Merge branch 'dev'
This commit is contained in:
Pi-Farm committed
commit
2c201f5811
9 files changed
+448
-636
No files matched your search
@@ -1,7 +1,18 @@
|
|||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
branches:
|
branches:
|
||||||
- 'main'
|
- 'dev'
|
||||||
|
paths-ignore:
|
||||||
|
- 'README.md'
|
||||||
|
- 'Dockerfile*'
|
||||||
|
- 'packages.txt'
|
||||||
|
- 'VERSION.history'
|
||||||
|
- 'docker-compose.yml'
|
||||||
|
- 'buildargs.env'
|
||||||
|
- 'entrypoint.sh'
|
||||||
|
- '*.md'
|
||||||
|
- '.gitignore'
|
||||||
|
- '.gitea/workflows/build-and-push.yaml'
|
||||||
tags:
|
tags:
|
||||||
- '*'
|
- '*'
|
||||||
schedule:
|
schedule:
|
||||||
@@ -27,11 +38,7 @@ jobs:
|
|||||||
id: prep
|
id: prep
|
||||||
run: |
|
run: |
|
||||||
export TZ=Europe/Berlin
|
export TZ=Europe/Berlin
|
||||||
|
|
||||||
# FIX 1: Stellt sicher, dass die Datei mit einem Zeilenumbruch endet.
|
|
||||||
# Das verhindert, dass Bash die letzte Zeile beim Einlesen verschluckt.
|
|
||||||
sed -i -e '$a\' buildargs.env
|
sed -i -e '$a\' buildargs.env
|
||||||
|
|
||||||
set -a
|
set -a
|
||||||
source <(grep -v '^#' buildargs.env | sed 's/\r$//')
|
source <(grep -v '^#' buildargs.env | sed 's/\r$//')
|
||||||
set +a
|
set +a
|
||||||
@@ -42,19 +49,24 @@ jobs:
|
|||||||
echo "build_args_hash=$ARGS_HASH" >> $GITHUB_OUTPUT
|
echo "build_args_hash=$ARGS_HASH" >> $GITHUB_OUTPUT
|
||||||
|
|
||||||
echo "event_name=${{ gitea.event_name }}" >> $GITHUB_OUTPUT
|
echo "event_name=${{ gitea.event_name }}" >> $GITHUB_OUTPUT
|
||||||
|
|
||||||
# FIX 2: Kugelsicheres Auslesen des Tags direkt aus der Datei.
|
|
||||||
# Trimm-Befehle (tr) entfernen eventuelle unsichtbare Zeichen oder Anführungszeichen.
|
|
||||||
SAFE_BUILD_TAG=$(grep "^BUILD_TAG=" buildargs.env | cut -d'=' -f2 | tr -d '\r' | tr -d '"' | xargs)
|
|
||||||
|
|
||||||
if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then
|
if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then
|
||||||
CLEAN_TAG=${{ gitea.ref_name }}
|
CLEAN_TAG=${{ gitea.ref_name }}
|
||||||
echo "docker_tag=${CLEAN_TAG#v}" >> $GITHUB_OUTPUT
|
FINAL_TAG="${CLEAN_TAG#v}"
|
||||||
else
|
else
|
||||||
# Nutzt jetzt garantiert den direkt extrahierten Wert
|
BASE_TAG="${BUILD_TAG:-${DEBIAN_CODENAME}-${BUILD_COUNTRY}}"
|
||||||
echo "docker_tag=${SAFE_BUILD_TAG:-latest}" >> $GITHUB_OUTPUT
|
if [[ "${{ gitea.ref_name }}" == "dev" ]]; then
|
||||||
|
if [[ "$BASE_TAG" != *-dev ]]; then
|
||||||
|
FINAL_TAG="${BASE_TAG}-dev"
|
||||||
|
else
|
||||||
|
FINAL_TAG="$BASE_TAG"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
FINAL_TAG="${BASE_TAG%-dev}"
|
||||||
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
echo "docker_tag=${FINAL_TAG:-latest}" >> $GITHUB_OUTPUT
|
||||||
|
|
||||||
OWNER=$(echo "${{ gitea.repository }}" | cut -d'/' -f1 | tr '[:upper:]' '[:lower:]')
|
OWNER=$(echo "${{ gitea.repository }}" | cut -d'/' -f1 | tr '[:upper:]' '[:lower:]')
|
||||||
REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2 | tr '[:upper:]' '[:lower:]')
|
REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2 | tr '[:upper:]' '[:lower:]')
|
||||||
|
|
||||||
@@ -143,26 +155,40 @@ jobs:
|
|||||||
|
|
||||||
BASE_SHA=$(docker buildx imagetools inspect $BASE --format '{{json .Manifest.Digest}}' 2>/dev/null | tr -d '"' || echo "unknown")
|
BASE_SHA=$(docker buildx imagetools inspect $BASE --format '{{json .Manifest.Digest}}' 2>/dev/null | tr -d '"' || echo "unknown")
|
||||||
|
|
||||||
# Bereite die Tags für den initialen Build vor (Gitea immer, Docker Hub optional)
|
|
||||||
AMD_TAGS=("-t" "$IMAGE_GITEA:tmp-amd64")
|
AMD_TAGS=("-t" "$IMAGE_GITEA:tmp-amd64")
|
||||||
ARM_TAGS=("-t" "$IMAGE_GITEA:tmp-arm64")
|
GITEA_SOURCES=("$IMAGE_GITEA:tmp-amd64")
|
||||||
|
|
||||||
if [[ "$PUSH" == *"dockerhub"* ]]; then
|
if [[ "$PUSH" == *"dockerhub"* ]]; then
|
||||||
AMD_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-amd64")
|
AMD_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-amd64")
|
||||||
ARM_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-arm64")
|
DH_SOURCES=("$DOCKERHUB_REPO:tmp-amd64")
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Build AMD64 & Push zu allen Zielen
|
|
||||||
docker buildx build "${DOCKER_ARGS[@]}" "${AMD_TAGS[@]}" \
|
docker buildx build "${DOCKER_ARGS[@]}" "${AMD_TAGS[@]}" \
|
||||||
|
--cache-from "type=registry,ref=$IMAGE_GITEA:buildcache-amd64" \
|
||||||
|
--cache-to "type=registry,ref=$IMAGE_GITEA:buildcache-amd64,mode=max" \
|
||||||
--pull --platform linux/amd64 -f Dockerfile \
|
--pull --platform linux/amd64 -f Dockerfile \
|
||||||
--label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
|
--label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
|
||||||
|
|
||||||
# Build ARM64 & Push zu allen Zielen
|
if [ -f "Dockerfile.aarch64" ]; then
|
||||||
docker buildx build "${DOCKER_ARGS[@]}" "${ARM_TAGS[@]}" \
|
echo "⚙️ Dockerfile.aarch64 gefunden. Baue ARM64 Image..."
|
||||||
--pull --platform linux/arm64 -f Dockerfile.aarch64 \
|
|
||||||
--label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
|
ARM_TAGS=("-t" "$IMAGE_GITEA:tmp-arm64")
|
||||||
|
GITEA_SOURCES+=("$IMAGE_GITEA:tmp-arm64")
|
||||||
|
|
||||||
|
if [[ "$PUSH" == *"dockerhub"* ]]; then
|
||||||
|
ARM_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-arm64")
|
||||||
|
DH_SOURCES+=("$DOCKERHUB_REPO:tmp-arm64")
|
||||||
|
fi
|
||||||
|
|
||||||
|
docker buildx build "${DOCKER_ARGS[@]}" "${ARM_TAGS[@]}" \
|
||||||
|
--cache-from "type=registry,ref=$IMAGE_GITEA:buildcache-arm64" \
|
||||||
|
--cache-to "type=registry,ref=$IMAGE_GITEA:buildcache-arm64,mode=max" \
|
||||||
|
--pull --platform linux/arm64 -f Dockerfile.aarch64 \
|
||||||
|
--label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
|
||||||
|
else
|
||||||
|
echo "Keine Dockerfile.aarch64 gefunden. ARM64 Build wird übersprungen."
|
||||||
|
fi
|
||||||
|
|
||||||
# 1. Manifest auf Gitea erstellen (aus Gitea Temp-Tags)
|
|
||||||
GITEA_MANIFEST_TAGS=("-t" "$IMAGE_GITEA:$TAG")
|
GITEA_MANIFEST_TAGS=("-t" "$IMAGE_GITEA:$TAG")
|
||||||
if [[ "$BUILD_TAG_LATEST" == "y" ]]; then
|
if [[ "$BUILD_TAG_LATEST" == "y" ]]; then
|
||||||
GITEA_MANIFEST_TAGS+=("-t" "$IMAGE_GITEA:latest")
|
GITEA_MANIFEST_TAGS+=("-t" "$IMAGE_GITEA:latest")
|
||||||
@@ -170,7 +196,7 @@ jobs:
|
|||||||
|
|
||||||
docker buildx imagetools create \
|
docker buildx imagetools create \
|
||||||
--annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \
|
--annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \
|
||||||
"${GITEA_MANIFEST_TAGS[@]}" $IMAGE_GITEA:tmp-amd64 $IMAGE_GITEA:tmp-arm64
|
"${GITEA_MANIFEST_TAGS[@]}" "${GITEA_SOURCES[@]}"
|
||||||
|
|
||||||
# 2. Manifest auf Docker Hub erstellen (aus Docker Hub Temp-Tags!)
|
# 2. Manifest auf Docker Hub erstellen (aus Docker Hub Temp-Tags!)
|
||||||
if [[ "$PUSH" == *"dockerhub"* ]]; then
|
if [[ "$PUSH" == *"dockerhub"* ]]; then
|
||||||
@@ -182,248 +208,260 @@ jobs:
|
|||||||
# WICHTIG: Hier werden jetzt als Quelle die Docker Hub Temp-Tags genutzt!
|
# WICHTIG: Hier werden jetzt als Quelle die Docker Hub Temp-Tags genutzt!
|
||||||
docker buildx imagetools create \
|
docker buildx imagetools create \
|
||||||
--annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \
|
--annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \
|
||||||
"${DH_MANIFEST_TAGS[@]}" $DOCKERHUB_REPO:tmp-amd64 $DOCKERHUB_REPO:tmp-arm64
|
"${DH_MANIFEST_TAGS[@]}" "${DH_SOURCES[@]}"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
- name: Update Documentation and Compose
|
- name: Update Documentation and Compose
|
||||||
id: update_doc
|
id: update_doc
|
||||||
if: steps.check_changes.outputs.should_build == 'true'
|
if: steps.check_changes.outputs.should_build == 'true'
|
||||||
run: |
|
run: |
|
||||||
set -x
|
set -x
|
||||||
|
|
||||||
export TZ=Europe/Berlin
|
export TZ=Europe/Berlin
|
||||||
CURRENT_TIME=$(date '+%d.%m.%Y %H:%M')
|
CURRENT_TIME=$(date '+%d.%m.%Y %H:%M')
|
||||||
BUILD_TAG="${{ steps.prep.outputs.docker_tag }}"
|
FULL_URL="${{ steps.prep.outputs.image_name }}"
|
||||||
FULL_URL="${{ steps.prep.outputs.image_name }}"
|
REPO_PURE="${{ steps.prep.outputs.repo_pure }}"
|
||||||
REPO_PURE="${{ steps.prep.outputs.repo_pure }}"
|
BASE_IMAGE="${{ steps.prep.outputs.base_image }}"
|
||||||
BASE_IMAGE="${{ steps.prep.outputs.base_image }}"
|
|
||||||
|
|
||||||
if [ ! -f "buildargs.env" ]; then echo "❌ buildargs.env missing!"; exit 1; fi
|
if [ ! -f "buildargs.env" ]; then echo "❌ buildargs.env missing!"; exit 1; fi
|
||||||
|
|
||||||
grep -v '^#' buildargs.env | sed 's/\r$//' > cleaned_env.sh
|
grep -v '^#' buildargs.env | sed 's/\r$//' > cleaned_env.sh
|
||||||
set -a
|
set -a
|
||||||
source ./cleaned_env.sh
|
source ./cleaned_env.sh
|
||||||
set +a
|
set +a
|
||||||
|
|
||||||
if [ -f "Dockerfile.aarch64" ]; then ARM_STATUS="✅ Active"; else ARM_STATUS="❌ Not supported"; fi
|
BUILD_TAG="${{ steps.prep.outputs.docker_tag }}"
|
||||||
|
|
||||||
cat << 'EOF' > commit_msg.txt
|
if [ -f "Dockerfile.aarch64" ]; then ARM_STATUS="✅ Active"; else ARM_STATUS="❌ Not supported"; fi
|
||||||
${{ gitea.event.head_commit.message }}
|
|
||||||
EOF
|
|
||||||
COMMIT_MSG=$(sed 's/\[skip ci\]//g' commit_msg.txt | xargs)
|
|
||||||
|
|
||||||
# 1. Authentifizierter Download der Templates via curl (-f bricht bei HTTP-Fehlern ab)
|
RAW_COMMIT_MSG="${{ gitea.event.head_commit.message }}"
|
||||||
TOKEN="${{ secrets.RUNNER_TOKEN }}"
|
COMMIT_MSG=$(echo "$RAW_COMMIT_MSG" | sed 's/\[skip ci\]//g' | tr -d '\r\n' | xargs)
|
||||||
curl -sSLf -H "Authorization: token $TOKEN" \
|
|
||||||
"https://git.pi-farm.de/pi-farm/templates/raw/branch/main/README.template" \
|
|
||||||
-o README.template || echo "Warnung: README Template konnte nicht geladen werden"
|
|
||||||
|
|
||||||
curl -sSLf -H "Authorization: token $TOKEN" \
|
TOKEN="${{ secrets.RUNNER_TOKEN }}"
|
||||||
"https://git.pi-farm.de/pi-farm/templates/raw/branch/main/docker-compose.template" \
|
curl -sSLf -H "Authorization: token $TOKEN" \
|
||||||
-o docker-compose.template || echo "Warnung: Compose Template konnte nicht geladen werden"
|
"https://git.pi-farm.de/pi-farm/templates/raw/branch/main/README.template" \
|
||||||
|
-o README.template || echo "Warnung: README Template konnte nicht geladen werden"
|
||||||
|
|
||||||
# 2. Sicherheitsprüfung: Falls Gitea trotz -f eine HTML-Login-Seite ausgibt, Datei sofort verwerfen
|
curl -sSLf -H "Authorization: token $TOKEN" \
|
||||||
for t_file in README.template docker-compose.template; do
|
"https://git.pi-farm.de/pi-farm/templates/raw/branch/main/docker-compose.template" \
|
||||||
if [ -f "$t_file" ] && grep -qi "<!DOCTYPE html>" "$t_file"; then
|
-o docker-compose.template || echo "Warnung: Compose Template konnte nicht geladen werden"
|
||||||
echo "❌ FEHLER: $t_file ist eine HTML-Loginseite! Download verworfen."
|
|
||||||
rm -f "$t_file"
|
for t_file in README.template docker-compose.template; do
|
||||||
|
if [ -f "$t_file" ] && grep -qi "<!DOCTYPE html>" "$t_file"; then
|
||||||
|
echo "❌ FEHLER: $t_file ist eine HTML-Loginseite! Download verworfen."
|
||||||
|
rm -f "$t_file"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
NEW_ROW="| **$BUILD_TAG** | $CURRENT_TIME | $COMMIT_MSG ✅ |"
|
||||||
|
if [ -f "VERSION.history" ]; then
|
||||||
|
grep -v "| **$BUILD_TAG** |" VERSION.history > VERSION.history.tmp || true
|
||||||
|
echo "$NEW_ROW" > VERSION.history
|
||||||
|
cat VERSION.history.tmp >> VERSION.history
|
||||||
|
rm VERSION.history.tmp
|
||||||
|
else
|
||||||
|
echo "$NEW_ROW" > VERSION.history
|
||||||
|
fi
|
||||||
|
HISTORY_CONTENT=$(cat VERSION.history)
|
||||||
|
|
||||||
|
ENV_BLOCK_CONTENT=""
|
||||||
|
env_vars=$(grep '^ENV_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
|
||||||
|
if [ -n "$env_vars" ]; then
|
||||||
|
ENV_BLOCK_CONTENT=" environment:\n"
|
||||||
|
while read -r line; do
|
||||||
|
[ -z "$line" ] && continue
|
||||||
|
key=$(echo "$line" | cut -d= -f1); val=$(echo "$line" | cut -d= -f2-); clean_key=${key#ENV_}
|
||||||
|
ENV_BLOCK_CONTENT="${ENV_BLOCK_CONTENT} - ${clean_key}=${val}\n"
|
||||||
|
done <<< "$env_vars"
|
||||||
|
fi
|
||||||
|
|
||||||
|
PORTS_BLOCK_CONTENT=""
|
||||||
|
port_vars=$(grep '^PORT_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
|
||||||
|
if [ -n "$port_vars" ]; then
|
||||||
|
PORTS_BLOCK_CONTENT=" ports:\n"
|
||||||
|
while read -r line; do
|
||||||
|
[ -z "$line" ] && continue
|
||||||
|
val=$(echo "$line" | cut -d= -f2-); PORTS_BLOCK_CONTENT="${PORTS_BLOCK_CONTENT} - ${val}\n"
|
||||||
|
done <<< "$port_vars"
|
||||||
|
fi
|
||||||
|
|
||||||
|
VOL_BLOCK_CONTENT=""
|
||||||
|
vol_vars=$(grep '^VOL_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
|
||||||
|
if [ -n "$vol_vars" ]; then
|
||||||
|
VOL_BLOCK_CONTENT=" volumes:\n"
|
||||||
|
while read -r line; do
|
||||||
|
[ -z "$line" ] && continue
|
||||||
|
val=$(echo "$line" | cut -d= -f2-); VOL_BLOCK_CONTENT="${VOL_BLOCK_CONTENT} - ${val}\n"
|
||||||
|
done <<< "$vol_vars"
|
||||||
|
fi
|
||||||
|
|
||||||
|
{
|
||||||
|
echo "docker run -d \\"
|
||||||
|
echo " --name $REPO_PURE \\"
|
||||||
|
echo " --restart unless-stopped \\"
|
||||||
|
|
||||||
|
all_params=$(grep -E '^(PORT_|ENV_|VOL_)' buildargs.env | grep -v '^#' | sed 's/\r$//' || true)
|
||||||
|
if [ -n "$all_params" ]; then
|
||||||
|
while read -r line; do
|
||||||
|
[ -z "$line" ] && continue
|
||||||
|
if [[ "$line" =~ ^PORT_ ]]; then
|
||||||
|
val=$(echo "$line" | cut -d= -f2-)
|
||||||
|
echo " -p ${val} \\"
|
||||||
|
elif [[ "$line" =~ ^ENV_ ]]; then
|
||||||
|
key=$(echo "$line" | cut -d= -f1); clean_key=${key#ENV_}; val=$(echo "$line" | cut -d= -f2-)
|
||||||
|
echo " -e ${clean_key}=${val} \\"
|
||||||
|
elif [[ "$line" =~ ^VOL_ ]]; then
|
||||||
|
val=$(echo "$line" | cut -d= -f2-)
|
||||||
|
echo " -v ${val} \\"
|
||||||
fi
|
fi
|
||||||
done
|
done <<< "$all_params"
|
||||||
|
fi
|
||||||
|
echo " $FULL_URL:$BUILD_TAG"
|
||||||
|
} > docker_run_block.txt
|
||||||
|
|
||||||
NEW_ROW="| **$BUILD_TAG** | $CURRENT_TIME | $COMMIT_MSG ✅ |"
|
DOCKERHUB_LINK_CONTENT=""
|
||||||
if [ -f "VERSION.history" ]; then
|
if [[ "${{ steps.prep.outputs.push_targets }}" == *"dockerhub"* ]]; then
|
||||||
grep -v "| **$BUILD_TAG** |" VERSION.history > VERSION.history.tmp || true
|
DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
|
||||||
echo "$NEW_ROW" > VERSION.history
|
DOCKERHUB_LINK_CONTENT='<a href="https://hub.docker.com/r/'"${DH_USER}"'/'"${REPO_PURE}"'" target="_blank" rel="noopener noreferrer"><img src="https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white" alt="Docker Hub"></a>'
|
||||||
cat VERSION.history.tmp >> VERSION.history
|
fi
|
||||||
rm VERSION.history.tmp
|
|
||||||
else
|
|
||||||
echo "$NEW_ROW" > VERSION.history
|
|
||||||
fi
|
|
||||||
HISTORY_CONTENT=$(cat VERSION.history)
|
|
||||||
|
|
||||||
ENV_BLOCK_CONTENT=""
|
if ! command -v python3 &> /dev/null; then
|
||||||
env_vars=$(grep '^ENV_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
|
echo "📦 python3 fehlt und wird installiert..."
|
||||||
if [ -n "$env_vars" ]; then
|
(apt-get update && apt-get install -y python3) || (apk add --no-cache python3) || true
|
||||||
ENV_BLOCK_CONTENT=" environment:\n"
|
fi
|
||||||
while read -r line; do
|
|
||||||
[ -z "$line" ] && continue
|
|
||||||
key=$(echo "$line" | cut -d= -f1); val=$(echo "$line" | cut -d= -f2-); clean_key=${key#ENV_}
|
|
||||||
ENV_BLOCK_CONTENT="${ENV_BLOCK_CONTENT} - ${clean_key}=${val}\n"
|
|
||||||
done <<< "$env_vars"
|
|
||||||
fi
|
|
||||||
|
|
||||||
PORTS_BLOCK_CONTENT=""
|
# Python-Skript sauber als eigene Datei erstellen (vermeidet YAML-Syntaxfehler)
|
||||||
port_vars=$(grep '^PORT_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
|
cat << 'EOF' > update_script.py
|
||||||
if [ -n "$port_vars" ]; then
|
import os, sys
|
||||||
PORTS_BLOCK_CONTENT=" ports:\n"
|
|
||||||
while read -r line; do
|
|
||||||
[ -z "$line" ] && continue
|
|
||||||
val=$(echo "$line" | cut -d= -f2-); PORTS_BLOCK_CONTENT="${PORTS_BLOCK_CONTENT} - ${val}\n"
|
|
||||||
done <<< "$port_vars"
|
|
||||||
fi
|
|
||||||
|
|
||||||
VOL_BLOCK_CONTENT=""
|
def process(output_file):
|
||||||
vol_vars=$(grep '^VOL_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
|
if not os.path.exists(output_file.replace('.md', '.template').replace('.yml', '.template')):
|
||||||
if [ -n "$vol_vars" ]; then
|
return
|
||||||
VOL_BLOCK_CONTENT=" volumes:\n"
|
|
||||||
while read -r line; do
|
|
||||||
[ -z "$line" ] && continue
|
|
||||||
val=$(echo "$line" | cut -d= -f2-); VOL_BLOCK_CONTENT="${VOL_BLOCK_CONTENT} - ${val}\n"
|
|
||||||
done <<< "$vol_vars"
|
|
||||||
fi
|
|
||||||
|
|
||||||
{
|
template_name = output_file.replace('.md', '.template').replace('.yml', '.template')
|
||||||
echo "docker run -d \\"
|
with open(template_name, "r", encoding="utf-8") as f:
|
||||||
echo " --name $REPO_PURE \\"
|
content = f.read()
|
||||||
echo " --restart unless-stopped \\"
|
|
||||||
|
|
||||||
all_params=$(grep -E '^(PORT_|ENV_|VOL_)' buildargs.env | grep -v '^#' | sed 's/\r$//' || true)
|
content = content.replace("__REPO_NAME__", os.environ.get("REPO_PURE", ""))
|
||||||
if [ -n "$all_params" ]; then
|
content = content.replace("__FULL_URL__", os.environ.get("FULL_URL", ""))
|
||||||
while read -r line; do
|
content = content.replace("__BUILD_TAG__", os.environ.get("BUILD_TAG", ""))
|
||||||
[ -z "$line" ] && continue
|
content = content.replace("__BASE_IMAGE__", os.environ.get("BASE_IMAGE", ""))
|
||||||
if [[ "$line" =~ ^PORT_ ]]; then
|
content = content.replace("__ARM_STATUS__", os.environ.get("ARM_STATUS", ""))
|
||||||
val=$(echo "$line" | cut -d= -f2-)
|
content = content.replace("__CURRENT_DATE__", os.environ.get("CURRENT_TIME", ""))
|
||||||
echo " -p ${val} \\"
|
content = content.replace("__HISTORY_CONTENT__", os.environ.get("HISTORY_CONTENT", ""))
|
||||||
elif [[ "$line" =~ ^ENV_ ]]; then
|
content = content.replace("__DOCKERHUB_LINK__", os.environ.get("DOCKERHUB_LINK_CONTENT", ""))
|
||||||
key=$(echo "$line" | cut -d= -f1); clean_key=${key#ENV_}; val=$(echo "$line" | cut -d= -f2-)
|
content = content.replace("__ENV_BLOCK__", os.environ.get("ENV_BLOCK_CONTENT", "").replace("\\n", "\n"))
|
||||||
echo " -e ${clean_key}=${val} \\"
|
content = content.replace("__PORTS_BLOCK__", os.environ.get("PORTS_BLOCK_CONTENT", "").replace("\\n", "\n"))
|
||||||
elif [[ "$line" =~ ^VOL_ ]]; then
|
content = content.replace("__VOL_BLOCK__", os.environ.get("VOL_BLOCK_CONTENT", "").replace("\\n", "\n"))
|
||||||
val=$(echo "$line" | cut -d= -f2-)
|
content = content.replace("__DESCRIPTION__", os.environ.get("DESCRIPTION", "Keine Beschreibung."))
|
||||||
echo " -v ${val} \\"
|
|
||||||
fi
|
|
||||||
done <<< "$all_params"
|
|
||||||
fi
|
|
||||||
echo " $FULL_URL:$BUILD_TAG"
|
|
||||||
} > docker_run_block.txt
|
|
||||||
|
|
||||||
DOCKERHUB_LINK_CONTENT=""
|
if "__DOCKER_RUN__" in content and os.path.exists("docker_run_block.txt"):
|
||||||
if [[ "${{ steps.prep.outputs.push_targets }}" == *"dockerhub"* ]]; then
|
with open("docker_run_block.txt", "r", encoding="utf-8") as f:
|
||||||
DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
|
content = content.replace("__DOCKER_RUN__", f.read())
|
||||||
DOCKERHUB_LINK_CONTENT="[](https://hub.docker.com/r/${DH_USER}/${REPO_PURE})"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Template-Verarbeitung via Python (verhindert awk-Abstürze bei Zeilenumbrüchen)
|
if "__COMPOSE_BLOCK__" in content and os.path.exists("docker-compose.yml"):
|
||||||
process_template() {
|
with open("docker-compose.yml", "r", encoding="utf-8") as f:
|
||||||
local template=$1; local output=$2
|
content = content.replace("__COMPOSE_BLOCK__", f.read())
|
||||||
[ ! -f "$template" ] && return
|
|
||||||
cp "$template" "$output"
|
|
||||||
|
|
||||||
export REPO_PURE FULL_URL BUILD_TAG BASE_IMAGE ARM_STATUS CURRENT_TIME \
|
with open(output_file, "w", encoding="utf-8") as f:
|
||||||
HISTORY_CONTENT DOCKERHUB_LINK_CONTENT ENV_BLOCK_CONTENT \
|
f.write(content)
|
||||||
PORTS_BLOCK_CONTENT VOL_BLOCK_CONTENT DESCRIPTION
|
|
||||||
|
|
||||||
python3 -c '
|
process("docker-compose.yml")
|
||||||
import os, sys
|
process("README.md")
|
||||||
|
EOF
|
||||||
|
|
||||||
output = sys.argv[1]
|
export REPO_PURE FULL_URL BUILD_TAG BASE_IMAGE ARM_STATUS CURRENT_TIME \
|
||||||
|
HISTORY_CONTENT DOCKERHUB_LINK_CONTENT ENV_BLOCK_CONTENT \
|
||||||
|
PORTS_BLOCK_CONTENT VOL_BLOCK_CONTENT DESCRIPTION
|
||||||
|
|
||||||
with open(output, "r", encoding="utf-8") as f:
|
python3 update_script.py
|
||||||
content = f.read()
|
rm -f update_script.py
|
||||||
|
|
||||||
content = content.replace("__REPO_NAME__", os.environ.get("REPO_PURE", ""))
|
echo "FINAL_MSG=$COMMIT_MSG" >> $GITHUB_ENV
|
||||||
content = content.replace("__FULL_URL__", os.environ.get("FULL_URL", ""))
|
{
|
||||||
content = content.replace("__BUILD_TAG__", os.environ.get("BUILD_TAG", ""))
|
echo "DESCRIPTION<<EOF"
|
||||||
content = content.replace("__BASE_IMAGE__", os.environ.get("BASE_IMAGE", ""))
|
echo "$DESCRIPTION"
|
||||||
content = content.replace("__ARM_STATUS__", os.environ.get("ARM_STATUS", ""))
|
echo "EOF"
|
||||||
content = content.replace("__CURRENT_DATE__", os.environ.get("CURRENT_TIME", ""))
|
} >> $GITHUB_ENV
|
||||||
content = content.replace("__HISTORY_CONTENT__", os.environ.get("HISTORY_CONTENT", ""))
|
|
||||||
content = content.replace("__DOCKERHUB_LINK__", os.environ.get("DOCKERHUB_LINK_CONTENT", ""))
|
|
||||||
content = content.replace("__ENV_BLOCK__", os.environ.get("ENV_BLOCK_CONTENT", "").replace("\\n", "\n"))
|
|
||||||
content = content.replace("__PORTS_BLOCK__", os.environ.get("PORTS_BLOCK_CONTENT", "").replace("\\n", "\n"))
|
|
||||||
content = content.replace("__VOL_BLOCK__", os.environ.get("VOL_BLOCK_CONTENT", "").replace("\\n", "\n"))
|
|
||||||
content = content.replace("__DESCRIPTION__", os.environ.get("DESCRIPTION", "Keine Beschreibung."))
|
|
||||||
|
|
||||||
if "__DOCKER_RUN__" in content and os.path.exists("docker_run_block.txt"):
|
- name: Push README to Docker Hub
|
||||||
with open("docker_run_block.txt", "r", encoding="utf-8") as f:
|
if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub')
|
||||||
content = content.replace("__DOCKER_RUN__", f.read())
|
run: |
|
||||||
|
if ! command -v jq &> /dev/null; then
|
||||||
|
apt-get update && apt-get install -y jq || apk add --no-cache jq || true
|
||||||
|
fi
|
||||||
|
|
||||||
if "__COMPOSE_BLOCK__" in content and os.path.exists("docker-compose.yml"):
|
echo "🚀 Starting update README on Docker Hub..."
|
||||||
with open("docker-compose.yml", "r", encoding="utf-8") as f:
|
|
||||||
content = content.replace("__COMPOSE_BLOCK__", f.read())
|
|
||||||
|
|
||||||
with open(output, "w", encoding="utf-8") as f:
|
TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
|
||||||
f.write(content)
|
-H "Content-Type: application/json" \
|
||||||
' "$output"
|
-d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token)
|
||||||
}
|
|
||||||
|
|
||||||
process_template "docker-compose.template" "docker-compose.yml"
|
if [ "$TOKEN" == "null" ] || [ -z "$TOKEN" ]; then
|
||||||
process_template "README.template" "README.md"
|
echo "❌ Error: No login-token available. Check your credentials!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
echo "FINAL_MSG=$COMMIT_MSG" >> $GITHUB_ENV
|
REPO_PURE="${{ steps.prep.outputs.repo_pure }}"
|
||||||
echo "DESCRIPTION<<EOF" >> $GITHUB_ENV
|
DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
|
||||||
echo -e "$DESCRIPTION" >> $GITHUB_ENV
|
GITEA_URL="${{ steps.prep.outputs.image_name }}"
|
||||||
echo "EOF" >> $GITHUB_ENV
|
DH_URL="${DH_USER}/${REPO_PURE}"
|
||||||
|
|
||||||
- name: Push README to Docker Hub
|
SHORT_DESC=$(echo -e "${{ env.DESCRIPTION }}" | head -n 1 | cut -c 1-100)
|
||||||
if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub')
|
[ -z "$SHORT_DESC" ] && SHORT_DESC="Docker Image for $REPO_PURE"
|
||||||
run: |
|
|
||||||
if ! command -v jq &> /dev/null; then
|
|
||||||
apt-get update && apt-get install -y jq || apk add --no-cache jq || true
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "🚀 Starting update README on Docker Hub..."
|
echo "📦 Processing README.md for Docker Hub (${DH_URL})..."
|
||||||
|
|
||||||
TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
|
# Ersetzt die Image-URL NUR dann, wenn kein http:// oder https:// davor steht
|
||||||
-H "Content-Type: application/json" \
|
export GITEA_URL DH_URL
|
||||||
-d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token)
|
python3 -c 'import os, re; content = open("README.md", "r", encoding="utf-8").read(); new_content = re.sub(r"(?<!https://)(?<!http://)" + re.escape(os.environ["GITEA_URL"]), os.environ["DH_URL"], content); open("README_DH.md", "w", encoding="utf-8").write(new_content)'
|
||||||
|
|
||||||
if [ "$TOKEN" == "null" ] || [ -z "$TOKEN" ]; then
|
jq -n \
|
||||||
echo "❌ Error: No login-token available. Check your credentials!"
|
--arg desc "$SHORT_DESC" \
|
||||||
exit 1
|
--rawfile full_desc README_DH.md \
|
||||||
fi
|
'{description: $desc, full_description: $full_desc}' > payload.json
|
||||||
|
|
||||||
REPO_PURE="${{ steps.prep.outputs.repo_pure }}"
|
echo "📤 Sending data to Docker Hub API..."
|
||||||
DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
|
RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
|
||||||
|
"https://hub.docker.com/v2/repositories/${DH_USER}/${REPO_PURE}/" \
|
||||||
|
-H "Authorization: JWT ${TOKEN}" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d @payload.json)
|
||||||
|
|
||||||
SHORT_DESC=$(echo -e "${{ env.DESCRIPTION }}" | head -n 1 | cut -c 1-100)
|
HTTP_STATUS=$(echo "$RESPONSE" | tail -n 1)
|
||||||
[ -z "$SHORT_DESC" ] && SHORT_DESC="Docker Image for $REPO_PURE"
|
BODY=$(echo "$RESPONSE" | head -n -1)
|
||||||
|
|
||||||
echo "📦 Processing README.md (${REPO_PURE})..."
|
if [ "$HTTP_STATUS" -eq 200 ]; then
|
||||||
|
echo "✅ README update successful (HTTP 200)."
|
||||||
|
else
|
||||||
|
echo "❌ Error on update! HTTP Status: $HTTP_STATUS"
|
||||||
|
echo "Answer from Docker Hub: $BODY"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
jq -n \
|
rm -f README_DH.md
|
||||||
--arg desc "$SHORT_DESC" \
|
|
||||||
--rawfile full_desc README.md \
|
|
||||||
'{description: $desc, full_description: $full_desc}' > payload.json
|
|
||||||
|
|
||||||
echo "📤 Sending data to Docker Hub API..."
|
- name: Commit, Tag and Push Changes
|
||||||
RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
|
if: steps.check_changes.outputs.should_build == 'true'
|
||||||
"https://hub.docker.com/v2/repositories/${DH_USER}/${REPO_PURE}/" \
|
run: |
|
||||||
-H "Authorization: JWT ${TOKEN}" \
|
git config --local user.email "action@pi-farm.de"
|
||||||
-H "Content-Type: application/json" \
|
git config --local user.name "Gitea Action"
|
||||||
-d @payload.json)
|
|
||||||
|
|
||||||
HTTP_STATUS=$(echo "$RESPONSE" | tail -n 1)
|
git add VERSION.history README.md docker-compose.yml
|
||||||
BODY=$(echo "$RESPONSE" | head -n -1)
|
|
||||||
|
|
||||||
if [ "$HTTP_STATUS" -eq 200 ]; then
|
git diff --quiet && git diff --staged --quiet || git commit -m "${{ env.FINAL_MSG }} [skip ci]"
|
||||||
echo "✅ README update successfull (HTTP 200)."
|
|
||||||
else
|
|
||||||
echo "❌ Error on update! HTTP Status: $HTTP_STATUS"
|
|
||||||
echo "Answer from Docker Hub: $BODY"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
- name: Commit, Tag and Push Changes
|
TARGET_TAG="${{ steps.prep.outputs.docker_tag }}"
|
||||||
if: steps.check_changes.outputs.should_build == 'true'
|
git tag -f "$TARGET_TAG"
|
||||||
run: |
|
|
||||||
git config --local user.email "action@pi-farm.de"
|
|
||||||
git config --local user.name "Gitea Action"
|
|
||||||
|
|
||||||
git add VERSION.history README.md docker-compose.yml
|
if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then
|
||||||
|
echo "🏷️ Build aus Tag getriggert: $TARGET_TAG"
|
||||||
git diff --quiet && git diff --staged --quiet || git commit -m "${{ env.FINAL_MSG }} [skip ci]"
|
git push -f origin "$TARGET_TAG"
|
||||||
|
else
|
||||||
TARGET_TAG="${{ steps.prep.outputs.docker_tag }}"
|
echo "🌿 Build aus Branch/Schedule getriggert: ${{ gitea.ref_name }}"
|
||||||
git tag -f "$TARGET_TAG"
|
git push origin HEAD:${{ gitea.ref_name }}
|
||||||
|
git push -f origin "$TARGET_TAG"
|
||||||
if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then
|
fi
|
||||||
echo "🏷️ Build aus Tag getriggert: $TARGET_TAG"
|
|
||||||
git push -f origin "$TARGET_TAG"
|
|
||||||
else
|
|
||||||
echo "🌿 Build aus Branch/Schedule getriggert: ${{ gitea.ref_name }}"
|
|
||||||
git push origin HEAD:${{ gitea.ref_name }}
|
|
||||||
git push -f origin "$TARGET_TAG"
|
|
||||||
fi
|
|
||||||
|
|
||||||
- name: Cleanup Temporary Tags on Docker Hub
|
- name: Cleanup Temporary Tags on Docker Hub
|
||||||
if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub')
|
if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub')
|
||||||
@@ -436,17 +474,22 @@ jobs:
|
|||||||
|
|
||||||
TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
|
TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
|
||||||
-H "Content-Type: application/json" \
|
-H "Content-Type: application/json" \
|
||||||
-d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token)
|
-d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token || echo "")
|
||||||
|
|
||||||
if [ "$TOKEN" != "null" ] && [ -n "$TOKEN" ]; then
|
if [ "$TOKEN" != "null" ] && [ -n "$TOKEN" ]; then
|
||||||
REPO_PURE=${{ steps.prep.outputs.repo_pure }}
|
REPO_PURE=${{ steps.prep.outputs.repo_pure }}
|
||||||
DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
|
DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
|
||||||
|
|
||||||
for t in tmp-amd64 tmp-arm64; do
|
CLEAN_TAGS=("tmp-amd64")
|
||||||
|
if [ -f "Dockerfile.aarch64" ]; then
|
||||||
|
CLEAN_TAGS+=("tmp-arm64")
|
||||||
|
fi
|
||||||
|
|
||||||
|
for t in "${CLEAN_TAGS[@]}"; do
|
||||||
echo "Deleting tag $t..."
|
echo "Deleting tag $t..."
|
||||||
STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE \
|
STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE \
|
||||||
"https://hub.docker.com/v2/repositories/${DH_USER}/${REPO_PURE}/tags/$t/" \
|
"https://hub.docker.com/v2/repositories/${DH_USER}/${REPO_PURE}/tags/$t/" \
|
||||||
-H "Authorization: JWT ${TOKEN}")
|
-H "Authorization: JWT ${TOKEN}" || echo "000")
|
||||||
echo "Status: $STATUS"
|
echo "Status: $STATUS"
|
||||||
done
|
done
|
||||||
echo "✅ Temp. tags deleted."
|
echo "✅ Temp. tags deleted."
|
||||||
@@ -455,13 +498,18 @@ jobs:
|
|||||||
- name: Cleanup Temporary Registry Tags (Gitea)
|
- name: Cleanup Temporary Registry Tags (Gitea)
|
||||||
if: steps.check_changes.outputs.should_build == 'true'
|
if: steps.check_changes.outputs.should_build == 'true'
|
||||||
run: |
|
run: |
|
||||||
TOKEN="${{ secrets.GIT_TOKEN }}"
|
TOKEN="${{ secrets.RUNNER_TOKEN }}"
|
||||||
ORG_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f1)
|
ORG_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f1)
|
||||||
REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2)
|
REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2)
|
||||||
|
|
||||||
for t in tmp-amd64 tmp-arm64; do
|
CLEAN_TAGS=("tmp-amd64")
|
||||||
curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/$ORG_NAME/container/$REPO_NAME/$t" -H "Authorization: token $TOKEN"
|
if [ -f "Dockerfile.aarch64" ]; then
|
||||||
curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/${ORG_NAME,,}/container/${REPO_NAME,,}/$t" -H "Authorization: token $TOKEN"
|
CLEAN_TAGS+=("tmp-arm64")
|
||||||
|
fi
|
||||||
|
|
||||||
|
for t in "${CLEAN_TAGS[@]}"; do
|
||||||
|
curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/$ORG_NAME/container/$REPO_NAME/$t" -H "Authorization: token $TOKEN" || true
|
||||||
|
curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/${ORG_NAME,,}/container/${REPO_NAME,,}/$t" -H "Authorization: token $TOKEN" || true
|
||||||
done
|
done
|
||||||
|
|
||||||
- name: Cleanup Docker Artifacts
|
- name: Cleanup Docker Artifacts
|
||||||
|
|||||||
+9
-37
@@ -1,4 +1,4 @@
|
|||||||
ARG BUILD_BASE_IMAGE=debian:bookworm
|
ARG BUILD_BASE_IMAGE
|
||||||
|
|
||||||
FROM ${BUILD_BASE_IMAGE}
|
FROM ${BUILD_BASE_IMAGE}
|
||||||
|
|
||||||
@@ -20,38 +20,13 @@ ENV LC_ALL=${BUILD_LC_ALL}
|
|||||||
ENV COUNTRY=${BUILD_COUNTRY}
|
ENV COUNTRY=${BUILD_COUNTRY}
|
||||||
ENV DEBIAN_FRONTEND=noninteractive
|
ENV DEBIAN_FRONTEND=noninteractive
|
||||||
|
|
||||||
|
COPY packages.txt /tmp/packages.txt
|
||||||
|
|
||||||
RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources && \
|
RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources && \
|
||||||
apt-get update && apt-get install -y \
|
apt-get update && apt-get install -y --no-install-recommends \
|
||||||
xrdp \
|
$(cat /tmp/packages.txt) \
|
||||||
sssd \
|
firefox-esr-l10n-${BUILD_COUNTRY} \
|
||||||
sssd-tools \
|
thunderbird-l10n-${BUILD_COUNTRY} && \
|
||||||
libpam-sss \
|
|
||||||
libnss-sss \
|
|
||||||
libsss-sudo \
|
|
||||||
ldap-utils \
|
|
||||||
ca-certificates \
|
|
||||||
dbus-x11 \
|
|
||||||
xfce4 \
|
|
||||||
xfce4-terminal \
|
|
||||||
sudo \
|
|
||||||
firefox-esr \
|
|
||||||
firefox-esr-l10n-${COUNTRY} \
|
|
||||||
thunderbird \
|
|
||||||
thunderbird-l10n-${COUNTRY} \
|
|
||||||
locales \
|
|
||||||
tzdata \
|
|
||||||
keyboard-configuration \
|
|
||||||
x11-xkb-utils \
|
|
||||||
pulseaudio \
|
|
||||||
build-essential \
|
|
||||||
dpkg-dev \
|
|
||||||
git \
|
|
||||||
libpulse-dev \
|
|
||||||
meson \
|
|
||||||
ninja-build \
|
|
||||||
pkg-config \
|
|
||||||
autoconf \
|
|
||||||
libtool && \
|
|
||||||
apt-get build-dep -y pulseaudio && \
|
apt-get build-dep -y pulseaudio && \
|
||||||
cd /tmp && \
|
cd /tmp && \
|
||||||
apt-get source pulseaudio && \
|
apt-get source pulseaudio && \
|
||||||
@@ -79,12 +54,9 @@ RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.s
|
|||||||
ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime && \
|
ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime && \
|
||||||
dpkg-reconfigure -f noninteractive tzdata && \
|
dpkg-reconfigure -f noninteractive tzdata && \
|
||||||
printf 'XKBMODEL="pc105"\nXKBLAYOUT="%s"\nXKBVARIANT=""\nXKBOPTIONS=""\nBACKSPACE="guess"\n' "${COUNTRY}" > /etc/default/keyboard && \
|
printf 'XKBMODEL="pc105"\nXKBLAYOUT="%s"\nXKBVARIANT=""\nXKBOPTIONS=""\nBACKSPACE="guess"\n' "${COUNTRY}" > /etc/default/keyboard && \
|
||||||
dpkg-reconfigure -f noninteractive keyboard-configuration
|
dpkg-reconfigure -f noninteractive keyboard-configuration && \
|
||||||
|
rm -rf /var/lib/apt/lists/* /tmp/packages.txt
|
||||||
|
|
||||||
# NEU: Systemweite statische Konfigurationen für LDAP/PAM/Sudo
|
|
||||||
# 1. Entfernt die gefährliche %users Regel
|
|
||||||
# 2. Sagt nsswitch, dass Sudoers auch im SSS (LDAP) gesucht werden sollen
|
|
||||||
# 3. Aktiviert das automatische Erstellen von Home-Verzeichnissen (mkhomedir)
|
|
||||||
RUN sed -i '/%users/s/^/# /' /etc/sudoers && \
|
RUN sed -i '/%users/s/^/# /' /etc/sudoers && \
|
||||||
echo "sudoers: files sss" >> /etc/nsswitch.conf && \
|
echo "sudoers: files sss" >> /etc/nsswitch.conf && \
|
||||||
echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0022" >> /etc/pam.d/common-session
|
echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0022" >> /etc/pam.d/common-session
|
||||||
|
|||||||
+9
-33
@@ -1,4 +1,4 @@
|
|||||||
ARG BUILD_BASE_IMAGE=debian:bookworm
|
ARG BUILD_BASE_IMAGE
|
||||||
|
|
||||||
FROM ${BUILD_BASE_IMAGE}
|
FROM ${BUILD_BASE_IMAGE}
|
||||||
|
|
||||||
@@ -20,38 +20,13 @@ ENV LC_ALL=${BUILD_LC_ALL}
|
|||||||
ENV COUNTRY=${BUILD_COUNTRY}
|
ENV COUNTRY=${BUILD_COUNTRY}
|
||||||
ENV DEBIAN_FRONTEND=noninteractive
|
ENV DEBIAN_FRONTEND=noninteractive
|
||||||
|
|
||||||
|
COPY packages.txt /tmp/packages.txt
|
||||||
|
|
||||||
RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources && \
|
RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources && \
|
||||||
apt-get update && apt-get install -y \
|
apt-get update && apt-get install -y --no-install-recommends \
|
||||||
xrdp \
|
$(cat /tmp/packages.txt) \
|
||||||
sssd \
|
firefox-esr-l10n-${BUILD_COUNTRY} \
|
||||||
sssd-tools \
|
thunderbird-l10n-${BUILD_COUNTRY} && \
|
||||||
libpam-sss \
|
|
||||||
libnss-sss \
|
|
||||||
libsss-sudo \
|
|
||||||
ldap-utils \
|
|
||||||
ca-certificates \
|
|
||||||
dbus-x11 \
|
|
||||||
xfce4 \
|
|
||||||
xfce4-terminal \
|
|
||||||
sudo \
|
|
||||||
firefox-esr \
|
|
||||||
firefox-esr-l10n-${COUNTRY} \
|
|
||||||
thunderbird \
|
|
||||||
thunderbird-l10n-${COUNTRY} \
|
|
||||||
locales \
|
|
||||||
tzdata \
|
|
||||||
keyboard-configuration \
|
|
||||||
x11-xkb-utils \
|
|
||||||
pulseaudio \
|
|
||||||
build-essential \
|
|
||||||
dpkg-dev \
|
|
||||||
git \
|
|
||||||
libpulse-dev \
|
|
||||||
meson \
|
|
||||||
ninja-build \
|
|
||||||
pkg-config \
|
|
||||||
autoconf \
|
|
||||||
libtool && \
|
|
||||||
apt-get build-dep -y pulseaudio && \
|
apt-get build-dep -y pulseaudio && \
|
||||||
cd /tmp && \
|
cd /tmp && \
|
||||||
apt-get source pulseaudio && \
|
apt-get source pulseaudio && \
|
||||||
@@ -79,7 +54,8 @@ RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.s
|
|||||||
ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime && \
|
ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime && \
|
||||||
dpkg-reconfigure -f noninteractive tzdata && \
|
dpkg-reconfigure -f noninteractive tzdata && \
|
||||||
printf 'XKBMODEL="pc105"\nXKBLAYOUT="%s"\nXKBVARIANT=""\nXKBOPTIONS=""\nBACKSPACE="guess"\n' "${COUNTRY}" > /etc/default/keyboard && \
|
printf 'XKBMODEL="pc105"\nXKBLAYOUT="%s"\nXKBVARIANT=""\nXKBOPTIONS=""\nBACKSPACE="guess"\n' "${COUNTRY}" > /etc/default/keyboard && \
|
||||||
dpkg-reconfigure -f noninteractive keyboard-configuration
|
dpkg-reconfigure -f noninteractive keyboard-configuration && \
|
||||||
|
rm -rf /var/lib/apt/lists/* /tmp/packages.txt
|
||||||
|
|
||||||
# NEU: Systemweite statische Konfigurationen für LDAP/PAM/Sudo
|
# NEU: Systemweite statische Konfigurationen für LDAP/PAM/Sudo
|
||||||
# 1. Entfernt die gefährliche %users Regel
|
# 1. Entfernt die gefährliche %users Regel
|
||||||
|
|||||||
@@ -1,32 +1,37 @@
|
|||||||
# base-image-debian-rdp-ldap
|
# base-image-debian-rdp-ldap
|
||||||
Debian Desktop with LDAP-Authentication and Pulse-Audio. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop.
|
Debian Desktop with LDAP Authentication and PulseAudio. To use behind Guacamole with LDAP Authentication and pass-through to Debian Desktop.
|
||||||
|
|
||||||
[](https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions)
|
<a href="https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions" target="_blank" rel="noopener noreferrer">
|
||||||
[](__REPO_URL__)
|
<img src="https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions/workflows/build-and-push.yaml/badge.svg" alt="Build Status">
|
||||||
|
</a>
|
||||||
|
<a href="https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap" target="_blank" rel="noopener noreferrer">
|
||||||
|
<img src="https://img.shields.io/badge/gitea-pi--farm-609930?logo=gitea&logoColor=white" alt="Gitea Repository">
|
||||||
|
</a>
|
||||||
|
|
||||||
This repository is built and pushed automatically.
|
This repository is built and pushed automatically.
|
||||||
|
|
||||||
[](https://hub.docker.com/r/pifarm/base-image-debian-rdp-ldap)
|
<a href="https://hub.docker.com/r/pifarm/base-image-debian-rdp-ldap" target="_blank" rel="noopener noreferrer"><img src="https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white" alt="Docker Hub"></a>
|
||||||
|
|
||||||
### 🏗️ Platform Support
|
### 🏗️ Platform Support
|
||||||
| Architecture | Status | Base Image | Build Date |
|
| Architecture | Status | Base Image | Build Date |
|
||||||
| :--- | :--- | :--- | :--- |
|
| :--- | :--- | :--- | :--- |
|
||||||
| x86_64 (amd64) | ✅ Active | debian:trixie | 09.08.2026 07:29 |
|
| x86_64 (amd64) | ✅ Active | debian:trixie | 08.10.2026 22:15 |
|
||||||
| aarch64 (arm64) | ✅ Active | debian:trixie | 09.08.2026 07:29 |
|
| aarch64 (arm64) | ✅ Active | debian:trixie | 08.10.2026 22:15 |
|
||||||
|
|
||||||
### 🚀 Docker Pull
|
---
|
||||||
```bash
|
|
||||||
docker pull git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de
|
## 🐙 Method 1: Docker Compose (Recommended)
|
||||||
```
|
|
||||||
### 🚀 Docker Compose
|
### 🚀 1. Create `docker-compose.yml`
|
||||||
```yaml
|
```yaml
|
||||||
services:
|
services:
|
||||||
base-image-debian-rdp-ldap:
|
base-image-debian-rdp-ldap:
|
||||||
image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de
|
image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de-dev
|
||||||
container_name: base-image-debian-rdp-ldap
|
container_name: base-image-debian-rdp-ldap
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
ports:
|
ports:
|
||||||
- 3889
|
- 3389:3389
|
||||||
|
|
||||||
environment:
|
environment:
|
||||||
- SSSD_DEBUG_LEVEL=5
|
- SSSD_DEBUG_LEVEL=5
|
||||||
- LDAP_URI=ldap://YOUR-LDAP-SERVER:389
|
- LDAP_URI=ldap://YOUR-LDAP-SERVER:389
|
||||||
@@ -34,10 +39,28 @@ services:
|
|||||||
- LDAP_BIND_DN=cn=YOUR-BIND-USER,dc=YOUR-DOMAIN,dc=LOC
|
- LDAP_BIND_DN=cn=YOUR-BIND-USER,dc=YOUR-DOMAIN,dc=LOC
|
||||||
- LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD
|
- LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD
|
||||||
- LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP
|
- LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP
|
||||||
|
|
||||||
volumes:
|
volumes:
|
||||||
- ./YOUR-PERSISTENT-FOLDER:/home
|
- ./YOUR-PERSISTENT-FOLDER:/home
|
||||||
|
|
||||||
```
|
```
|
||||||
### 🚀 Docker Run
|
### 🚀 2. Pull & start the container
|
||||||
|
### Pull or update the image
|
||||||
|
```bash
|
||||||
|
docker compose pull
|
||||||
|
```
|
||||||
|
### Start container in background
|
||||||
|
```bash
|
||||||
|
docker compose up -d
|
||||||
|
```
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🐳 Method 2: Standalone Container (Docker Run / CLI)
|
||||||
|
### 🚀 1. Pull the image manually
|
||||||
|
```bash
|
||||||
|
docker pull git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de-dev
|
||||||
|
```
|
||||||
|
### 🚀 2. Run the container directly
|
||||||
```bash
|
```bash
|
||||||
docker run -d \
|
docker run -d \
|
||||||
--name base-image-debian-rdp-ldap \
|
--name base-image-debian-rdp-ldap \
|
||||||
@@ -49,26 +72,27 @@ docker run -d \
|
|||||||
-e LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD \
|
-e LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD \
|
||||||
-e LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP \
|
-e LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP \
|
||||||
-v ./YOUR-PERSISTENT-FOLDER:/home \
|
-v ./YOUR-PERSISTENT-FOLDER:/home \
|
||||||
-p 3889 \
|
-p 3389:3389 \
|
||||||
git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de
|
git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de-dev
|
||||||
|
|
||||||
```
|
```
|
||||||
|
|
||||||
*Last updated on: 09.08.2026 07:29*
|
*Last updated on: 08.10.2026 22:15*
|
||||||
|
|
||||||
### 📜 Version History
|
### 📜 Version History
|
||||||
| Version | Date | Status |
|
| Version | Date | Status |
|
||||||
| :--- | :--- | :--- |
|
| :--- | :--- | :--- |
|
||||||
| **trixie-de** | 09.08.2026 07:29 | ✅ |
|
| **trixie-de-dev** | 08.10.2026 22:15 | ✅ |
|
||||||
| **trixie-de** | 19.07.2026 07:26 | ✅ |
|
| **trixie-de-dev** | 08.10.2026 20:57 | ✅ |
|
||||||
| **trixie-de** | 28.06.2026 07:27 | ✅ |
|
| **trixie-de-dev** | 08.10.2026 17:56 | ✅ |
|
||||||
| **trixie-de** | 14.06.2026 07:25 | ✅ |
|
| **trixie-de-dev** | 08.10.2026 17:30 | ✅ |
|
||||||
| **trixie-de** | 04.06.2026 13:41 | build trixie-de latest ✅ |
|
| **trixie-de-dev** | 08.10.2026 17:04 | entrypoint.sh aktualisiert ✅ |
|
||||||
| **trixie-de** | 04.06.2026 12:25 | Trixie build ✅ |
|
| **trixie-de-dev** | 08.10.2026 15:39 | ✅ |
|
||||||
| **bookworm-de** | 02.06.2026 18:17 | .gitea/workflows/build-and-push.yaml aktualisiert ✅ |
|
| **trixie-de-dev** | 08.10.2026 15:20 | fix typo ✅ |
|
||||||
| **bookworm-de** | 02.06.2026 17:04 | ✅ |
|
| **trixie-de-dev** | 08.10.2026 15:17 | fix dbus container-restart ✅ |
|
||||||
| **bookworm-de** | 24.05.2026 07:22 | ✅ |
|
| **trixie-de-dev** | 08.10.2026 14:21 | ✅ |
|
||||||
| **bookworm-de** | 10.05.2026 07:21 | ✅ |
|
| **bookworm-de-dev** | 08.10.2026 14:01 | ✅ |
|
||||||
| **bookworm-de** | 26.04.2026 07:23 | ✅ |
|
| **bookworm-de-dev** | 08.10.2026 13:52 | ✅ |
|
||||||
| **bookworm-de** | 09.04.2026 17:19 | build for bookworm ✅ |
|
| **bookworm-de-dev** | 08.10.2026 12:51 | ✅ |
|
||||||
| **trixie-de** | 09.04.2026 16:44 | build for trixie-de ✅ |
|
| **trixie-de-dev** | 08.10.2026 12:32 | ✅ |
|
||||||
| **bookworm-de** | 09.04.2026 16:15 | Merge pull request dev (#2) from dev into main Reviewed-on: https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/pulls/2 ✅ |
|
| **trixie-de-dev** | 08.10.2026 12:27 | ✅ |
|
||||||
+14
-15
@@ -1,15 +1,14 @@
|
|||||||
| **trixie-de** | 06.10.2026 17:30 | .gitea/workflows/build-and-push.yaml aktualisiert ✅ |
|
| **trixie-de-dev** | 08.10.2026 22:15 | ✅ |
|
||||||
| **trixie-de** | 09.08.2026 07:29 | ✅ |
|
| **trixie-de-dev** | 08.10.2026 20:57 | ✅ |
|
||||||
| **trixie-de** | 19.07.2026 07:26 | ✅ |
|
| **trixie-de-dev** | 08.10.2026 17:56 | ✅ |
|
||||||
| **trixie-de** | 28.06.2026 07:27 | ✅ |
|
| **trixie-de-dev** | 08.10.2026 17:30 | ✅ |
|
||||||
| **trixie-de** | 14.06.2026 07:25 | ✅ |
|
| **trixie-de-dev** | 08.10.2026 17:04 | entrypoint.sh aktualisiert ✅ |
|
||||||
| **trixie-de** | 04.06.2026 13:41 | build trixie-de latest ✅ |
|
| **trixie-de-dev** | 08.10.2026 15:39 | ✅ |
|
||||||
| **trixie-de** | 04.06.2026 12:25 | Trixie build ✅ |
|
| **trixie-de-dev** | 08.10.2026 15:20 | fix typo ✅ |
|
||||||
| **bookworm-de** | 02.06.2026 18:17 | .gitea/workflows/build-and-push.yaml aktualisiert ✅ |
|
| **trixie-de-dev** | 08.10.2026 15:17 | fix dbus container-restart ✅ |
|
||||||
| **bookworm-de** | 02.06.2026 17:04 | ✅ |
|
| **trixie-de-dev** | 08.10.2026 14:21 | ✅ |
|
||||||
| **bookworm-de** | 24.05.2026 07:22 | ✅ |
|
| **bookworm-de-dev** | 08.10.2026 14:01 | ✅ |
|
||||||
| **bookworm-de** | 10.05.2026 07:21 | ✅ |
|
| **bookworm-de-dev** | 08.10.2026 13:52 | ✅ |
|
||||||
| **bookworm-de** | 26.04.2026 07:23 | ✅ |
|
| **bookworm-de-dev** | 08.10.2026 12:51 | ✅ |
|
||||||
| **bookworm-de** | 09.04.2026 17:19 | build for bookworm ✅ |
|
| **trixie-de-dev** | 08.10.2026 12:32 | ✅ |
|
||||||
| **trixie-de** | 09.04.2026 16:44 | build for trixie-de ✅ |
|
| **trixie-de-dev** | 08.10.2026 12:27 | ✅ |
|
||||||
| **bookworm-de** | 09.04.2026 16:15 | Merge pull request dev (#2) from dev into main Reviewed-on: https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/pulls/2 ✅ |
|
|
||||||
+11
-5
@@ -1,7 +1,10 @@
|
|||||||
## BUILD STAGE
|
## BASE CONFIG
|
||||||
BUILD_BASE_IMAGE=debian:trixie
|
DEBIAN_CODENAME=trixie
|
||||||
BUILD_COUNTRY=de
|
BUILD_COUNTRY=de
|
||||||
BUILD_TAG=trixie-de
|
|
||||||
|
## BUILD STAGE
|
||||||
|
BUILD_BASE_IMAGE="debian:${DEBIAN_CODENAME}"
|
||||||
|
BUILD_TAG="${DEBIAN_CODENAME}-${BUILD_COUNTRY}"
|
||||||
BUILD_TAG_LATEST=y
|
BUILD_TAG_LATEST=y
|
||||||
BUILD_LANG=de_DE.UTF-8
|
BUILD_LANG=de_DE.UTF-8
|
||||||
BUILD_LANGUAGE=de_DE:de
|
BUILD_LANGUAGE=de_DE:de
|
||||||
@@ -12,6 +15,9 @@ BUILD_APP_NAME=base-image-debian-rdp-ldap
|
|||||||
BUILD_APP_VERSION=1.0.0
|
BUILD_APP_VERSION=1.0.0
|
||||||
PUSH=dockerhub
|
PUSH=dockerhub
|
||||||
|
|
||||||
|
## BASE PACKAGES
|
||||||
|
BUILD_BASE_PACKAGES="xrdp sssd sssd-tools libpam-sss libnss-sss libsss-sudo ldap-utils ca-certificates dbus-x11 xfce4 xfce4-terminal sudo firefox-esr firefox-esr-l10n-${BUILD_COUNTRY} thunderbird thunderbird-l10n-${BUILD_COUNTRY} locales tzdata keyboard-configuration x11-xkb-utils pulseaudio build-essential dpkg-dev git libpulse-dev meson ninja-build pkg-config autoconf libtool thunar-archive-plugin xarchiver unzip zip p7zip-full tar gzip bzip2 dialog whiptail"
|
||||||
|
|
||||||
## ENV STAGE
|
## ENV STAGE
|
||||||
ENV_SSSD_DEBUG_LEVEL=5
|
ENV_SSSD_DEBUG_LEVEL=5
|
||||||
ENV_LDAP_URI=ldap://YOUR-LDAP-SERVER:389
|
ENV_LDAP_URI=ldap://YOUR-LDAP-SERVER:389
|
||||||
@@ -22,6 +28,6 @@ ENV_LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP
|
|||||||
|
|
||||||
## DOCKER / COMPOSE CONFIG
|
## DOCKER / COMPOSE CONFIG
|
||||||
VOL_HOME=./YOUR-PERSISTENT-FOLDER:/home
|
VOL_HOME=./YOUR-PERSISTENT-FOLDER:/home
|
||||||
PORT_RDP=3889
|
PORT_RDP=3389:3389
|
||||||
|
|
||||||
DESCRIPTION="Debian Desktop with LDAP-Authentication and Pulse-Audio. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop."
|
DESCRIPTION="Debian Desktop with LDAP Authentication and PulseAudio. To use behind Guacamole with LDAP Authentication and pass-through to Debian Desktop."
|
||||||
+18
-281
@@ -1,281 +1,18 @@
|
|||||||
<!DOCTYPE html>
|
services:
|
||||||
<html lang="en-US" data-theme="gitea-auto">
|
base-image-debian-rdp-ldap:
|
||||||
<head>
|
image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de-dev
|
||||||
<meta http-equiv="Content-Security-Policy" content="default-src * data: blob:;script-src * 'nonce-2f1114650edc4dcd89ad1b32c2c5a1c0';style-src * 'unsafe-inline';">
|
container_name: base-image-debian-rdp-ldap
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
restart: unless-stopped
|
||||||
<title>Sign In - Gitea: Git with a cup of tea</title>
|
ports:
|
||||||
<link rel="manifest" href="/assets/site-manifest.json">
|
- 3389:3389
|
||||||
<meta name="author" content="Gitea - Git with a cup of tea">
|
|
||||||
<meta name="description" content="Gitea (Git with a cup of tea) is a painless self-hosted Git service written in Go">
|
environment:
|
||||||
<meta name="keywords" content="go,git,self-hosted,gitea">
|
- SSSD_DEBUG_LEVEL=5
|
||||||
<meta name="referrer" content="same-origin">
|
- LDAP_URI=ldap://YOUR-LDAP-SERVER:389
|
||||||
|
- LDAP_BASE_DN=dc=YOUR-DOMAIN,dc=LOC
|
||||||
|
- LDAP_BIND_DN=cn=YOUR-BIND-USER,dc=YOUR-DOMAIN,dc=LOC
|
||||||
<link rel="icon" href="/assets/img/favicon.svg" type="image/svg+xml">
|
- LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD
|
||||||
<link rel="alternate icon" href="/assets/img/favicon.png" type="image/png">
|
- LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP
|
||||||
|
|
||||||
<meta property="og:title" content="Gitea: Git with a cup of tea">
|
volumes:
|
||||||
<meta property="og:type" content="website">
|
- ./YOUR-PERSISTENT-FOLDER:/home
|
||||||
<meta property="og:image" content="/assets/img/logo.png">
|
|
||||||
<meta property="og:url" content="https://git.pi-farm.de">
|
|
||||||
<meta property="og:description" content="Gitea (Git with a cup of tea) is a painless self-hosted Git service written in Go">
|
|
||||||
|
|
||||||
<meta property="og:site_name" content="Gitea: Git with a cup of tea">
|
|
||||||
|
|
||||||
<link rel="stylesheet" href="/assets/css/index.BHUwT9fG.css">
|
|
||||||
<link rel="stylesheet" href="/assets/css/theme-gitea-auto.v3RW7v-i.css">
|
|
||||||
|
|
||||||
|
|
||||||
<script nonce="2f1114650edc4dcd89ad1b32c2c5a1c0">
|
|
||||||
|
|
||||||
window.addEventListener('error', function(e) {window._globalHandlerErrors=window._globalHandlerErrors||[]; window._globalHandlerErrors.push(e);});
|
|
||||||
window.addEventListener('unhandledrejection', function(e) {window._globalHandlerErrors=window._globalHandlerErrors||[]; window._globalHandlerErrors.push(e);});
|
|
||||||
window.config = {
|
|
||||||
appUrl: 'https:\/\/git.pi-farm.de\/',
|
|
||||||
appSubUrl: '',
|
|
||||||
assetUrlPrefix: '\/assets',
|
|
||||||
runModeIsProd: true ,
|
|
||||||
customEmojis: {"codeberg":":codeberg:","git":":git:","gitea":":gitea:","github":":github:","gitlab":":gitlab:","gogs":":gogs:"},
|
|
||||||
pageData: {},
|
|
||||||
notificationSettings: {"EventSourceUpdateTime":10000,"MaxTimeout":60000,"MinTimeout":10000,"TimeoutStep":10000},
|
|
||||||
enableTimeTracking: true ,
|
|
||||||
mermaidMaxSourceCharacters: 50000 ,
|
|
||||||
sharedWorkerUri: '\/assets\/js\/eventsource.sharedworker.DV1Z2uJv.js',
|
|
||||||
|
|
||||||
i18n: {
|
|
||||||
error_occurred: "An error occurred",
|
|
||||||
remove_label_str: "Remove item \"%s\"",
|
|
||||||
modal_confirm: "Confirm",
|
|
||||||
modal_cancel: "Cancel",
|
|
||||||
more_items: "More items",
|
|
||||||
copy_success: "Copied!",
|
|
||||||
copy_error: "Copy failed",
|
|
||||||
},
|
|
||||||
};
|
|
||||||
|
|
||||||
window.config.pageData = window.config.pageData || {};
|
|
||||||
</script>
|
|
||||||
<script nonce="2f1114650edc4dcd89ad1b32c2c5a1c0" src="/assets/js/iife.D2XhYhS2.js"></script>
|
|
||||||
|
|
||||||
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
|
|
||||||
|
|
||||||
<div class="full height">
|
|
||||||
<noscript>This website requires JavaScript.</noscript>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<nav id="navbar" aria-label="Navigation Bar">
|
|
||||||
<div class="navbar-left">
|
|
||||||
|
|
||||||
<a class="item" id="navbar-logo" href="/" aria-label="Home">
|
|
||||||
<img width="30" height="30" src="/assets/img/logo.svg" alt="Logo" aria-hidden="true">
|
|
||||||
</a>
|
|
||||||
|
|
||||||
|
|
||||||
<div class="ui secondary menu navbar-mobile-right only-mobile">
|
|
||||||
|
|
||||||
|
|
||||||
<button class="item ui icon mini button tw-m-0" id="navbar-expand-toggle" aria-label="Navigation Menu"><svg viewBox="0 0 16 16" class="svg octicon-three-bars" aria-hidden="true" width="16" height="16"><path d="M1 2.75A.75.75 0 0 1 1.75 2h12.5a.75.75 0 0 1 0 1.5H1.75A.75.75 0 0 1 1 2.75m0 5A.75.75 0 0 1 1.75 7h12.5a.75.75 0 0 1 0 1.5H1.75A.75.75 0 0 1 1 7.75M1.75 12h12.5a.75.75 0 0 1 0 1.5H1.75a.75.75 0 0 1 0-1.5"/></svg></button>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<a class="item" href="/explore/repos">Explore</a>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<a class="item" target="_blank" href="https://docs.gitea.com">Help</a>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
|
|
||||||
<div class="navbar-right">
|
|
||||||
|
|
||||||
|
|
||||||
<a class="item active" rel="nofollow" href="/user/login">
|
|
||||||
<svg viewBox="0 0 16 16" class="svg octicon-sign-in" aria-hidden="true" width="16" height="16"><path d="M2 2.75C2 1.784 2.784 1 3.75 1h2.5a.75.75 0 0 1 0 1.5h-2.5a.25.25 0 0 0-.25.25v10.5c0 .138.112.25.25.25h2.5a.75.75 0 0 1 0 1.5h-2.5A1.75 1.75 0 0 1 2 13.25Zm6.56 4.5h5.69a.75.75 0 0 1 0 1.5H8.56l1.97 1.97a.749.749 0 0 1-.326 1.275.75.75 0 0 1-.734-.215L6.22 8.53a.75.75 0 0 1 0-1.06l3.25-3.25a.749.749 0 0 1 1.275.326.75.75 0 0 1-.215.734Z"/></svg>
|
|
||||||
<span class="tw-ml-1">Sign In</span>
|
|
||||||
</a>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</nav>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<div role="main" aria-label="Sign In" class="page-content user signin">
|
|
||||||
<div class="ui middle very relaxed page grid">
|
|
||||||
|
|
||||||
<div class="column tw-flex tw-flex-col tw-gap-4 tw-max-w-2xl tw-m-auto">
|
|
||||||
<div class="ui container fluid">
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<h4 class="ui top attached header center">
|
|
||||||
|
|
||||||
Sign In
|
|
||||||
|
|
||||||
</h4>
|
|
||||||
<div class="ui attached segment">
|
|
||||||
|
|
||||||
<form class="ui form" action="/user/login" method="post">
|
|
||||||
<div class="required field ">
|
|
||||||
<label for="user_name">Username or Email Address</label>
|
|
||||||
<input id="user_name" type="text" name="user_name" value="" autofocus required tabindex="1">
|
|
||||||
</div>
|
|
||||||
|
|
||||||
<div class="required field ">
|
|
||||||
<div class="tw-flex tw-mb-1">
|
|
||||||
<label for="password" class="tw-flex-1">Password</label>
|
|
||||||
<a href="/user/forgot_password" tabindex="4">Forgot password?</a>
|
|
||||||
</div>
|
|
||||||
<input id="password" name="password" type="password" value="" autocomplete="current-password" required tabindex="2">
|
|
||||||
</div>
|
|
||||||
|
|
||||||
|
|
||||||
<div class="inline field">
|
|
||||||
<div class="ui checkbox">
|
|
||||||
<label>Remember This Device</label>
|
|
||||||
<input name="remember" type="checkbox" tabindex="5">
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<div class="field">
|
|
||||||
<button class="ui primary button tw-w-full" tabindex="3">
|
|
||||||
|
|
||||||
Sign In
|
|
||||||
|
|
||||||
</button>
|
|
||||||
</div>
|
|
||||||
</form>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
|
|
||||||
<div class="ui container fluid">
|
|
||||||
<div class="ui attached segment header top tw-max-w-2xl tw-m-auto tw-flex tw-flex-col tw-items-center">
|
|
||||||
|
|
||||||
<div id="webauthn-error" class="ui negative message tw-hidden">
|
|
||||||
<div class="header">Could not read your security key.</div>
|
|
||||||
<div id="webauthn-error-msg" class="tw-pt-2"></div>
|
|
||||||
<div class="tw-hidden">
|
|
||||||
<div data-webauthn-error-msg="browser">Your browser does not currently support WebAuthn.</div>
|
|
||||||
<div data-webauthn-error-msg="unknown">An unknown error occurred. Please retry.</div>
|
|
||||||
<div data-webauthn-error-msg="insecure">WebAuthn only supports secure connections. For testing over HTTP, you can use the origin "localhost" or "127.0.0.1".</div>
|
|
||||||
<div data-webauthn-error-msg="unable-to-process">The server could not process your request.</div>
|
|
||||||
<div data-webauthn-error-msg="duplicated">The security key is not permitted for this request. Please make sure that the key is not already registered.</div>
|
|
||||||
<div data-webauthn-error-msg="empty">You must set a name for this key.</div>
|
|
||||||
<div data-webauthn-error-msg="timeout">Timeout reached before your key could be read. Please reload this page and retry.</div>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
<a class="signin-passkey">Sign in with a passkey</a>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
<footer class="page-footer" role="group" aria-label="Footer">
|
|
||||||
<div class="left-links" role="contentinfo" aria-label="About Software">
|
|
||||||
|
|
||||||
<a target="_blank" href="https://about.gitea.com">Powered by Gitea</a>
|
|
||||||
|
|
||||||
|
|
||||||
<span>
|
|
||||||
Version:
|
|
||||||
|
|
||||||
1.27.2
|
|
||||||
|
|
||||||
</span>
|
|
||||||
|
|
||||||
|
|
||||||
<span>
|
|
||||||
Page: <strong>2ms</strong>
|
|
||||||
Template: <strong>0ms</strong>
|
|
||||||
</span>
|
|
||||||
|
|
||||||
|
|
||||||
</div>
|
|
||||||
<div class="right-links" role="group" aria-label="Links">
|
|
||||||
<div class="ui dropdown custom" id="footer-theme-selector">
|
|
||||||
<span class="default-text"><div class="theme-menu-item" data-tooltip-content=""><svg viewBox="490 490 820 820" class="svg gitea-eclipse" aria-hidden="true" width="16" height="16"><path d="M866.7 582.1A321.3 321.3 0 0 0 738.6 623a317.3 317.3 0 0 0-109.1 108.5A418 418 0 0 0 609 772a335.3 335.3 0 0 0-19.6 71.5 205.2 205.2 0 0 0-2.8 45c0 25.8.2 29.3 2.8 45 4.1 25.4 9.9 46.4 19.6 71.5a314.2 314.2 0 0 0 111.6 137.3A306.8 306.8 0 0 0 893 1196a308.6 308.6 0 0 0 303.6-262.5c2.6-15.7 2.8-19.2 2.8-45s-.2-29.3-2.8-45A335.3 335.3 0 0 0 1177 772a314.2 314.2 0 0 0-111.6-137.3A308.3 308.3 0 0 0 918 582c-13-1.1-38.2-1.1-51.3.1M747 663.5l-2.4 16.7c-4 26.4-4.9 41.1-4.3 65.3a323.7 323.7 0 0 0 37.2 145c18.2 36 41.3 66.6 72 95.5a346.4 346.4 0 0 0 208.5 93.1l18 1.6 4.5.5-8.5 8a259.3 259.3 0 0 1-141.5 65.8 281 281 0 0 1-123.9-11.4 267.2 267.2 0 0 1-181.7-269.9c2-27.6 5.7-47.6 13.3-70.7a281.2 281.2 0 0 1 46.4-85c8-10.1 28-30.2 37.9-38.1 13.8-11.1 24.5-18.3 24.5-16.4"/></svg> Auto </div></span>
|
|
||||||
<div class="menu theme-menu"></div>
|
|
||||||
</div>
|
|
||||||
<div class="ui dropdown upward">
|
|
||||||
<span class="flex-text-inline"><svg viewBox="0 0 16 16" class="svg octicon-globe" aria-hidden="true" width="14" height="14"><path d="M8 0a8 8 0 1 1 0 16A8 8 0 0 1 8 0M5.78 8.75a9.64 9.64 0 0 0 1.363 4.177q.383.64.857 1.215c.245-.296.551-.705.857-1.215A9.64 9.64 0 0 0 10.22 8.75Zm4.44-1.5a9.64 9.64 0 0 0-1.363-4.177c-.307-.51-.612-.919-.857-1.215a10 10 0 0 0-.857 1.215A9.64 9.64 0 0 0 5.78 7.25Zm-5.944 1.5H1.543a6.51 6.51 0 0 0 4.666 5.5q-.184-.271-.352-.552c-.715-1.192-1.437-2.874-1.581-4.948m-2.733-1.5h2.733c.144-2.074.866-3.756 1.58-4.948q.18-.295.353-.552a6.51 6.51 0 0 0-4.666 5.5m10.181 1.5c-.144 2.074-.866 3.756-1.58 4.948q-.18.296-.353.552a6.51 6.51 0 0 0 4.666-5.5Zm2.733-1.5a6.51 6.51 0 0 0-4.666-5.5q.184.272.353.552c.714 1.192 1.436 2.874 1.58 4.948Z"/></svg> English</span>
|
|
||||||
<div class="menu language-menu">
|
|
||||||
<a lang="id-ID" data-url="/?lang=id-ID" class="item ">Bahasa Indonesia</a>
|
|
||||||
<a lang="de-DE" data-url="/?lang=de-DE" class="item ">Deutsch</a>
|
|
||||||
<a lang="en-US" data-url="/?lang=en-US" class="item selected">English</a>
|
|
||||||
<a lang="es-ES" data-url="/?lang=es-ES" class="item ">Español</a>
|
|
||||||
<a lang="fr-FR" data-url="/?lang=fr-FR" class="item ">Français</a>
|
|
||||||
<a lang="ga-IE" data-url="/?lang=ga-IE" class="item ">Gaeilge</a>
|
|
||||||
<a lang="it-IT" data-url="/?lang=it-IT" class="item ">Italiano</a>
|
|
||||||
<a lang="lv-LV" data-url="/?lang=lv-LV" class="item ">Latviešu</a>
|
|
||||||
<a lang="hu-HU" data-url="/?lang=hu-HU" class="item ">Magyar nyelv</a>
|
|
||||||
<a lang="nl-NL" data-url="/?lang=nl-NL" class="item ">Nederlands</a>
|
|
||||||
<a lang="pl-PL" data-url="/?lang=pl-PL" class="item ">Polski</a>
|
|
||||||
<a lang="pt-PT" data-url="/?lang=pt-PT" class="item ">Português de Portugal</a>
|
|
||||||
<a lang="pt-BR" data-url="/?lang=pt-BR" class="item ">Português do Brasil</a>
|
|
||||||
<a lang="fi-FI" data-url="/?lang=fi-FI" class="item ">Suomi</a>
|
|
||||||
<a lang="sv-SE" data-url="/?lang=sv-SE" class="item ">Svenska</a>
|
|
||||||
<a lang="tr-TR" data-url="/?lang=tr-TR" class="item ">Türkçe</a>
|
|
||||||
<a lang="cs-CZ" data-url="/?lang=cs-CZ" class="item ">Čeština</a>
|
|
||||||
<a lang="el-GR" data-url="/?lang=el-GR" class="item ">Ελληνικά</a>
|
|
||||||
<a lang="bg-BG" data-url="/?lang=bg-BG" class="item ">Български</a>
|
|
||||||
<a lang="ru-RU" data-url="/?lang=ru-RU" class="item ">Русский</a>
|
|
||||||
<a lang="uk-UA" data-url="/?lang=uk-UA" class="item ">Українська</a>
|
|
||||||
<a lang="fa-IR" data-url="/?lang=fa-IR" class="item ">فارسی</a>
|
|
||||||
<a lang="ml-IN" data-url="/?lang=ml-IN" class="item ">മലയാളം</a>
|
|
||||||
<a lang="ja-JP" data-url="/?lang=ja-JP" class="item ">日本語</a>
|
|
||||||
<a lang="zh-CN" data-url="/?lang=zh-CN" class="item ">简体中文</a>
|
|
||||||
<a lang="zh-TW" data-url="/?lang=zh-TW" class="item ">繁體中文（台灣）</a>
|
|
||||||
<a lang="zh-HK" data-url="/?lang=zh-HK" class="item ">繁體中文（香港）</a>
|
|
||||||
<a lang="ko-KR" data-url="/?lang=ko-KR" class="item ">한국어</a>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
<a href="/assets/licenses.txt">Licenses</a>
|
|
||||||
<a href="/api/swagger">API</a>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
</footer>
|
|
||||||
|
|
||||||
<script nonce="2f1114650edc4dcd89ad1b32c2c5a1c0" type="module" src="/assets/js/index.8BwIzI4A.js"></script>
|
|
||||||
|
|
||||||
<script nonce="2f1114650edc4dcd89ad1b32c2c5a1c0" type="module">
|
|
||||||
if (!window.config?.frontendInited && window.config?.runModeIsProd) alert("Frontend is not initialized, check console errors or asset files.");
|
|
||||||
</script>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
|
|
||||||
+15
-8
@@ -1,8 +1,6 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
set -e
|
set -e
|
||||||
|
|
||||||
# Mapping der Gitea-Workflow Variablen (ENV_...) auf interne Variablen
|
|
||||||
# Falls ENV_LDAP_URI nicht gesetzt ist, wird ein Fallback genutzt
|
|
||||||
LDAP_URI=${LDAP_URI:-"ldap://localhost:389"}
|
LDAP_URI=${LDAP_URI:-"ldap://localhost:389"}
|
||||||
LDAP_BASE_DN=${LDAP_BASE_DN:-"dc=example,dc=com"}
|
LDAP_BASE_DN=${LDAP_BASE_DN:-"dc=example,dc=com"}
|
||||||
LDAP_BIND_DN=${LDAP_BIND_DN:-"cn=admin,dc=example,dc=com"}
|
LDAP_BIND_DN=${LDAP_BIND_DN:-"cn=admin,dc=example,dc=com"}
|
||||||
@@ -32,10 +30,9 @@ ldap_default_authtok = ${LDAP_BIND_PASSWORD}
|
|||||||
|
|
||||||
ldap_schema = rfc2307bis
|
ldap_schema = rfc2307bis
|
||||||
ldap_group_member = uniqueMember
|
ldap_group_member = uniqueMember
|
||||||
|
ldap_auth_disable_tls_never_use_in_production = true
|
||||||
ldap_id_use_start_tls = false
|
ldap_id_use_start_tls = false
|
||||||
ldap_tls_reqcert = never
|
ldap_tls_reqcert = never
|
||||||
ldap_auth_disable_tls_never_use_in_production = true
|
|
||||||
|
|
||||||
cache_credentials = true
|
cache_credentials = true
|
||||||
enumerate = false
|
enumerate = false
|
||||||
@@ -48,14 +45,24 @@ echo ">>> Erstelle Sudoers-Regel für Gruppe: ${LDAP_SUDO_GROUP}..."
|
|||||||
echo "%${LDAP_SUDO_GROUP} ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/ldap-admins
|
echo "%${LDAP_SUDO_GROUP} ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/ldap-admins
|
||||||
chmod 0440 /etc/sudoers.d/ldap-admins
|
chmod 0440 /etc/sudoers.d/ldap-admins
|
||||||
|
|
||||||
echo ">>> Bereinige SSSD Cache..."
|
echo ">>> Erzwinge TLS für xrdp (Guacamole Fix)..."
|
||||||
|
if [ -f /etc/xrdp/xrdp.ini ]; then
|
||||||
|
sed -i 's/^security_layer=.*/security_layer=tls/' /etc/xrdp/xrdp.ini
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ">>> Bereinige alte PID-Dateien und SSSD Cache..."
|
||||||
|
rm -f /var/run/dbus/pid /run/dbus/dbus.pid /var/run/xrdp/*.pid /var/run/xrdp/xrdp-sesman.pid
|
||||||
rm -f /var/lib/sss/db/*
|
rm -f /var/lib/sss/db/*
|
||||||
rm -f /var/lib/sss/mc/*
|
rm -f /var/lib/sss/mc/*
|
||||||
|
|
||||||
echo ">>> Starte Dienste..."
|
echo ">>> Starte D-Bus..."
|
||||||
# SSSD mit dem gemappten Debug-Level starten
|
mkdir -p /var/run/dbus /run/dbus
|
||||||
|
dbus-uuidgen --ensure
|
||||||
|
dbus-daemon --system --fork
|
||||||
|
|
||||||
|
echo ">>> Starte SSSD..."
|
||||||
sssd -D --debug-level=${SSSD_DEBUG}
|
sssd -D --debug-level=${SSSD_DEBUG}
|
||||||
|
|
||||||
service dbus start
|
echo ">>> Starte XRDP..."
|
||||||
xrdp-sesman
|
xrdp-sesman
|
||||||
exec xrdp -n
|
exec xrdp -n
|
||||||
@@ -0,0 +1,43 @@
|
|||||||
|
sssd
|
||||||
|
sssd-tools
|
||||||
|
libpam-sss
|
||||||
|
libnss-sss
|
||||||
|
libsss-sudo
|
||||||
|
ldap-utils
|
||||||
|
ca-certificates
|
||||||
|
xrdp
|
||||||
|
xorgxrdp
|
||||||
|
dbus
|
||||||
|
dbus-x11
|
||||||
|
xfce4
|
||||||
|
xfce4-terminal
|
||||||
|
xdg-user-dirs
|
||||||
|
desktop-base
|
||||||
|
sudo
|
||||||
|
firefox-esr
|
||||||
|
thunderbird
|
||||||
|
geany
|
||||||
|
locales
|
||||||
|
tzdata
|
||||||
|
keyboard-configuration
|
||||||
|
x11-xkb-utils
|
||||||
|
pulseaudio
|
||||||
|
build-essential
|
||||||
|
dpkg-dev
|
||||||
|
git
|
||||||
|
libpulse-dev
|
||||||
|
meson
|
||||||
|
ninja-build
|
||||||
|
pkg-config
|
||||||
|
autoconf
|
||||||
|
libtool
|
||||||
|
thunar-archive-plugin
|
||||||
|
xarchiver
|
||||||
|
unzip
|
||||||
|
zip
|
||||||
|
p7zip-full
|
||||||
|
tar
|
||||||
|
gzip
|
||||||
|
bzip2
|
||||||
|
dialog
|
||||||
|
whiptail
|
||||||
Reference in new issue
Block a user