24.05.2026 07:22 | ✅ | -| **bookworm-de** | 10.05.2026 07:21 | ✅ | -| **bookworm-de** | 26.04.2026 07:23 | ✅ | -| **bookworm-de** | 09.04.2026 17:19 | build for bookworm ✅ | -| **trixie-de** | 09.04.2026 16:44 | build for trixie-de ✅ | -| **bookworm-de** | 09.04.2026 16:15 | Merge pull request dev (#2) from dev into main Reviewed-on: https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/pulls/2 ✅ | \ No newline at end of file +| **trixie-de-dev** | 08.10.2026 22:15 | ✅ | +| **trixie-de-dev** | 08.10.2026 20:57 | ✅ | +| **trixie-de-dev** | 08.10.2026 17:56 | ✅ | +| **trixie-de-dev** | 08.10.2026 17:30 | ✅ | +| **trixie-de-dev** | 08.10.2026 17:04 | entrypoint.sh aktualisiert ✅ | +| **trixie-de-dev** | 08.10.2026 15:39 | ✅ | +| **trixie-de-dev** | 08.10.2026 15:20 | fix typo ✅ | +| **trixie-de-dev** | 08.10.2026 15:17 | fix dbus container-restart ✅ | +| **trixie-de-dev** | 08.10.2026 14:21 | ✅ | +| **bookworm-de-dev** | 08.10.2026 14:01 | ✅ | +| **bookworm-de-dev** | 08.10.2026 13:52 | ✅ | +| **bookworm-de-dev** | 08.10.2026 12:51 | ✅ | +| **trixie-de-dev** | 08.10.2026 12:32 | ✅ | +| **trixie-de-dev** | 08.10.2026 12:27 | ✅ | \ No newline at end of file diff --git a/VERSION.history b/VERSION.history index 5d28442..c26d860 100644 --- a/VERSION.history +++ b/VERSION.history @@ -1,15 +1,14 @@ -| **trixie-de** | 06.10.2026 17:30 | .gitea/workflows/build-and-push.yaml aktualisiert ✅ | -| **trixie-de** | 09.08.2026 07:29 | ✅ | -| **trixie-de** | 19.07.2026 07:26 | ✅ | -| **trixie-de** | 28.06.2026 07:27 | ✅ | -| **trixie-de** | 14.06.2026 07:25 | ✅ | -| **trixie-de** | 04.06.2026 13:41 | build trixie-de latest ✅ | -| **trixie-de** | 04.06.2026 12:25 | Trixie build ✅ | -| **bookworm-de** | 02.06.2026 18:17 | .gitea/workflows/build-and-push.yaml aktualisiert ✅ | -| **bookworm-de** | 02.06.2026 17:04 | ✅ | -| **bookworm-de** | 24.05.2026 07:22 | ✅ | -| **bookworm-de** | 10.05.2026 07:21 | ✅ | -| **bookworm-de** | 26.04.2026 07:23 | ✅ | -| **bookworm-de** | 09.04.2026 17:19 | build for bookworm ✅ | -| **trixie-de** | 09.04.2026 16:44 | build for trixie-de ✅ | -| **bookworm-de** | 09.04.2026 16:15 | Merge pull request dev (#2) from dev into main Reviewed-on: https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/pulls/2 ✅ | +| **trixie-de-dev** | 08.10.2026 22:15 | ✅ | +| **trixie-de-dev** | 08.10.2026 20:57 | ✅ | +| **trixie-de-dev** | 08.10.2026 17:56 | ✅ | +| **trixie-de-dev** | 08.10.2026 17:30 | ✅ | +| **trixie-de-dev** | 08.10.2026 17:04 | entrypoint.sh aktualisiert ✅ | +| **trixie-de-dev** | 08.10.2026 15:39 | ✅ | +| **trixie-de-dev** | 08.10.2026 15:20 | fix typo ✅ | +| **trixie-de-dev** | 08.10.2026 15:17 | fix dbus container-restart ✅ | +| **trixie-de-dev** | 08.10.2026 14:21 | ✅ | +| **bookworm-de-dev** | 08.10.2026 14:01 | ✅ | +| **bookworm-de-dev** | 08.10.2026 13:52 | ✅ | +| **bookworm-de-dev** | 08.10.2026 12:51 | ✅ | +| **trixie-de-dev** | 08.10.2026 12:32 | ✅ | +| **trixie-de-dev** | 08.10.2026 12:27 | ✅ | diff --git a/buildargs.env b/buildargs.env index ca6dbe0..7ab9628 100644 --- a/buildargs.env +++ b/buildargs.env @@ -1,7 +1,10 @@ -## BUILD STAGE -BUILD_BASE_IMAGE=debian:trixie +## BASE CONFIG +DEBIAN_CODENAME=trixie BUILD_COUNTRY=de -BUILD_TAG=trixie-de + +## BUILD STAGE +BUILD_BASE_IMAGE="debian:${DEBIAN_CODENAME}" +BUILD_TAG="${DEBIAN_CODENAME}-${BUILD_COUNTRY}" BUILD_TAG_LATEST=y BUILD_LANG=de_DE.UTF-8 BUILD_LANGUAGE=de_DE:de @@ -12,6 +15,9 @@ BUILD_APP_NAME=base-image-debian-rdp-ldap BUILD_APP_VERSION=1.0.0 PUSH=dockerhub +## BASE PACKAGES +BUILD_BASE_PACKAGES="xrdp sssd sssd-tools libpam-sss libnss-sss libsss-sudo ldap-utils ca-certificates dbus-x11 xfce4 xfce4-terminal sudo firefox-esr firefox-esr-l10n-${BUILD_COUNTRY} thunderbird thunderbird-l10n-${BUILD_COUNTRY} locales tzdata keyboard-configuration x11-xkb-utils pulseaudio build-essential dpkg-dev git libpulse-dev meson ninja-build pkg-config autoconf libtool thunar-archive-plugin xarchiver unzip zip p7zip-full tar gzip bzip2 dialog whiptail" + ## ENV STAGE ENV_SSSD_DEBUG_LEVEL=5 ENV_LDAP_URI=ldap://YOUR-LDAP-SERVER:389 @@ -22,6 +28,6 @@ ENV_LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP ## DOCKER / COMPOSE CONFIG VOL_HOME=./YOUR-PERSISTENT-FOLDER:/home -PORT_RDP=3889 +PORT_RDP=3389:3389 -DESCRIPTION="Debian Desktop with LDAP-Authentication and Pulse-Audio. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop." \ No newline at end of file +DESCRIPTION="Debian Desktop with LDAP Authentication and PulseAudio. To use behind Guacamole with LDAP Authentication and pass-through to Debian Desktop." \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index b736ac4..1ee3cec 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,281 +1,18 @@ - - - - - - Sign In - Gitea: Git with a cup of tea - - - - - +services: + base-image-debian-rdp-ldap: + image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de-dev + container_name: base-image-debian-rdp-ldap + restart: unless-stopped + ports: + - 3389:3389 + environment: + - SSSD_DEBUG_LEVEL=5 + - LDAP_URI=ldap://YOUR-LDAP-SERVER:389 + - LDAP_BASE_DN=dc=YOUR-DOMAIN,dc=LOC + - LDAP_BIND_DN=cn=YOUR-BIND-USER,dc=YOUR-DOMAIN,dc=LOC + - LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD + - LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - -
-
- - - Logo - - - -
- - - -
- - - - Explore - - - - - - Help - -
- - -
- - - - - Sign In - - -
- - - -
- - - - - - - - -
-
- -
-
- - - -

- - Sign In - -

-
- -
-
- - -
- -
-
- - Forgot password? -
- -
- - -
-
- - -
-
- - - - - -
- -
-
- - - - -
-
- - -
-
- -
-
Could not read your security key.
-
-
-
Your browser does not currently support WebAuthn.
-
An unknown error occurred. Please retry.
-
WebAuthn only supports secure connections. For testing over HTTP, you can use the origin "localhost" or "127.0.0.1".
-
The server could not process your request.
-
The security key is not permitted for this request. Please make sure that the key is not already registered.
-
You must set a name for this key.
-
Timeout reached before your key could be read. Please reload this page and retry.
-
-
- - Sign in with a passkey - - - -
-
- - -
-
-
- - - -
- -
-
- - Powered by Gitea - - - - Version: - - 1.27.2 - - - - - - Page: 2ms - Template: 0ms - - - -
-
-
-
Auto
-
-
-
- English -
- Bahasa Indonesia - Deutsch - English - Español - Français - Gaeilge - Italiano - Latviešu - Magyar nyelv - Nederlands - Polski - Português de Portugal - Português do Brasil - Suomi - Svenska - Türkçe - Čeština - Ελληνικά - Български - Русский - Українська - فارسی - മലയാളം - 日本語 - 简体中文 - 繁體中文（台灣） - 繁體中文（香港） - 한국어 -
-
- Licenses - API - -
-
- - - - - - - + volumes: + - ./YOUR-PERSISTENT-FOLDER:/home diff --git a/entrypoint.sh b/entrypoint.sh index 3fa5b1a..377433f 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,8 +1,6 @@ #!/bin/bash set -e -# Mapping der Gitea-Workflow Variablen (ENV_...) auf interne Variablen -# Falls ENV_LDAP_URI nicht gesetzt ist, wird ein Fallback genutzt LDAP_URI=${LDAP_URI:-"ldap://localhost:389"} LDAP_BASE_DN=${LDAP_BASE_DN:-"dc=example,dc=com"} LDAP_BIND_DN=${LDAP_BIND_DN:-"cn=admin,dc=example,dc=com"} @@ -32,10 +30,9 @@ ldap_default_authtok = ${LDAP_BIND_PASSWORD} ldap_schema = rfc2307bis ldap_group_member = uniqueMember - +ldap_auth_disable_tls_never_use_in_production = true ldap_id_use_start_tls = false ldap_tls_reqcert = never -ldap_auth_disable_tls_never_use_in_production = true cache_credentials = true enumerate = false @@ -48,14 +45,24 @@ echo ">>> Erstelle Sudoers-Regel für Gruppe: ${LDAP_SUDO_GROUP}..." echo "%${LDAP_SUDO_GROUP} ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/ldap-admins chmod 0440 /etc/sudoers.d/ldap-admins -echo ">>> Bereinige SSSD Cache..." +echo ">>> Erzwinge TLS für xrdp (Guacamole Fix)..." +if [ -f /etc/xrdp/xrdp.ini ]; then + sed -i 's/^security_layer=.*/security_layer=tls/' /etc/xrdp/xrdp.ini +fi + +echo ">>> Bereinige alte PID-Dateien und SSSD Cache..." +rm -f /var/run/dbus/pid /run/dbus/dbus.pid /var/run/xrdp/*.pid /var/run/xrdp/xrdp-sesman.pid rm -f /var/lib/sss/db/* rm -f /var/lib/sss/mc/* -echo ">>> Starte Dienste..." -# SSSD mit dem gemappten Debug-Level starten +echo ">>> Starte D-Bus..." +mkdir -p /var/run/dbus /run/dbus +dbus-uuidgen --ensure +dbus-daemon --system --fork + +echo ">>> Starte SSSD..." sssd -D --debug-level=${SSSD_DEBUG} -service dbus start +echo ">>> Starte XRDP..." xrdp-sesman exec xrdp -n \ No newline at end of file diff --git a/packages.txt b/packages.txt new file mode 100644 index 0000000..cde159d --- /dev/null +++ b/packages.txt @@ -0,0 +1,43 @@ +sssd +sssd-tools +libpam-sss +libnss-sss +libsss-sudo +ldap-utils +ca-certificates +xrdp +xorgxrdp +dbus +dbus-x11 +xfce4 +xfce4-terminal +xdg-user-dirs +desktop-base +sudo +firefox-esr +thunderbird +geany +locales +tzdata +keyboard-configuration +x11-xkb-utils +pulseaudio +build-essential +dpkg-dev +git +libpulse-dev +meson +ninja-build +pkg-config +autoconf +libtool +thunar-archive-plugin +xarchiver +unzip +zip +p7zip-full +tar +gzip +bzip2 +dialog +whiptail \ No newline at end of file