Compare commits
120
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
9f5ce4fece | ||
|
|
89c0d53507 | ||
|
|
465f2027f7 | ||
|
|
0bbf28e240 | ||
|
|
0de572f637 | ||
|
|
518c671d2b | ||
|
|
a8e270ba1d | ||
|
|
3e8957da1a | ||
|
|
dbf4b71151 | ||
|
|
359a537a61 | ||
|
|
258a6e072f | ||
|
|
9050c7baf3 | ||
|
|
3dc20ced31 | ||
|
|
73bb575d79 | ||
|
|
37528f087a | ||
|
|
9a447a8166 | ||
|
|
923abce325 | ||
|
|
1296b2a484 | ||
|
|
15812c1c08 | ||
|
|
862e9f24b3 | ||
|
|
a1cd9ef1c4 | ||
|
|
18ba516faf | ||
|
|
315b832ef3 | ||
|
|
a86ce056fc | ||
|
|
007066f5ff | ||
|
|
4e406b6366 | ||
|
|
d945d52d70 | ||
|
|
b79d5a8b73 | ||
|
|
98db04d666 | ||
|
|
7db1355f71 | ||
|
|
548c96a9f2 | ||
|
|
ca3014de29 | ||
|
|
fb7afb4e8f | ||
|
|
a5842b0cb6 | ||
|
|
3c4846216e | ||
|
|
d93f54617a | ||
|
|
d3453c6ec8 | ||
|
|
3857b83df9 | ||
|
|
499d7cfbd4 | ||
|
|
a25b8f0932 | ||
|
|
6cd8723263 | ||
|
|
f914c67f1c | ||
|
|
9682aeb843 | ||
|
|
dfffb8b9a7 | ||
|
|
45f0d5e927 | ||
|
|
fd5c9e53cc | ||
|
|
9228e00985 | ||
|
|
b289f3bcfc | ||
|
|
0b9383b571 | ||
|
|
5a72ebe7db | ||
|
|
209a921ad8 | ||
|
|
be7454650c | ||
|
|
31579e259c | ||
|
|
f92516e04e | ||
|
|
4999a09728 | ||
|
|
11d2880e45 | ||
|
|
8e8555dc63 | ||
|
|
4bea97d738 | ||
|
|
a5f653c959 | ||
|
|
fb61f145cf | ||
|
|
3e6dabb93f | ||
|
|
d53e5149e3 | ||
|
|
46a5d290c1 | ||
|
|
5ccdbead00 | ||
|
|
1f89d4f495 | ||
|
|
cfbe309e38 | ||
|
|
cf82b0dae2 | ||
|
|
6983500190 | ||
|
|
fb37dbaa5f | ||
|
|
438d8bfa42 | ||
|
|
490e6ddbd2 | ||
|
|
5bc3095b78 | ||
|
|
ff86386ab7 | ||
|
|
7276600c53 | ||
|
|
964dacdbd1 | ||
|
|
d194e1fa43 | ||
|
|
faec5655ff | ||
|
|
48c5573992 | ||
|
|
e0c4a93176 | ||
|
|
234298718b | ||
|
|
d75868f2f8 | ||
|
|
43ddf5f96c | ||
|
|
3bc5199462 | ||
|
|
ee6a954dde | ||
|
|
db03c9f5e8 | ||
|
|
7ef83dfce5 | ||
|
|
7b37b00408 | ||
|
|
db68aaa11a | ||
|
|
a687f3f7a1 | ||
|
|
220767e82b | ||
|
|
225679a316 | ||
|
|
ebba5af257 | ||
|
|
d699e10271 | ||
|
|
4e6e74d56c | ||
|
|
badbfc89c4 | ||
|
|
c1cf74e7f6 | ||
|
|
9bfbadd89b | ||
|
|
305e507598 | ||
|
|
e0cef93e27 | ||
|
|
90f4f9fe18 | ||
|
|
75b2c50bf5 | ||
|
|
d8a2e6ef9f | ||
|
|
60d1afdcb2 | ||
|
|
d12c3e57ac | ||
|
|
d87a0d461d | ||
|
|
3e8726f3fb | ||
|
|
3879067d9b | ||
|
|
453923d406 | ||
|
|
59d5de46f9 | ||
|
|
a53403fbea | ||
|
|
d25f1697c5 | ||
|
|
0d1bf8ecde | ||
|
|
2e98ee5b0e | ||
|
|
ca9a63ce1a | ||
|
|
062bf85f6e | ||
|
|
59da82bc96 | ||
|
|
3e93e15477 | ||
|
|
d064afbc0b | ||
|
|
fe343cfcd5 | ||
|
|
c7c1c7b2f3 |
No files matched your search
@@ -1,13 +1,28 @@
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- 'main'
|
||||
- 'dev'
|
||||
paths-ignore:
|
||||
- 'README.md'
|
||||
- 'Dockerfile*'
|
||||
- 'packages.txt'
|
||||
- 'VERSION.history'
|
||||
- 'docker-compose.yml'
|
||||
- 'buildargs.env'
|
||||
- 'entrypoint.sh'
|
||||
- '*.md'
|
||||
- '.gitignore'
|
||||
- '.gitea/workflows/build-and-push.yaml'
|
||||
tags:
|
||||
- '*'
|
||||
schedule:
|
||||
- cron: '0 5 * * 0'
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
packages: write
|
||||
|
||||
jobs:
|
||||
release-and-build:
|
||||
runs-on: buildx-multiarch
|
||||
@@ -16,17 +31,14 @@ jobs:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
token: ${{ secrets.RUNNER_TOKEN }}
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Prepare Environment and Read Config
|
||||
id: prep
|
||||
run: |
|
||||
export TZ=Europe/Berlin
|
||||
|
||||
# FIX 1: Stellt sicher, dass die Datei mit einem Zeilenumbruch endet.
|
||||
# Das verhindert, dass Bash die letzte Zeile beim Einlesen verschluckt.
|
||||
sed -i -e '$a\' buildargs.env
|
||||
|
||||
set -a
|
||||
source <(grep -v '^#' buildargs.env | sed 's/\r$//')
|
||||
set +a
|
||||
@@ -37,18 +49,23 @@ jobs:
|
||||
echo "build_args_hash=$ARGS_HASH" >> $GITHUB_OUTPUT
|
||||
|
||||
echo "event_name=${{ gitea.event_name }}" >> $GITHUB_OUTPUT
|
||||
|
||||
# FIX 2: Kugelsicheres Auslesen des Tags direkt aus der Datei.
|
||||
# Trimm-Befehle (tr) entfernen eventuelle unsichtbare Zeichen oder Anführungszeichen.
|
||||
SAFE_BUILD_TAG=$(grep "^BUILD_TAG=" buildargs.env | cut -d'=' -f2 | tr -d '\r' | tr -d '"' | xargs)
|
||||
|
||||
if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then
|
||||
CLEAN_TAG=${{ gitea.ref_name }}
|
||||
echo "docker_tag=${CLEAN_TAG#v}" >> $GITHUB_OUTPUT
|
||||
FINAL_TAG="${CLEAN_TAG#v}"
|
||||
else
|
||||
# Nutzt jetzt garantiert den direkt extrahierten Wert
|
||||
echo "docker_tag=${SAFE_BUILD_TAG:-latest}" >> $GITHUB_OUTPUT
|
||||
BASE_TAG="${BUILD_TAG:-${DEBIAN_CODENAME}-${BUILD_COUNTRY}}"
|
||||
if [[ "${{ gitea.ref_name }}" == "dev" ]]; then
|
||||
if [[ "$BASE_TAG" != *-dev ]]; then
|
||||
FINAL_TAG="${BASE_TAG}-dev"
|
||||
else
|
||||
FINAL_TAG="$BASE_TAG"
|
||||
fi
|
||||
else
|
||||
FINAL_TAG="${BASE_TAG%-dev}"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "docker_tag=${FINAL_TAG:-latest}" >> $GITHUB_OUTPUT
|
||||
|
||||
OWNER=$(echo "${{ gitea.repository }}" | cut -d'/' -f1 | tr '[:upper:]' '[:lower:]')
|
||||
REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2 | tr '[:upper:]' '[:lower:]')
|
||||
@@ -59,8 +76,7 @@ jobs:
|
||||
|
||||
- name: Login to Gitea Registry
|
||||
run: |
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login \
|
||||
git.pi-farm.de -u ${{ secrets.REGISTRY_USER }} --password-stdin
|
||||
echo "${{ secrets.RUNNER_TOKEN }}" | docker login git.pi-farm.de -u "${{ gitea.actor }}" --password-stdin
|
||||
|
||||
- name: Check for Real Changes
|
||||
id: check_changes
|
||||
@@ -125,6 +141,7 @@ jobs:
|
||||
ARGS_HASH=${{ steps.prep.outputs.build_args_hash }}
|
||||
BASE=${{ steps.prep.outputs.base_image }}
|
||||
REPO_PURE=${{ steps.prep.outputs.repo_pure }}
|
||||
DOCKERHUB_REPO="${{ secrets.DOCKERHUB_USERNAME }}/$REPO_PURE"
|
||||
|
||||
set -a
|
||||
source <(grep -v '^#' buildargs.env | sed 's/\r$//')
|
||||
@@ -138,13 +155,39 @@ jobs:
|
||||
|
||||
BASE_SHA=$(docker buildx imagetools inspect $BASE --format '{{json .Manifest.Digest}}' 2>/dev/null | tr -d '"' || echo "unknown")
|
||||
|
||||
docker buildx build "${DOCKER_ARGS[@]}" -t "$IMAGE_GITEA:tmp-amd64" \
|
||||
AMD_TAGS=("-t" "$IMAGE_GITEA:tmp-amd64")
|
||||
GITEA_SOURCES=("$IMAGE_GITEA:tmp-amd64")
|
||||
|
||||
if [[ "$PUSH" == *"dockerhub"* ]]; then
|
||||
AMD_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-amd64")
|
||||
DH_SOURCES=("$DOCKERHUB_REPO:tmp-amd64")
|
||||
fi
|
||||
|
||||
docker buildx build "${DOCKER_ARGS[@]}" "${AMD_TAGS[@]}" \
|
||||
--cache-from "type=registry,ref=$IMAGE_GITEA:buildcache-amd64" \
|
||||
--cache-to "type=registry,ref=$IMAGE_GITEA:buildcache-amd64,mode=max" \
|
||||
--pull --platform linux/amd64 -f Dockerfile \
|
||||
--label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
|
||||
|
||||
docker buildx build "${DOCKER_ARGS[@]}" -t "$IMAGE_GITEA:tmp-arm64" \
|
||||
if [ -f "Dockerfile.aarch64" ]; then
|
||||
echo "⚙️ Dockerfile.aarch64 gefunden. Baue ARM64 Image..."
|
||||
|
||||
ARM_TAGS=("-t" "$IMAGE_GITEA:tmp-arm64")
|
||||
GITEA_SOURCES+=("$IMAGE_GITEA:tmp-arm64")
|
||||
|
||||
if [[ "$PUSH" == *"dockerhub"* ]]; then
|
||||
ARM_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-arm64")
|
||||
DH_SOURCES+=("$DOCKERHUB_REPO:tmp-arm64")
|
||||
fi
|
||||
|
||||
docker buildx build "${DOCKER_ARGS[@]}" "${ARM_TAGS[@]}" \
|
||||
--cache-from "type=registry,ref=$IMAGE_GITEA:buildcache-arm64" \
|
||||
--cache-to "type=registry,ref=$IMAGE_GITEA:buildcache-arm64,mode=max" \
|
||||
--pull --platform linux/arm64 -f Dockerfile.aarch64 \
|
||||
--label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
|
||||
else
|
||||
echo "Keine Dockerfile.aarch64 gefunden. ARM64 Build wird übersprungen."
|
||||
fi
|
||||
|
||||
GITEA_MANIFEST_TAGS=("-t" "$IMAGE_GITEA:$TAG")
|
||||
if [[ "$BUILD_TAG_LATEST" == "y" ]]; then
|
||||
@@ -153,10 +196,9 @@ jobs:
|
||||
|
||||
docker buildx imagetools create \
|
||||
--annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \
|
||||
"${GITEA_MANIFEST_TAGS[@]}" $IMAGE_GITEA:tmp-amd64 $IMAGE_GITEA:tmp-arm64
|
||||
"${GITEA_MANIFEST_TAGS[@]}" "${GITEA_SOURCES[@]}"
|
||||
|
||||
if [[ "$PUSH" == *"dockerhub"* ]]; then
|
||||
DOCKERHUB_REPO="${{ secrets.DOCKERHUB_USERNAME }}/$REPO_PURE"
|
||||
DH_MANIFEST_TAGS=("-t" "$DOCKERHUB_REPO:$TAG")
|
||||
if [[ "$BUILD_TAG_LATEST" == "y" ]]; then
|
||||
DH_MANIFEST_TAGS+=("-t" "$DOCKERHUB_REPO:latest")
|
||||
@@ -164,7 +206,7 @@ jobs:
|
||||
|
||||
docker buildx imagetools create \
|
||||
--annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \
|
||||
"${DH_MANIFEST_TAGS[@]}" $IMAGE_GITEA:tmp-amd64 $IMAGE_GITEA:tmp-arm64
|
||||
"${DH_MANIFEST_TAGS[@]}" "${DH_SOURCES[@]}"
|
||||
fi
|
||||
|
||||
- name: Update Documentation and Compose
|
||||
@@ -175,7 +217,6 @@ jobs:
|
||||
|
||||
export TZ=Europe/Berlin
|
||||
CURRENT_TIME=$(date '+%d.%m.%Y %H:%M')
|
||||
BUILD_TAG="${{ steps.prep.outputs.docker_tag }}"
|
||||
FULL_URL="${{ steps.prep.outputs.image_name }}"
|
||||
REPO_PURE="${{ steps.prep.outputs.repo_pure }}"
|
||||
BASE_IMAGE="${{ steps.prep.outputs.base_image }}"
|
||||
@@ -187,15 +228,28 @@ jobs:
|
||||
source ./cleaned_env.sh
|
||||
set +a
|
||||
|
||||
BUILD_TAG="${{ steps.prep.outputs.docker_tag }}"
|
||||
|
||||
if [ -f "Dockerfile.aarch64" ]; then ARM_STATUS="✅ Active"; else ARM_STATUS="❌ Not supported"; fi
|
||||
|
||||
cat << 'EOF' > commit_msg.txt
|
||||
${{ gitea.event.head_commit.message }}
|
||||
EOF
|
||||
COMMIT_MSG=$(sed 's/\[skip ci\]//g' commit_msg.txt | xargs)
|
||||
RAW_COMMIT_MSG="${{ gitea.event.head_commit.message }}"
|
||||
COMMIT_MSG=$(echo "$RAW_COMMIT_MSG" | sed 's/\[skip ci\]//g' | tr -d '\r\n' | xargs)
|
||||
|
||||
wget -q https://git.pi-farm.de/pi-farm/templates/raw/branch/main/README.template -O README.template || echo "Warnung: README Template fehlt"
|
||||
wget -q https://git.pi-farm.de/pi-farm/templates/raw/branch/main/docker-compose.template -O docker-compose.template || echo "Warnung: Compose Template fehlt"
|
||||
TOKEN="${{ secrets.RUNNER_TOKEN }}"
|
||||
curl -sSLf -H "Authorization: token $TOKEN" \
|
||||
"https://git.pi-farm.de/pi-farm/templates/raw/branch/main/README.template" \
|
||||
-o README.template || echo "Warnung: README Template konnte nicht geladen werden"
|
||||
|
||||
curl -sSLf -H "Authorization: token $TOKEN" \
|
||||
"https://git.pi-farm.de/pi-farm/templates/raw/branch/main/docker-compose.template" \
|
||||
-o docker-compose.template || echo "Warnung: Compose Template konnte nicht geladen werden"
|
||||
|
||||
for t_file in README.template docker-compose.template; do
|
||||
if [ -f "$t_file" ] && grep -qi "<!DOCTYPE html>" "$t_file"; then
|
||||
echo "❌ FEHLER: $t_file ist eine HTML-Loginseite! Download verworfen."
|
||||
rm -f "$t_file"
|
||||
fi
|
||||
done
|
||||
|
||||
NEW_ROW="| **$BUILD_TAG** | $CURRENT_TIME | $COMMIT_MSG ✅ |"
|
||||
if [ -f "VERSION.history" ]; then
|
||||
@@ -266,50 +320,67 @@ jobs:
|
||||
DOCKERHUB_LINK_CONTENT=""
|
||||
if [[ "${{ steps.prep.outputs.push_targets }}" == *"dockerhub"* ]]; then
|
||||
DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
|
||||
DOCKERHUB_LINK_CONTENT="[](https://hub.docker.com/r/${DH_USER}/${REPO_PURE})"
|
||||
DOCKERHUB_LINK_CONTENT='<a href="https://hub.docker.com/r/'"${DH_USER}"'/'"${REPO_PURE}"'" target="_blank" rel="noopener noreferrer"><img src="https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white" alt="Docker Hub"></a>'
|
||||
fi
|
||||
|
||||
process_template() {
|
||||
local template=$1; local output=$2
|
||||
[ ! -f "$template" ] && return
|
||||
cp "$template" "$output"
|
||||
|
||||
sed -i "s|__REPO_NAME__|$REPO_PURE|g" "$output"
|
||||
sed -i "s|__FULL_URL__|$FULL_URL|g" "$output"
|
||||
sed -i "s|__BUILD_TAG__|$BUILD_TAG|g" "$output"
|
||||
sed -i "s|__BASE_IMAGE__|$BASE_IMAGE|g" "$output"
|
||||
sed -i "s|__ARM_STATUS__|$ARM_STATUS|g" "$output"
|
||||
sed -i "s|__CURRENT_DATE__|$CURRENT_TIME|g" "$output"
|
||||
|
||||
awk -v r="$HISTORY_CONTENT" '{gsub(/__HISTORY_CONTENT__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
|
||||
awk -v r="$DOCKERHUB_LINK_CONTENT" '{gsub(/__DOCKERHUB_LINK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
|
||||
|
||||
if grep -q "__DOCKER_RUN__" "$output" && [ -f "docker_run_block.txt" ]; then
|
||||
sed -e '/__DOCKER_RUN__/{r docker_run_block.txt' -e 'd;}' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
|
||||
if ! command -v python3 &> /dev/null; then
|
||||
echo "📦 python3 fehlt und wird installiert..."
|
||||
(apt-get update && apt-get install -y python3) || (apk add --no-cache python3) || true
|
||||
fi
|
||||
|
||||
if grep -q "__COMPOSE_BLOCK__" "$output" && [ -f "docker-compose.yml" ]; then
|
||||
sed -e '/__COMPOSE_BLOCK__/{r docker-compose.yml' -e 'd;}' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
|
||||
fi
|
||||
# Python-Skript sauber als eigene Datei erstellen (vermeidet YAML-Syntaxfehler)
|
||||
cat << 'EOF' > update_script.py
|
||||
import os, sys
|
||||
|
||||
if grep -q "__ENV_BLOCK__" "$output"; then
|
||||
awk -v r="$(echo -e "$ENV_BLOCK_CONTENT")" '{gsub(/__ENV_BLOCK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
|
||||
fi
|
||||
awk -v r="$(echo -e "$PORTS_BLOCK_CONTENT")" '{gsub(/__PORTS_BLOCK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
|
||||
awk -v r="$(echo -e "$VOL_BLOCK_CONTENT")" '{gsub(/__VOL_BLOCK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
|
||||
def process(output_file):
|
||||
if not os.path.exists(output_file.replace('.md', '.template').replace('.yml', '.template')):
|
||||
return
|
||||
|
||||
if grep -q "__DESCRIPTION__" "$output"; then
|
||||
awk -v r="$(echo -e "${DESCRIPTION:-Keine Beschreibung.}")" '{gsub(/__DESCRIPTION__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
|
||||
fi
|
||||
}
|
||||
template_name = output_file.replace('.md', '.template').replace('.yml', '.template')
|
||||
with open(template_name, "r", encoding="utf-8") as f:
|
||||
content = f.read()
|
||||
|
||||
process_template "docker-compose.template" "docker-compose.yml"
|
||||
process_template "README.template" "README.md"
|
||||
content = content.replace("__REPO_NAME__", os.environ.get("REPO_PURE", ""))
|
||||
content = content.replace("__FULL_URL__", os.environ.get("FULL_URL", ""))
|
||||
content = content.replace("__BUILD_TAG__", os.environ.get("BUILD_TAG", ""))
|
||||
content = content.replace("__BASE_IMAGE__", os.environ.get("BASE_IMAGE", ""))
|
||||
content = content.replace("__ARM_STATUS__", os.environ.get("ARM_STATUS", ""))
|
||||
content = content.replace("__CURRENT_DATE__", os.environ.get("CURRENT_TIME", ""))
|
||||
content = content.replace("__HISTORY_CONTENT__", os.environ.get("HISTORY_CONTENT", ""))
|
||||
content = content.replace("__DOCKERHUB_LINK__", os.environ.get("DOCKERHUB_LINK_CONTENT", ""))
|
||||
content = content.replace("__ENV_BLOCK__", os.environ.get("ENV_BLOCK_CONTENT", "").replace("\\n", "\n"))
|
||||
content = content.replace("__PORTS_BLOCK__", os.environ.get("PORTS_BLOCK_CONTENT", "").replace("\\n", "\n"))
|
||||
content = content.replace("__VOL_BLOCK__", os.environ.get("VOL_BLOCK_CONTENT", "").replace("\\n", "\n"))
|
||||
content = content.replace("__DESCRIPTION__", os.environ.get("DESCRIPTION", "Keine Beschreibung."))
|
||||
|
||||
if "__DOCKER_RUN__" in content and os.path.exists("docker_run_block.txt"):
|
||||
with open("docker_run_block.txt", "r", encoding="utf-8") as f:
|
||||
content = content.replace("__DOCKER_RUN__", f.read())
|
||||
|
||||
if "__COMPOSE_BLOCK__" in content and os.path.exists("docker-compose.yml"):
|
||||
with open("docker-compose.yml", "r", encoding="utf-8") as f:
|
||||
content = content.replace("__COMPOSE_BLOCK__", f.read())
|
||||
|
||||
with open(output_file, "w", encoding="utf-8") as f:
|
||||
f.write(content)
|
||||
|
||||
process("docker-compose.yml")
|
||||
process("README.md")
|
||||
EOF
|
||||
|
||||
export REPO_PURE FULL_URL BUILD_TAG BASE_IMAGE ARM_STATUS CURRENT_TIME \
|
||||
HISTORY_CONTENT DOCKERHUB_LINK_CONTENT ENV_BLOCK_CONTENT \
|
||||
PORTS_BLOCK_CONTENT VOL_BLOCK_CONTENT DESCRIPTION
|
||||
|
||||
python3 update_script.py
|
||||
rm -f update_script.py
|
||||
|
||||
echo "FINAL_MSG=$COMMIT_MSG" >> $GITHUB_ENV
|
||||
echo "DESCRIPTION<<EOF" >> $GITHUB_ENV
|
||||
echo -e "$DESCRIPTION" >> $GITHUB_ENV
|
||||
echo "EOF" >> $GITHUB_ENV
|
||||
{
|
||||
echo "DESCRIPTION<<EOF"
|
||||
echo "$DESCRIPTION"
|
||||
echo "EOF"
|
||||
} >> $GITHUB_ENV
|
||||
|
||||
- name: Push README to Docker Hub
|
||||
if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub')
|
||||
@@ -331,15 +402,21 @@ jobs:
|
||||
|
||||
REPO_PURE="${{ steps.prep.outputs.repo_pure }}"
|
||||
DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
|
||||
GITEA_URL="${{ steps.prep.outputs.image_name }}"
|
||||
DH_URL="${DH_USER}/${REPO_PURE}"
|
||||
|
||||
SHORT_DESC=$(echo -e "${{ env.DESCRIPTION }}" | head -n 1 | cut -c 1-100)
|
||||
[ -z "$SHORT_DESC" ] && SHORT_DESC="Docker Image for $REPO_PURE"
|
||||
|
||||
echo "📦 Processing README.md (${REPO_PURE})..."
|
||||
echo "📦 Processing README.md for Docker Hub (${DH_URL})..."
|
||||
|
||||
# Ersetzt die Image-URL NUR dann, wenn kein http:// oder https:// davor steht
|
||||
export GITEA_URL DH_URL
|
||||
python3 -c 'import os, re; content = open("README.md", "r", encoding="utf-8").read(); new_content = re.sub(r"(?<!https://)(?<!http://)" + re.escape(os.environ["GITEA_URL"]), os.environ["DH_URL"], content); open("README_DH.md", "w", encoding="utf-8").write(new_content)'
|
||||
|
||||
jq -n \
|
||||
--arg desc "$SHORT_DESC" \
|
||||
--rawfile full_desc README.md \
|
||||
--rawfile full_desc README_DH.md \
|
||||
'{description: $desc, full_description: $full_desc}' > payload.json
|
||||
|
||||
echo "📤 Sending data to Docker Hub API..."
|
||||
@@ -353,13 +430,15 @@ jobs:
|
||||
BODY=$(echo "$RESPONSE" | head -n -1)
|
||||
|
||||
if [ "$HTTP_STATUS" -eq 200 ]; then
|
||||
echo "✅ README update successfull (HTTP 200)."
|
||||
echo "✅ README update successful (HTTP 200)."
|
||||
else
|
||||
echo "❌ Error on update! HTTP Status: $HTTP_STATUS"
|
||||
echo "Answer from Docker Hub: $BODY"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
rm -f README_DH.md
|
||||
|
||||
- name: Commit, Tag and Push Changes
|
||||
if: steps.check_changes.outputs.should_build == 'true'
|
||||
run: |
|
||||
@@ -393,17 +472,22 @@ jobs:
|
||||
|
||||
TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token)
|
||||
-d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token || echo "")
|
||||
|
||||
if [ "$TOKEN" != "null" ] && [ -n "$TOKEN" ]; then
|
||||
REPO_PURE=${{ steps.prep.outputs.repo_pure }}
|
||||
DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
|
||||
|
||||
for t in tmp-amd64 tmp-arm64; do
|
||||
CLEAN_TAGS=("tmp-amd64")
|
||||
if [ -f "Dockerfile.aarch64" ]; then
|
||||
CLEAN_TAGS+=("tmp-arm64")
|
||||
fi
|
||||
|
||||
for t in "${CLEAN_TAGS[@]}"; do
|
||||
echo "Deleting tag $t..."
|
||||
STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE \
|
||||
"https://hub.docker.com/v2/repositories/${DH_USER}/${REPO_PURE}/tags/$t/" \
|
||||
-H "Authorization: JWT ${TOKEN}")
|
||||
-H "Authorization: JWT ${TOKEN}" || echo "000")
|
||||
echo "Status: $STATUS"
|
||||
done
|
||||
echo "✅ Temp. tags deleted."
|
||||
@@ -412,13 +496,18 @@ jobs:
|
||||
- name: Cleanup Temporary Registry Tags (Gitea)
|
||||
if: steps.check_changes.outputs.should_build == 'true'
|
||||
run: |
|
||||
TOKEN="${{ secrets.GIT_TOKEN }}"
|
||||
TOKEN="${{ secrets.RUNNER_TOKEN }}"
|
||||
ORG_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f1)
|
||||
REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2)
|
||||
|
||||
for t in tmp-amd64 tmp-arm64; do
|
||||
curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/$ORG_NAME/container/$REPO_NAME/$t" -H "Authorization: token $TOKEN"
|
||||
curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/${ORG_NAME,,}/container/${REPO_NAME,,}/$t" -H "Authorization: token $TOKEN"
|
||||
CLEAN_TAGS=("tmp-amd64")
|
||||
if [ -f "Dockerfile.aarch64" ]; then
|
||||
CLEAN_TAGS+=("tmp-arm64")
|
||||
fi
|
||||
|
||||
for t in "${CLEAN_TAGS[@]}"; do
|
||||
curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/$ORG_NAME/container/$REPO_NAME/$t" -H "Authorization: token $TOKEN" || true
|
||||
curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/${ORG_NAME,,}/container/${REPO_NAME,,}/$t" -H "Authorization: token $TOKEN" || true
|
||||
done
|
||||
|
||||
- name: Cleanup Docker Artifacts
|
||||
|
||||
@@ -12,3 +12,4 @@ config/*
|
||||
!config/.gitkeep
|
||||
home/*
|
||||
!home/.gitkeep
|
||||
.vscode/*
|
||||
+22
-43
@@ -1,4 +1,4 @@
|
||||
ARG BUILD_BASE_IMAGE=debian:bookworm
|
||||
ARG BUILD_BASE_IMAGE
|
||||
|
||||
FROM ${BUILD_BASE_IMAGE}
|
||||
|
||||
@@ -20,38 +20,13 @@ ENV LC_ALL=${BUILD_LC_ALL}
|
||||
ENV COUNTRY=${BUILD_COUNTRY}
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
COPY packages.txt /tmp/packages.txt
|
||||
|
||||
RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources && \
|
||||
apt-get update && apt-get install -y \
|
||||
xrdp \
|
||||
sssd \
|
||||
sssd-tools \
|
||||
libpam-sss \
|
||||
libnss-sss \
|
||||
libsss-sudo \
|
||||
ldap-utils \
|
||||
ca-certificates \
|
||||
dbus-x11 \
|
||||
xfce4 \
|
||||
xfce4-terminal \
|
||||
sudo \
|
||||
firefox-esr \
|
||||
firefox-esr-l10n-${COUNTRY} \
|
||||
thunderbird \
|
||||
thunderbird-l10n-${COUNTRY} \
|
||||
locales \
|
||||
tzdata \
|
||||
keyboard-configuration \
|
||||
x11-xkb-utils \
|
||||
pulseaudio \
|
||||
build-essential \
|
||||
dpkg-dev \
|
||||
git \
|
||||
libpulse-dev \
|
||||
meson \
|
||||
ninja-build \
|
||||
pkg-config \
|
||||
autoconf \
|
||||
libtool && \
|
||||
apt-get update && apt-get install -y --no-install-recommends \
|
||||
$(cat /tmp/packages.txt) \
|
||||
firefox-esr-l10n-${BUILD_COUNTRY} \
|
||||
thunderbird-l10n-${BUILD_COUNTRY} && \
|
||||
apt-get build-dep -y pulseaudio && \
|
||||
cd /tmp && \
|
||||
apt-get source pulseaudio && \
|
||||
@@ -79,29 +54,33 @@ RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.s
|
||||
ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime && \
|
||||
dpkg-reconfigure -f noninteractive tzdata && \
|
||||
printf 'XKBMODEL="pc105"\nXKBLAYOUT="%s"\nXKBVARIANT=""\nXKBOPTIONS=""\nBACKSPACE="guess"\n' "${COUNTRY}" > /etc/default/keyboard && \
|
||||
dpkg-reconfigure -f noninteractive keyboard-configuration
|
||||
dpkg-reconfigure -f noninteractive keyboard-configuration && \
|
||||
rm -rf /var/lib/apt/lists/* /tmp/packages.txt
|
||||
|
||||
# NEU: Systemweite statische Konfigurationen für LDAP/PAM/Sudo
|
||||
# 1. Entfernt die gefährliche %users Regel
|
||||
# 2. Sagt nsswitch, dass Sudoers auch im SSS (LDAP) gesucht werden sollen
|
||||
# 3. Aktiviert das automatische Erstellen von Home-Verzeichnissen (mkhomedir)
|
||||
RUN sed -i '/%users/s/^/# /' /etc/sudoers && \
|
||||
echo "sudoers: files sss" >> /etc/nsswitch.conf && \
|
||||
echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0022" >> /etc/pam.d/common-session
|
||||
echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0077" >> /etc/pam.d/common-session
|
||||
|
||||
RUN chmod 440 /etc/sudoers && \
|
||||
mkdir -p /etc/sssd && chown root:root /etc/sssd && chmod 755 /etc/sssd && \
|
||||
mkdir -p /home && chmod 755 /home && \
|
||||
mkdir -p /home && chmod 777 /home && \
|
||||
chown xrdp:xrdp /etc/xrdp/key.pem /etc/xrdp/cert.pem /etc/xrdp/rsakeys.ini && \
|
||||
chmod 600 /etc/xrdp/key.pem /etc/xrdp/rsakeys.ini && \
|
||||
chmod 644 /etc/xrdp/cert.pem && \
|
||||
echo "LANG=${LANG}" >> /etc/environment && \
|
||||
echo "LANGUAGE=${LANGUAGE}" >> /etc/environment && \
|
||||
echo "LC_ALL=${LC_ALL}" >> /etc/environment && \
|
||||
sed -i '2i export LANG=${LANG}\nexport LANGUAGE=${LANGUAGE}\nexport LC_ALL=${LC_ALL}\npulseaudio --start\npactl load-module module-xrdp-sink.so\npactl load-module module-xrdp-source.so' /etc/xrdp/startwm.sh && \
|
||||
chmod +x /etc/xrdp/startwm.sh && \
|
||||
mkdir -p /etc/xdg/xfce4 && \
|
||||
echo "setxkbmap ${COUNTRY}" >> /etc/xdg/xfce4/xinitrc
|
||||
echo "#!/bin/sh" > /etc/xrdp/startwm.sh && \
|
||||
echo "export LANG=${LANG}" >> /etc/xrdp/startwm.sh && \
|
||||
echo "export LANGUAGE=${LANGUAGE}" >> /etc/xrdp/startwm.sh && \
|
||||
echo "export LC_ALL=${LC_ALL}" >> /etc/xrdp/startwm.sh && \
|
||||
echo "export XDG_SESSION_TYPE=x11" >> /etc/xrdp/startwm.sh && \
|
||||
echo "setxkbmap ${COUNTRY}" >> /etc/xrdp/startwm.sh && \
|
||||
echo "pulseaudio --start" >> /etc/xrdp/startwm.sh && \
|
||||
echo "pactl load-module module-xrdp-sink.so" >> /etc/xrdp/startwm.sh && \
|
||||
echo "pactl load-module module-xrdp-source.so" >> /etc/xrdp/startwm.sh && \
|
||||
echo "exec dbus-launch --exit-with-session mate-session" >> /etc/xrdp/startwm.sh && \
|
||||
chmod +x /etc/xrdp/startwm.sh
|
||||
|
||||
EXPOSE 3389
|
||||
|
||||
|
||||
+22
-43
@@ -1,4 +1,4 @@
|
||||
ARG BUILD_BASE_IMAGE=debian:bookworm
|
||||
ARG BUILD_BASE_IMAGE
|
||||
|
||||
FROM ${BUILD_BASE_IMAGE}
|
||||
|
||||
@@ -20,38 +20,13 @@ ENV LC_ALL=${BUILD_LC_ALL}
|
||||
ENV COUNTRY=${BUILD_COUNTRY}
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
COPY packages.txt /tmp/packages.txt
|
||||
|
||||
RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources && \
|
||||
apt-get update && apt-get install -y \
|
||||
xrdp \
|
||||
sssd \
|
||||
sssd-tools \
|
||||
libpam-sss \
|
||||
libnss-sss \
|
||||
libsss-sudo \
|
||||
ldap-utils \
|
||||
ca-certificates \
|
||||
dbus-x11 \
|
||||
xfce4 \
|
||||
xfce4-terminal \
|
||||
sudo \
|
||||
firefox-esr \
|
||||
firefox-esr-l10n-${COUNTRY} \
|
||||
thunderbird \
|
||||
thunderbird-l10n-${COUNTRY} \
|
||||
locales \
|
||||
tzdata \
|
||||
keyboard-configuration \
|
||||
x11-xkb-utils \
|
||||
pulseaudio \
|
||||
build-essential \
|
||||
dpkg-dev \
|
||||
git \
|
||||
libpulse-dev \
|
||||
meson \
|
||||
ninja-build \
|
||||
pkg-config \
|
||||
autoconf \
|
||||
libtool && \
|
||||
apt-get update && apt-get install -y --no-install-recommends \
|
||||
$(cat /tmp/packages.txt) \
|
||||
firefox-esr-l10n-${BUILD_COUNTRY} \
|
||||
thunderbird-l10n-${BUILD_COUNTRY} && \
|
||||
apt-get build-dep -y pulseaudio && \
|
||||
cd /tmp && \
|
||||
apt-get source pulseaudio && \
|
||||
@@ -79,29 +54,33 @@ RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.s
|
||||
ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime && \
|
||||
dpkg-reconfigure -f noninteractive tzdata && \
|
||||
printf 'XKBMODEL="pc105"\nXKBLAYOUT="%s"\nXKBVARIANT=""\nXKBOPTIONS=""\nBACKSPACE="guess"\n' "${COUNTRY}" > /etc/default/keyboard && \
|
||||
dpkg-reconfigure -f noninteractive keyboard-configuration
|
||||
dpkg-reconfigure -f noninteractive keyboard-configuration && \
|
||||
rm -rf /var/lib/apt/lists/* /tmp/packages.txt
|
||||
|
||||
# NEU: Systemweite statische Konfigurationen für LDAP/PAM/Sudo
|
||||
# 1. Entfernt die gefährliche %users Regel
|
||||
# 2. Sagt nsswitch, dass Sudoers auch im SSS (LDAP) gesucht werden sollen
|
||||
# 3. Aktiviert das automatische Erstellen von Home-Verzeichnissen (mkhomedir)
|
||||
RUN sed -i '/%users/s/^/# /' /etc/sudoers && \
|
||||
echo "sudoers: files sss" >> /etc/nsswitch.conf && \
|
||||
echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0022" >> /etc/pam.d/common-session
|
||||
echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0077" >> /etc/pam.d/common-session
|
||||
|
||||
RUN chmod 440 /etc/sudoers && \
|
||||
mkdir -p /etc/sssd && chown root:root /etc/sssd && chmod 755 /etc/sssd && \
|
||||
mkdir -p /home && chmod 755 /home && \
|
||||
mkdir -p /home && chmod 777 /home && \
|
||||
chown xrdp:xrdp /etc/xrdp/key.pem /etc/xrdp/cert.pem /etc/xrdp/rsakeys.ini && \
|
||||
chmod 600 /etc/xrdp/key.pem /etc/xrdp/rsakeys.ini && \
|
||||
chmod 644 /etc/xrdp/cert.pem && \
|
||||
echo "LANG=${LANG}" >> /etc/environment && \
|
||||
echo "LANGUAGE=${LANGUAGE}" >> /etc/environment && \
|
||||
echo "LC_ALL=${LC_ALL}" >> /etc/environment && \
|
||||
sed -i '2i export LANG=${LANG}\nexport LANGUAGE=${LANGUAGE}\nexport LC_ALL=${LC_ALL}\npulseaudio --start\npactl load-module module-xrdp-sink.so\npactl load-module module-xrdp-source.so' /etc/xrdp/startwm.sh && \
|
||||
chmod +x /etc/xrdp/startwm.sh && \
|
||||
mkdir -p /etc/xdg/xfce4 && \
|
||||
echo "setxkbmap ${COUNTRY}" >> /etc/xdg/xfce4/xinitrc
|
||||
echo "#!/bin/sh" > /etc/xrdp/startwm.sh && \
|
||||
echo "export LANG=${LANG}" >> /etc/xrdp/startwm.sh && \
|
||||
echo "export LANGUAGE=${LANGUAGE}" >> /etc/xrdp/startwm.sh && \
|
||||
echo "export LC_ALL=${LC_ALL}" >> /etc/xrdp/startwm.sh && \
|
||||
echo "export XDG_SESSION_TYPE=x11" >> /etc/xrdp/startwm.sh && \
|
||||
echo "setxkbmap ${COUNTRY}" >> /etc/xrdp/startwm.sh && \
|
||||
echo "pulseaudio --start" >> /etc/xrdp/startwm.sh && \
|
||||
echo "pactl load-module module-xrdp-sink.so" >> /etc/xrdp/startwm.sh && \
|
||||
echo "pactl load-module module-xrdp-source.so" >> /etc/xrdp/startwm.sh && \
|
||||
echo "exec dbus-launch --exit-with-session mate-session" >> /etc/xrdp/startwm.sh && \
|
||||
chmod +x /etc/xrdp/startwm.sh
|
||||
|
||||
EXPOSE 3389
|
||||
|
||||
|
||||
@@ -1,32 +1,37 @@
|
||||
# base-image-debian-rdp-ldap
|
||||
Debian Desktop with LDAP-Authentication. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop.
|
||||
Debian Desktop with LDAP Authentication and PulseAudio. To use behind Guacamole with LDAP Authentication and pass-through to Debian Desktop.
|
||||
|
||||
[](https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions)
|
||||
[](__REPO_URL__)
|
||||
<a href="https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions" target="_blank" rel="noopener noreferrer">
|
||||
<img src="https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions/workflows/build-and-push.yaml/badge.svg" alt="Build Status">
|
||||
</a>
|
||||
<a href="https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap" target="_blank" rel="noopener noreferrer">
|
||||
<img src="https://img.shields.io/badge/gitea-pi--farm-609930?logo=gitea&logoColor=white" alt="Gitea Repository">
|
||||
</a>
|
||||
|
||||
This repository is built and pushed automatically.
|
||||
|
||||
[](https://hub.docker.com/r/pifarm/base-image-debian-rdp-ldap)
|
||||
<a href="https://hub.docker.com/r/pifarm/base-image-debian-rdp-ldap" target="_blank" rel="noopener noreferrer"><img src="https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white" alt="Docker Hub"></a>
|
||||
|
||||
### 🏗️ Platform Support
|
||||
| Architecture | Status | Base Image | Build Date |
|
||||
| :--- | :--- | :--- | :--- |
|
||||
| x86_64 (amd64) | ✅ Active | debian:bookworm | 09.04.2026 15:23 |
|
||||
| aarch64 (arm64) | ✅ Active | debian:bookworm | 09.04.2026 15:23 |
|
||||
| x86_64 (amd64) | ✅ Active | debian:trixie | 27.10.2026 23:42 |
|
||||
| aarch64 (arm64) | ✅ Active | debian:trixie | 27.10.2026 23:42 |
|
||||
|
||||
### 🚀 Docker Pull
|
||||
```bash
|
||||
docker pull git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:bookworm-de
|
||||
```
|
||||
### 🚀 Docker Compose
|
||||
---
|
||||
|
||||
## 🐙 Method 1: Docker Compose (Recommended)
|
||||
|
||||
### 🚀 1. Create `docker-compose.yml`
|
||||
```yaml
|
||||
services:
|
||||
base-image-debian-rdp-ldap:
|
||||
image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:bookworm-de
|
||||
image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-mate-de
|
||||
container_name: base-image-debian-rdp-ldap
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- 3889
|
||||
- 3389:3389
|
||||
|
||||
environment:
|
||||
- SSSD_DEBUG_LEVEL=5
|
||||
- LDAP_URI=ldap://YOUR-LDAP-SERVER:389
|
||||
@@ -34,10 +39,28 @@ services:
|
||||
- LDAP_BIND_DN=cn=YOUR-BIND-USER,dc=YOUR-DOMAIN,dc=LOC
|
||||
- LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD
|
||||
- LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP
|
||||
|
||||
volumes:
|
||||
- ./YOUR-PERSISTENT-FOLDER:/home
|
||||
|
||||
```
|
||||
### 🚀 Docker Run
|
||||
### 🚀 2. Pull & start the container
|
||||
### Pull or update the image
|
||||
```bash
|
||||
docker compose pull
|
||||
```
|
||||
### Start container in background
|
||||
```bash
|
||||
docker compose up -d
|
||||
```
|
||||
---
|
||||
|
||||
## 🐳 Method 2: Standalone Container (Docker Run / CLI)
|
||||
### 🚀 1. Pull the image manually
|
||||
```bash
|
||||
docker pull git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-mate-de
|
||||
```
|
||||
### 🚀 2. Run the container directly
|
||||
```bash
|
||||
docker run -d \
|
||||
--name base-image-debian-rdp-ldap \
|
||||
@@ -49,27 +72,15 @@ docker run -d \
|
||||
-e LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD \
|
||||
-e LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP \
|
||||
-v ./YOUR-PERSISTENT-FOLDER:/home \
|
||||
-p 3889 \
|
||||
git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:bookworm-de
|
||||
-p 3389:3389 \
|
||||
git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-mate-de
|
||||
|
||||
```
|
||||
|
||||
*Last updated on: 09.04.2026 15:23*
|
||||
*Last updated on: 27.10.2026 23:42*
|
||||
|
||||
### 📜 Version History
|
||||
| Version | Date | Status |
|
||||
| :--- | :--- | :--- |
|
||||
| **bookworm-de** | 09.04.2026 15:23 | ✅ |
|
||||
| **trixie-de** | 09.04.2026 14:58 | ✅ |
|
||||
| **bookworm-de** | 09.04.2026 14:13 | ✅ |
|
||||
| **bookworm-de** | 09.04.2026 13:10 | ✅ |
|
||||
| **bookworm-de** | 09.04.2026 11:58 | ✅ |
|
||||
| **bookworm-de** | 09.04.2026 10:11 | ✅ |
|
||||
| **bookworm-de** | 07.04.2026 19:27 | ✅ |
|
||||
| **bookworm-de** | 07.04.2026 17:38 | ✅ |
|
||||
| **bookworm-de** | 05.04.2026 11:47 | ✅ |
|
||||
| **bookworm-de** | 05.04.2026 11:20 | ✅ |
|
||||
| **bookworm-de** | 04.04.2026 00:31 | ✅ |
|
||||
| **bookworm-de** | 02.04.2026 17:26 | ✅ |
|
||||
| **bookworm-de** | 02.04.2026 16:44 | ✅ |
|
||||
| **bookworm-de** | 02.04.2026 15:37 | ✅ |
|
||||
| **bookworm** | 02.04.2026 14:15 | ✅ |
|
||||
| **trixie-mate-de** | 27.10.2026 23:42 | ✅ |
|
||||
| **trixie-mate-de** | 27.10.2026 23:35 | ✅ |
|
||||
@@ -0,0 +1,2 @@
|
||||
| **trixie-mate-de** | 27.10.2026 23:42 | ✅ |
|
||||
| **trixie-mate-de** | 27.10.2026 23:35 | ✅ |
|
||||
+8
-5
@@ -1,7 +1,10 @@
|
||||
## BUILD STAGE
|
||||
BUILD_BASE_IMAGE=debian:bookworm
|
||||
## BASE CONFIG
|
||||
DEBIAN_CODENAME=trixie
|
||||
BUILD_COUNTRY=de
|
||||
BUILD_TAG=bookworm-de
|
||||
|
||||
## BUILD STAGE
|
||||
BUILD_BASE_IMAGE="debian:${DEBIAN_CODENAME}"
|
||||
BUILD_TAG="${DEBIAN_CODENAME}-mate-${BUILD_COUNTRY}"
|
||||
BUILD_TAG_LATEST=n
|
||||
BUILD_LANG=de_DE.UTF-8
|
||||
BUILD_LANGUAGE=de_DE:de
|
||||
@@ -22,6 +25,6 @@ ENV_LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP
|
||||
|
||||
## DOCKER / COMPOSE CONFIG
|
||||
VOL_HOME=./YOUR-PERSISTENT-FOLDER:/home
|
||||
PORT_RDP=3889
|
||||
PORT_RDP=3389:3389
|
||||
|
||||
DESCRIPTION="Debian Desktop with LDAP-Authentication and Pulse-Audio. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop."
|
||||
DESCRIPTION="Debian Desktop with LDAP Authentication and PulseAudio. To use behind Guacamole with LDAP Authentication and pass-through to Debian Desktop."
|
||||
+4
-2
@@ -1,10 +1,11 @@
|
||||
services:
|
||||
base-image-debian-rdp-ldap:
|
||||
image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:bookworm-de
|
||||
image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-mate-de
|
||||
container_name: base-image-debian-rdp-ldap
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- 3889
|
||||
- 3389:3389
|
||||
|
||||
environment:
|
||||
- SSSD_DEBUG_LEVEL=5
|
||||
- LDAP_URI=ldap://YOUR-LDAP-SERVER:389
|
||||
@@ -12,5 +13,6 @@ services:
|
||||
- LDAP_BIND_DN=cn=YOUR-BIND-USER,dc=YOUR-DOMAIN,dc=LOC
|
||||
- LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD
|
||||
- LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP
|
||||
|
||||
volumes:
|
||||
- ./YOUR-PERSISTENT-FOLDER:/home
|
||||
+33
-8
@@ -1,8 +1,6 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Mapping der Gitea-Workflow Variablen (ENV_...) auf interne Variablen
|
||||
# Falls ENV_LDAP_URI nicht gesetzt ist, wird ein Fallback genutzt
|
||||
LDAP_URI=${LDAP_URI:-"ldap://localhost:389"}
|
||||
LDAP_BASE_DN=${LDAP_BASE_DN:-"dc=example,dc=com"}
|
||||
LDAP_BIND_DN=${LDAP_BIND_DN:-"cn=admin,dc=example,dc=com"}
|
||||
@@ -33,9 +31,9 @@ ldap_default_authtok = ${LDAP_BIND_PASSWORD}
|
||||
ldap_schema = rfc2307bis
|
||||
ldap_group_member = uniqueMember
|
||||
|
||||
ldap_auth_disable_tls_never_use_in_production = true
|
||||
ldap_id_use_start_tls = false
|
||||
ldap_tls_reqcert = never
|
||||
ldap_auth_disable_tls_never_use_in_production = true
|
||||
|
||||
cache_credentials = true
|
||||
enumerate = false
|
||||
@@ -48,14 +46,41 @@ echo ">>> Erstelle Sudoers-Regel für Gruppe: ${LDAP_SUDO_GROUP}..."
|
||||
echo "%${LDAP_SUDO_GROUP} ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/ldap-admins
|
||||
chmod 0440 /etc/sudoers.d/ldap-admins
|
||||
|
||||
echo ">>> Bereinige SSSD Cache..."
|
||||
echo ">>> Erzwinge TLS für xrdp (Guacamole Fix)..."
|
||||
if [ -f /etc/xrdp/xrdp.ini ]; then
|
||||
sed -i 's/^security_layer=.*/security_layer=tls/' /etc/xrdp/xrdp.ini
|
||||
fi
|
||||
|
||||
echo ">>> Bereinige alte PID-Dateien und SSSD Cache..."
|
||||
rm -f /var/run/dbus/pid /run/dbus/dbus.pid /var/run/xrdp/*.pid /var/run/xrdp/xrdp-sesman.pid
|
||||
rm -f /var/lib/sss/db/*
|
||||
rm -f /var/lib/sss/mc/*
|
||||
|
||||
echo ">>> Starte Dienste..."
|
||||
# SSSD mit dem gemappten Debug-Level starten
|
||||
echo ">>> Starte D-Bus..."
|
||||
mkdir -p /var/run/dbus /run/dbus
|
||||
dbus-uuidgen --ensure
|
||||
dbus-daemon --system --fork
|
||||
|
||||
echo ">>> Starte SSSD..."
|
||||
sssd -D --debug-level=${SSSD_DEBUG}
|
||||
|
||||
service dbus start
|
||||
echo ">>> Starte XRDP..."
|
||||
xrdp-sesman
|
||||
exec xrdp -n
|
||||
xrdp
|
||||
|
||||
echo ">>> Leite Logs an Docker weiter..."
|
||||
mkdir -p /var/log/sssd /var/log/xrdp
|
||||
|
||||
touch /var/log/xrdp.log \
|
||||
/var/log/xrdp-sesman.log \
|
||||
/var/log/sssd/sssd.log \
|
||||
/var/log/sssd/sssd_LDAP.log \
|
||||
/var/log/sssd/sssd_nss.log \
|
||||
/var/log/sssd/sssd_pam.log
|
||||
|
||||
exec tail -F /var/log/xrdp.log \
|
||||
/var/log/xrdp-sesman.log \
|
||||
/var/log/sssd/sssd.log \
|
||||
/var/log/sssd/sssd_LDAP.log \
|
||||
/var/log/sssd/sssd_nss.log \
|
||||
/var/log/sssd/sssd_pam.log
|
||||
@@ -0,0 +1,44 @@
|
||||
sssd
|
||||
sssd-tools
|
||||
libpam-sss
|
||||
libnss-sss
|
||||
libsss-sudo
|
||||
ldap-utils
|
||||
ca-certificates
|
||||
xrdp
|
||||
xorgxrdp
|
||||
dbus
|
||||
dbus-x11
|
||||
mate-desktop-environment
|
||||
mate-terminal
|
||||
pluma
|
||||
xdg-user-dirs
|
||||
desktop-base
|
||||
sudo
|
||||
firefox-esr
|
||||
thunderbird
|
||||
geany
|
||||
locales
|
||||
tzdata
|
||||
keyboard-configuration
|
||||
x11-xkb-utils
|
||||
pulseaudio
|
||||
build-essential
|
||||
dpkg-dev
|
||||
git
|
||||
libpulse-dev
|
||||
meson
|
||||
ninja-build
|
||||
pkg-config
|
||||
autoconf
|
||||
libtool
|
||||
thunar-archive-plugin
|
||||
xarchiver
|
||||
unzip
|
||||
zip
|
||||
p7zip-full
|
||||
tar
|
||||
gzip
|
||||
bzip2
|
||||
dialog
|
||||
whiptail
|
||||
Reference in new issue
Block a user