revert 2b8b8260b1

revert add archive-tools

.gitea/workflows/build-and-push.yaml

@@ -1,18 +1,7 @@
 on:
   push:
     branches:
-      - 'dev'
+      - 'main'
-    paths-ignore:
-      - 'README.md'
-      - 'Dockerfile*'
-      - 'packages.txt'
-      - 'VERSION.history'
-      - 'docker-compose.yml'
-      - 'buildargs.env'
-      - 'entrypoint.sh'
-      - '*.md'
-      - '.gitignore'
-      - '.gitea/workflows/build-and-push.yaml'
     tags:
       - '*'
   schedule:
@@ -38,34 +27,33 @@ jobs:
         id: prep
         run: |
           export TZ=Europe/Berlin
+          
+          # FIX 1: Stellt sicher, dass die Datei mit einem Zeilenumbruch endet.
+          # Das verhindert, dass Bash die letzte Zeile beim Einlesen verschluckt.
           sed -i -e '$a\' buildargs.env
+          
           set -a
           source <(grep -v '^#' buildargs.env | sed 's/\r$//')
           set +a
-
+          
           echo "push_targets=$PUSH" >> $GITHUB_OUTPUT
 
           ARGS_HASH=$(grep "^BUILD_" buildargs.env | sha256sum | cut -d' ' -f1)
           echo "build_args_hash=$ARGS_HASH" >> $GITHUB_OUTPUT
           
           echo "event_name=${{ gitea.event_name }}" >> $GITHUB_OUTPUT
+          
+          # FIX 2: Kugelsicheres Auslesen des Tags direkt aus der Datei.
+          # Trimm-Befehle (tr) entfernen eventuelle unsichtbare Zeichen oder Anführungszeichen.
+          SAFE_BUILD_TAG=$(grep "^BUILD_TAG=" buildargs.env | cut -d'=' -f2 | tr -d '\r' | tr -d '"' | xargs)
+          
           if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then
             CLEAN_TAG=${{ gitea.ref_name }}
-            FINAL_TAG="${CLEAN_TAG#v}"
+            echo "docker_tag=${CLEAN_TAG#v}" >> $GITHUB_OUTPUT
           else
-            BASE_TAG="${BUILD_TAG:-${DEBIAN_CODENAME}-${BUILD_COUNTRY}}"
+            # Nutzt jetzt garantiert den direkt extrahierten Wert
-            if [[ "${{ gitea.ref_name }}" == "dev" ]]; then
+            echo "docker_tag=${SAFE_BUILD_TAG:-latest}" >> $GITHUB_OUTPUT
-              if [[ "$BASE_TAG" != *-dev ]]; then
-                FINAL_TAG="${BASE_TAG}-dev"
-              else
-                FINAL_TAG="$BASE_TAG"
-              fi
-            else
-              FINAL_TAG="${BASE_TAG%-dev}"
-            fi
           fi
-
-          echo "docker_tag=${FINAL_TAG:-latest}" >> $GITHUB_OUTPUT
           
           OWNER=$(echo "${{ gitea.repository }}" | cut -d'/' -f1 | tr '[:upper:]' '[:lower:]')
           REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2 | tr '[:upper:]' '[:lower:]')
@@ -132,7 +120,7 @@ jobs:
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-          
+
       - name: Build and Push Docker Image
         if: steps.check_changes.outputs.should_build == 'true'
         run: |
@@ -155,40 +143,26 @@ jobs:
           
           BASE_SHA=$(docker buildx imagetools inspect $BASE --format '{{json .Manifest.Digest}}' 2>/dev/null | tr -d '"' || echo "unknown")
 
+          # Bereite die Tags für den initialen Build vor (Gitea immer, Docker Hub optional)
           AMD_TAGS=("-t" "$IMAGE_GITEA:tmp-amd64")
-          GITEA_SOURCES=("$IMAGE_GITEA:tmp-amd64")
+          ARM_TAGS=("-t" "$IMAGE_GITEA:tmp-arm64")
           
           if [[ "$PUSH" == *"dockerhub"* ]]; then
             AMD_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-amd64")
-            DH_SOURCES=("$DOCKERHUB_REPO:tmp-amd64")
+            ARM_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-arm64")
           fi
 
+          # Build AMD64 & Push zu allen Zielen
           docker buildx build "${DOCKER_ARGS[@]}" "${AMD_TAGS[@]}" \
-            --cache-from "type=registry,ref=$IMAGE_GITEA:buildcache-amd64" \
-            --cache-to "type=registry,ref=$IMAGE_GITEA:buildcache-amd64,mode=max" \
             --pull --platform linux/amd64 -f Dockerfile \
             --label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
-
+          
-          if [ -f "Dockerfile.aarch64" ]; then
+          # Build ARM64 & Push zu allen Zielen
-            echo "⚙️ Dockerfile.aarch64 gefunden. Baue ARM64 Image..."
+          docker buildx build "${DOCKER_ARGS[@]}" "${ARM_TAGS[@]}" \
-            
+            --pull --platform linux/arm64 -f Dockerfile.aarch64 \
-            ARM_TAGS=("-t" "$IMAGE_GITEA:tmp-arm64")
+            --label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
-            GITEA_SOURCES+=("$IMAGE_GITEA:tmp-arm64")
+          
-            
+          # 1. Manifest auf Gitea erstellen (aus Gitea Temp-Tags)
-            if [[ "$PUSH" == *"dockerhub"* ]]; then
-              ARM_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-arm64")
-              DH_SOURCES+=("$DOCKERHUB_REPO:tmp-arm64")
-            fi
-
-            docker buildx build "${DOCKER_ARGS[@]}" "${ARM_TAGS[@]}" \
-              --cache-from "type=registry,ref=$IMAGE_GITEA:buildcache-arm64" \
-              --cache-to "type=registry,ref=$IMAGE_GITEA:buildcache-arm64,mode=max" \
-              --pull --platform linux/arm64 -f Dockerfile.aarch64 \
-              --label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
-          else
-            echo "Keine Dockerfile.aarch64 gefunden. ARM64 Build wird übersprungen."
-          fi
-
           GITEA_MANIFEST_TAGS=("-t" "$IMAGE_GITEA:$TAG")
           if [[ "$BUILD_TAG_LATEST" == "y" ]]; then
             GITEA_MANIFEST_TAGS+=("-t" "$IMAGE_GITEA:latest")
@@ -196,270 +170,260 @@ jobs:
 
           docker buildx imagetools create \
             --annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \
-            "${GITEA_MANIFEST_TAGS[@]}" "${GITEA_SOURCES[@]}"
+            "${GITEA_MANIFEST_TAGS[@]}" $IMAGE_GITEA:tmp-amd64 $IMAGE_GITEA:tmp-arm64
 
+          # 2. Manifest auf Docker Hub erstellen (aus Docker Hub Temp-Tags!)
           if [[ "$PUSH" == *"dockerhub"* ]]; then
             DH_MANIFEST_TAGS=("-t" "$DOCKERHUB_REPO:$TAG")
             if [[ "$BUILD_TAG_LATEST" == "y" ]]; then
               DH_MANIFEST_TAGS+=("-t" "$DOCKERHUB_REPO:latest")
             fi
 
+            # WICHTIG: Hier werden jetzt als Quelle die Docker Hub Temp-Tags genutzt!
             docker buildx imagetools create \
               --annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \
-              "${DH_MANIFEST_TAGS[@]}" "${DH_SOURCES[@]}"
+              "${DH_MANIFEST_TAGS[@]}" $DOCKERHUB_REPO:tmp-amd64 $DOCKERHUB_REPO:tmp-arm64
           fi
 
       - name: Update Documentation and Compose
         id: update_doc
         if: steps.check_changes.outputs.should_build == 'true'
         run: |
-          set -x 
+            set -x 
-            
-          export TZ=Europe/Berlin
-          CURRENT_TIME=$(date '+%d.%m.%Y %H:%M')
-          FULL_URL="${{ steps.prep.outputs.image_name }}"
-          REPO_PURE="${{ steps.prep.outputs.repo_pure }}"
-          BASE_IMAGE="${{ steps.prep.outputs.base_image }}"
-          
-          if [ ! -f "buildargs.env" ]; then echo "❌ buildargs.env missing!"; exit 1; fi
-
-          grep -v '^#' buildargs.env | sed 's/\r$//' > cleaned_env.sh
-          set -a
-          source ./cleaned_env.sh
-          set +a
-
-          BUILD_TAG="${{ steps.prep.outputs.docker_tag }}"
-
-          if [ -f "Dockerfile.aarch64" ]; then ARM_STATUS="✅ Active"; else ARM_STATUS="❌ Not supported"; fi
-          
-          RAW_COMMIT_MSG="${{ gitea.event.head_commit.message }}"
-          COMMIT_MSG=$(echo "$RAW_COMMIT_MSG" | sed 's/\[skip ci\]//g' | tr -d '\r\n' | xargs)
-
-          TOKEN="${{ secrets.RUNNER_TOKEN }}"
-          curl -sSLf -H "Authorization: token $TOKEN" \
-            "https://git.pi-farm.de/pi-farm/templates/raw/branch/main/README.template" \
-            -o README.template || echo "Warnung: README Template konnte nicht geladen werden"
-
-          curl -sSLf -H "Authorization: token $TOKEN" \
-            "https://git.pi-farm.de/pi-farm/templates/raw/branch/main/docker-compose.template" \
-            -o docker-compose.template || echo "Warnung: Compose Template konnte nicht geladen werden"
-
-          for t_file in README.template docker-compose.template; do
-            if [ -f "$t_file" ] && grep -qi "<!DOCTYPE html>" "$t_file"; then
-              echo "❌ FEHLER: $t_file ist eine HTML-Loginseite! Download verworfen."
-              rm -f "$t_file"
-            fi
-          done
-
-          NEW_ROW="| **$BUILD_TAG** | $CURRENT_TIME | $COMMIT_MSG ✅ |"
-          if [ -f "VERSION.history" ]; then
-             grep -v "| **$BUILD_TAG** |" VERSION.history > VERSION.history.tmp || true
-             echo "$NEW_ROW" > VERSION.history
-             cat VERSION.history.tmp >> VERSION.history
-             rm VERSION.history.tmp
-          else
-             echo "$NEW_ROW" > VERSION.history
-          fi
-          HISTORY_CONTENT=$(cat VERSION.history)
-
-          ENV_BLOCK_CONTENT=""
-          env_vars=$(grep '^ENV_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
-          if [ -n "$env_vars" ]; then
-            ENV_BLOCK_CONTENT="    environment:\n"
-            while read -r line; do
-              [ -z "$line" ] && continue
-              key=$(echo "$line" | cut -d= -f1); val=$(echo "$line" | cut -d= -f2-); clean_key=${key#ENV_}
-              ENV_BLOCK_CONTENT="${ENV_BLOCK_CONTENT}      - ${clean_key}=${val}\n"
-            done <<< "$env_vars"
-          fi
-
-          PORTS_BLOCK_CONTENT=""
-          port_vars=$(grep '^PORT_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
-          if [ -n "$port_vars" ]; then
-             PORTS_BLOCK_CONTENT="    ports:\n"
-             while read -r line; do
-               [ -z "$line" ] && continue
-               val=$(echo "$line" | cut -d= -f2-); PORTS_BLOCK_CONTENT="${PORTS_BLOCK_CONTENT}      - ${val}\n"
-             done <<< "$port_vars"
-          fi
-
-          VOL_BLOCK_CONTENT=""
-          vol_vars=$(grep '^VOL_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
-          if [ -n "$vol_vars" ]; then
-             VOL_BLOCK_CONTENT="    volumes:\n"
-             while read -r line; do
-               [ -z "$line" ] && continue
-               val=$(echo "$line" | cut -d= -f2-); VOL_BLOCK_CONTENT="${VOL_BLOCK_CONTENT}      - ${val}\n"
-             done <<< "$vol_vars"
-          fi
-
-          {
-            echo "docker run -d \\"
-            echo "  --name $REPO_PURE \\"
-            echo "  --restart unless-stopped \\"
-            
-            all_params=$(grep -E '^(PORT_|ENV_|VOL_)' buildargs.env | grep -v '^#' | sed 's/\r$//' || true)
-            if [ -n "$all_params" ]; then
-              while read -r line; do
-                [ -z "$line" ] && continue
-                if [[ "$line" =~ ^PORT_ ]]; then
-                  val=$(echo "$line" | cut -d= -f2-)
-                  echo "  -p ${val} \\"
-                elif [[ "$line" =~ ^ENV_ ]]; then
-                  key=$(echo "$line" | cut -d= -f1); clean_key=${key#ENV_}; val=$(echo "$line" | cut -d= -f2-)
-                  echo "  -e ${clean_key}=${val} \\"
-                elif [[ "$line" =~ ^VOL_ ]]; then
-                  val=$(echo "$line" | cut -d= -f2-)
-                  echo "  -v ${val} \\"
-                fi
-              done <<< "$all_params"
-            fi
-            echo "  $FULL_URL:$BUILD_TAG"
-          } > docker_run_block.txt
-
-          DOCKERHUB_LINK_CONTENT=""
-          if [[ "${{ steps.prep.outputs.push_targets }}" == *"dockerhub"* ]]; then
-            DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
-            DOCKERHUB_LINK_CONTENT='<a href="https://hub.docker.com/r/'"${DH_USER}"'/'"${REPO_PURE}"'" target="_blank" rel="noopener noreferrer"><img src="https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white" alt="Docker Hub"></a>'
-          fi
-
-          if ! command -v python3 &> /dev/null; then
-            echo "📦 python3 fehlt und wird installiert..."
-            (apt-get update && apt-get install -y python3) || (apk add --no-cache python3) || true
-          fi
-
-          # Python-Skript sauber als eigene Datei erstellen (vermeidet YAML-Syntaxfehler)
-          cat << 'EOF' > update_script.py
-          import os, sys
-
-          def process(output_file):
-              if not os.path.exists(output_file.replace('.md', '.template').replace('.yml', '.template')):
-                  return
               
-              template_name = output_file.replace('.md', '.template').replace('.yml', '.template')
+              export TZ=Europe/Berlin
-              with open(template_name, "r", encoding="utf-8") as f:
+              CURRENT_TIME=$(date '+%d.%m.%Y %H:%M')
-                  content = f.read()
+              BUILD_TAG="${{ steps.prep.outputs.docker_tag }}"
-
+              FULL_URL="${{ steps.prep.outputs.image_name }}"
-              content = content.replace("__REPO_NAME__", os.environ.get("REPO_PURE", ""))
+              REPO_PURE="${{ steps.prep.outputs.repo_pure }}"
-              content = content.replace("__FULL_URL__", os.environ.get("FULL_URL", ""))
+              BASE_IMAGE="${{ steps.prep.outputs.base_image }}"
-              content = content.replace("__BUILD_TAG__", os.environ.get("BUILD_TAG", ""))
+              
-              content = content.replace("__BASE_IMAGE__", os.environ.get("BASE_IMAGE", ""))
+              if [ ! -f "buildargs.env" ]; then echo "❌ buildargs.env missing!"; exit 1; fi
-              content = content.replace("__ARM_STATUS__", os.environ.get("ARM_STATUS", ""))
+        
-              content = content.replace("__CURRENT_DATE__", os.environ.get("CURRENT_TIME", ""))
+              grep -v '^#' buildargs.env | sed 's/\r$//' > cleaned_env.sh
-              content = content.replace("__HISTORY_CONTENT__", os.environ.get("HISTORY_CONTENT", ""))
+              set -a
-              content = content.replace("__DOCKERHUB_LINK__", os.environ.get("DOCKERHUB_LINK_CONTENT", ""))
+              source ./cleaned_env.sh
-              content = content.replace("__ENV_BLOCK__", os.environ.get("ENV_BLOCK_CONTENT", "").replace("\\n", "\n"))
+              set +a
-              content = content.replace("__PORTS_BLOCK__", os.environ.get("PORTS_BLOCK_CONTENT", "").replace("\\n", "\n"))
+        
-              content = content.replace("__VOL_BLOCK__", os.environ.get("VOL_BLOCK_CONTENT", "").replace("\\n", "\n"))
+              if [ -f "Dockerfile.aarch64" ]; then ARM_STATUS="✅ Active"; else ARM_STATUS="❌ Not supported"; fi
-              content = content.replace("__DESCRIPTION__", os.environ.get("DESCRIPTION", "Keine Beschreibung."))
+              
-
+              cat << 'EOF' > commit_msg.txt
-              if "__DOCKER_RUN__" in content and os.path.exists("docker_run_block.txt"):
+              ${{ gitea.event.head_commit.message }}
-                  with open("docker_run_block.txt", "r", encoding="utf-8") as f:
+              EOF
-                      content = content.replace("__DOCKER_RUN__", f.read())
+              COMMIT_MSG=$(sed 's/\[skip ci\]//g' commit_msg.txt | xargs)
-
+        
-              if "__COMPOSE_BLOCK__" in content and os.path.exists("docker-compose.yml"):
+              # 1. Authentifizierter Download der Templates via curl (-f bricht bei HTTP-Fehlern ab)
-                  with open("docker-compose.yml", "r", encoding="utf-8") as f:
+              TOKEN="${{ secrets.RUNNER_TOKEN }}"
-                      content = content.replace("__COMPOSE_BLOCK__", f.read())
+              curl -sSLf -H "Authorization: token $TOKEN" \
-
+                "https://git.pi-farm.de/pi-farm/templates/raw/branch/main/README.template" \
-              with open(output_file, "w", encoding="utf-8") as f:
+                -o README.template || echo "Warnung: README Template konnte nicht geladen werden"
-                  f.write(content)
+        
-
+              curl -sSLf -H "Authorization: token $TOKEN" \
-          process("docker-compose.yml")
+                "https://git.pi-farm.de/pi-farm/templates/raw/branch/main/docker-compose.template" \
-          process("README.md")
+                -o docker-compose.template || echo "Warnung: Compose Template konnte nicht geladen werden"
-          EOF
+        
-
+              # 2. Sicherheitsprüfung: Falls Gitea trotz -f eine HTML-Login-Seite ausgibt, Datei sofort verwerfen
-          export REPO_PURE FULL_URL BUILD_TAG BASE_IMAGE ARM_STATUS CURRENT_TIME \
+              for t_file in README.template docker-compose.template; do
-                 HISTORY_CONTENT DOCKERHUB_LINK_CONTENT ENV_BLOCK_CONTENT \
+                if [ -f "$t_file" ] && grep -qi "<!DOCTYPE html>" "$t_file"; then
-                 PORTS_BLOCK_CONTENT VOL_BLOCK_CONTENT DESCRIPTION
+                  echo "❌ FEHLER: $t_file ist eine HTML-Loginseite! Download verworfen."
-
+                  rm -f "$t_file"
-          python3 update_script.py
+                fi
-          rm -f update_script.py
+              done
-          
+        
-          echo "FINAL_MSG=$COMMIT_MSG" >> $GITHUB_ENV
+              NEW_ROW="| **$BUILD_TAG** | $CURRENT_TIME | $COMMIT_MSG ✅ |"
-          {
+              if [ -f "VERSION.history" ]; then
-            echo "DESCRIPTION<<EOF"
+                 grep -v "| **$BUILD_TAG** |" VERSION.history > VERSION.history.tmp || true
-            echo "$DESCRIPTION"
+                 echo "$NEW_ROW" > VERSION.history
-            echo "EOF"
+                 cat VERSION.history.tmp >> VERSION.history
-          } >> $GITHUB_ENV
+                 rm VERSION.history.tmp
+              else
+                 echo "$NEW_ROW" > VERSION.history
+              fi
+              HISTORY_CONTENT=$(cat VERSION.history)
+        
+              ENV_BLOCK_CONTENT=""
+              env_vars=$(grep '^ENV_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
+              if [ -n "$env_vars" ]; then
+                ENV_BLOCK_CONTENT="    environment:\n"
+                while read -r line; do
+                  [ -z "$line" ] && continue
+                  key=$(echo "$line" | cut -d= -f1); val=$(echo "$line" | cut -d= -f2-); clean_key=${key#ENV_}
+                  ENV_BLOCK_CONTENT="${ENV_BLOCK_CONTENT}      - ${clean_key}=${val}\n"
+                done <<< "$env_vars"
+              fi
+        
+              PORTS_BLOCK_CONTENT=""
+              port_vars=$(grep '^PORT_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
+              if [ -n "$port_vars" ]; then
+                 PORTS_BLOCK_CONTENT="    ports:\n"
+                 while read -r line; do
+                   [ -z "$line" ] && continue
+                   val=$(echo "$line" | cut -d= -f2-); PORTS_BLOCK_CONTENT="${PORTS_BLOCK_CONTENT}      - ${val}\n"
+                 done <<< "$port_vars"
+              fi
+        
+              VOL_BLOCK_CONTENT=""
+              vol_vars=$(grep '^VOL_' buildargs.env | grep -v '^#' | tr -d '\r' || true)
+              if [ -n "$vol_vars" ]; then
+                 VOL_BLOCK_CONTENT="    volumes:\n"
+                 while read -r line; do
+                   [ -z "$line" ] && continue
+                   val=$(echo "$line" | cut -d= -f2-); VOL_BLOCK_CONTENT="${VOL_BLOCK_CONTENT}      - ${val}\n"
+                 done <<< "$vol_vars"
+              fi
+        
+              {
+                echo "docker run -d \\"
+                echo "  --name $REPO_PURE \\"
+                echo "  --restart unless-stopped \\"
+                
+                all_params=$(grep -E '^(PORT_|ENV_|VOL_)' buildargs.env | grep -v '^#' | sed 's/\r$//' || true)
+                if [ -n "$all_params" ]; then
+                  while read -r line; do
+                    [ -z "$line" ] && continue
+                    if [[ "$line" =~ ^PORT_ ]]; then
+                      val=$(echo "$line" | cut -d= -f2-)
+                      echo "  -p ${val} \\"
+                    elif [[ "$line" =~ ^ENV_ ]]; then
+                      key=$(echo "$line" | cut -d= -f1); clean_key=${key#ENV_}; val=$(echo "$line" | cut -d= -f2-)
+                      echo "  -e ${clean_key}=${val} \\"
+                    elif [[ "$line" =~ ^VOL_ ]]; then
+                      val=$(echo "$line" | cut -d= -f2-)
+                      echo "  -v ${val} \\"
+                    fi
+                  done <<< "$all_params"
+                fi
+                echo "  $FULL_URL:$BUILD_TAG"
+              } > docker_run_block.txt
+        
+              DOCKERHUB_LINK_CONTENT=""
+              if [[ "${{ steps.prep.outputs.push_targets }}" == *"dockerhub"* ]]; then
+                DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
+                DOCKERHUB_LINK_CONTENT="[![Docker Hub](https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white)](https://hub.docker.com/r/${DH_USER}/${REPO_PURE})"
+              fi
+        
+              # Template-Verarbeitung via Python (verhindert awk-Abstürze bei Zeilenumbrüchen)
+              process_template() {
+                local template=$1; local output=$2
+                [ ! -f "$template" ] && return
+                cp "$template" "$output"
+        
+                export REPO_PURE FULL_URL BUILD_TAG BASE_IMAGE ARM_STATUS CURRENT_TIME \
+                       HISTORY_CONTENT DOCKERHUB_LINK_CONTENT ENV_BLOCK_CONTENT \
+                       PORTS_BLOCK_CONTENT VOL_BLOCK_CONTENT DESCRIPTION
+        
+                python3 -c '
+            import os, sys
+        
+            output = sys.argv[1]
+        
+            with open(output, "r", encoding="utf-8") as f:
+              content = f.read()
+        
+            content = content.replace("__REPO_NAME__", os.environ.get("REPO_PURE", ""))
+            content = content.replace("__FULL_URL__", os.environ.get("FULL_URL", ""))
+            content = content.replace("__BUILD_TAG__", os.environ.get("BUILD_TAG", ""))
+            content = content.replace("__BASE_IMAGE__", os.environ.get("BASE_IMAGE", ""))
+            content = content.replace("__ARM_STATUS__", os.environ.get("ARM_STATUS", ""))
+            content = content.replace("__CURRENT_DATE__", os.environ.get("CURRENT_TIME", ""))
+            content = content.replace("__HISTORY_CONTENT__", os.environ.get("HISTORY_CONTENT", ""))
+            content = content.replace("__DOCKERHUB_LINK__", os.environ.get("DOCKERHUB_LINK_CONTENT", ""))
+            content = content.replace("__ENV_BLOCK__", os.environ.get("ENV_BLOCK_CONTENT", "").replace("\\n", "\n"))
+            content = content.replace("__PORTS_BLOCK__", os.environ.get("PORTS_BLOCK_CONTENT", "").replace("\\n", "\n"))
+            content = content.replace("__VOL_BLOCK__", os.environ.get("VOL_BLOCK_CONTENT", "").replace("\\n", "\n"))
+            content = content.replace("__DESCRIPTION__", os.environ.get("DESCRIPTION", "Keine Beschreibung."))
             
-      - name: Push README to Docker Hub
+            if "__DOCKER_RUN__" in content and os.path.exists("docker_run_block.txt"):
-        if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub')
+                with open("docker_run_block.txt", "r", encoding="utf-8") as f:
-        run: |
+                    content = content.replace("__DOCKER_RUN__", f.read())
-          if ! command -v jq &> /dev/null; then
+            
-            apt-get update && apt-get install -y jq || apk add --no-cache jq || true
+            if "__COMPOSE_BLOCK__" in content and os.path.exists("docker-compose.yml"):
-          fi
+                with open("docker-compose.yml", "r", encoding="utf-8") as f:
-
+                    content = content.replace("__COMPOSE_BLOCK__", f.read())
-          echo "🚀 Starting update README on Docker Hub..."
+            
-
+            with open(output, "w", encoding="utf-8") as f:
-          TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
+                f.write(content)
-            -H "Content-Type: application/json" \
+            ' "$output"
-            -d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token)
+                  }
-
+            
-          if [ "$TOKEN" == "null" ] || [ -z "$TOKEN" ]; then
+                  process_template "docker-compose.template" "docker-compose.yml"
-            echo "❌ Error: No login-token available. Check your credentials!"
+                  process_template "README.template" "README.md"
-            exit 1
+                  
-          fi
+                  echo "FINAL_MSG=$COMMIT_MSG" >> $GITHUB_ENV
-
+                  echo "DESCRIPTION<<EOF" >> $GITHUB_ENV
-          REPO_PURE="${{ steps.prep.outputs.repo_pure }}"
+                  echo -e "$DESCRIPTION" >> $GITHUB_ENV
-          DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
+                  echo "EOF" >> $GITHUB_ENV
-          GITEA_URL="${{ steps.prep.outputs.image_name }}"
+            
-          DH_URL="${DH_USER}/${REPO_PURE}"
+              - name: Push README to Docker Hub
-
+                if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub')
-          SHORT_DESC=$(echo -e "${{ env.DESCRIPTION }}" | head -n 1 | cut -c 1-100)
+                run: |
-          [ -z "$SHORT_DESC" ] && SHORT_DESC="Docker Image for $REPO_PURE"
+                  if ! command -v jq &> /dev/null; then
-
+                    apt-get update && apt-get install -y jq || apk add --no-cache jq || true
-          echo "📦 Processing README.md for Docker Hub (${DH_URL})..."
+                  fi
-
+            
-          # Ersetzt die Image-URL NUR dann, wenn kein http:// oder https:// davor steht
+                  echo "🚀 Starting update README on Docker Hub..."
-          export GITEA_URL DH_URL
+            
-          python3 -c 'import os, re; content = open("README.md", "r", encoding="utf-8").read(); new_content = re.sub(r"(?<!https://)(?<!http://)" + re.escape(os.environ["GITEA_URL"]), os.environ["DH_URL"], content); open("README_DH.md", "w", encoding="utf-8").write(new_content)'
+                  TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
-
+                    -H "Content-Type: application/json" \
-          jq -n \
+                    -d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token)
-            --arg desc "$SHORT_DESC" \
+            
-            --rawfile full_desc README_DH.md \
+                  if [ "$TOKEN" == "null" ] || [ -z "$TOKEN" ]; then
-            '{description: $desc, full_description: $full_desc}' > payload.json
+                    echo "❌ Error: No login-token available. Check your credentials!"
-
+                    exit 1
-          echo "📤 Sending data to Docker Hub API..."
+                  fi
-          RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
+            
-            "https://hub.docker.com/v2/repositories/${DH_USER}/${REPO_PURE}/" \
+                  REPO_PURE="${{ steps.prep.outputs.repo_pure }}"
-            -H "Authorization: JWT ${TOKEN}" \
+                  DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
-            -H "Content-Type: application/json" \
+                  
-            -d @payload.json)
+                  SHORT_DESC=$(echo -e "${{ env.DESCRIPTION }}" | head -n 1 | cut -c 1-100)
-
+                  [ -z "$SHORT_DESC" ] && SHORT_DESC="Docker Image for $REPO_PURE"
-          HTTP_STATUS=$(echo "$RESPONSE" | tail -n 1)
+            
-          BODY=$(echo "$RESPONSE" | head -n -1)
+                  echo "📦 Processing README.md (${REPO_PURE})..."
-
+            
-          if [ "$HTTP_STATUS" -eq 200 ]; then
+                  jq -n \
-            echo "✅ README update successful (HTTP 200)."
+                    --arg desc "$SHORT_DESC" \
-          else
+                    --rawfile full_desc README.md \
-            echo "❌ Error on update! HTTP Status: $HTTP_STATUS"
+                    '{description: $desc, full_description: $full_desc}' > payload.json
-            echo "Answer from Docker Hub: $BODY"
+            
-            exit 1
+                  echo "📤 Sending data to Docker Hub API..."
-          fi
+                  RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
-
+                    "https://hub.docker.com/v2/repositories/${DH_USER}/${REPO_PURE}/" \
-          rm -f README_DH.md
+                    -H "Authorization: JWT ${TOKEN}" \
-
+                    -H "Content-Type: application/json" \
-      - name: Commit, Tag and Push Changes
+                    -d @payload.json)
-        if: steps.check_changes.outputs.should_build == 'true'
+            
-        run: |
+                  HTTP_STATUS=$(echo "$RESPONSE" | tail -n 1)
-          git config --local user.email "action@pi-farm.de"
+                  BODY=$(echo "$RESPONSE" | head -n -1)
-          git config --local user.name "Gitea Action"
+            
-          
+                  if [ "$HTTP_STATUS" -eq 200 ]; then
-          git add VERSION.history README.md docker-compose.yml
+                    echo "✅ README update successfull (HTTP 200)."
-          
+                  else
-          git diff --quiet && git diff --staged --quiet || git commit -m "${{ env.FINAL_MSG }} [skip ci]"
+                    echo "❌ Error on update! HTTP Status: $HTTP_STATUS"
-          
+                    echo "Answer from Docker Hub: $BODY"
-          TARGET_TAG="${{ steps.prep.outputs.docker_tag }}"
+                    exit 1
-          git tag -f "$TARGET_TAG"
+                  fi
-          
+            
-          if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then
+              - name: Commit, Tag and Push Changes
-            echo "🏷️ Build aus Tag getriggert: $TARGET_TAG"
+                if: steps.check_changes.outputs.should_build == 'true'
-            git push -f origin "$TARGET_TAG"
+                run: |
-          else
+                  git config --local user.email "action@pi-farm.de"
-            echo "🌿 Build aus Branch/Schedule getriggert: ${{ gitea.ref_name }}"
+                  git config --local user.name "Gitea Action"
-            git push origin HEAD:${{ gitea.ref_name }}
+                  
-            git push -f origin "$TARGET_TAG"
+                  git add VERSION.history README.md docker-compose.yml
-          fi  
+                  
+                  git diff --quiet && git diff --staged --quiet || git commit -m "${{ env.FINAL_MSG }} [skip ci]"
+                  
+                  TARGET_TAG="${{ steps.prep.outputs.docker_tag }}"
+                  git tag -f "$TARGET_TAG"
+                  
+                  if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then
+                    echo "🏷️ Build aus Tag getriggert: $TARGET_TAG"
+                    git push -f origin "$TARGET_TAG"
+                  else
+                    echo "🌿 Build aus Branch/Schedule getriggert: ${{ gitea.ref_name }}"
+                    git push origin HEAD:${{ gitea.ref_name }}
+                    git push -f origin "$TARGET_TAG"
+                  fi  
 
       - name: Cleanup Temporary Tags on Docker Hub
         if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub')
@@ -472,22 +436,17 @@ jobs:
           
           TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
             -H "Content-Type: application/json" \
-            -d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token || echo "")
+            -d "{\"username\": \"${{ secrets.DOCKERHUB_USERNAME }}\", \"password\": \"${{ secrets.DOCKERHUB_TOKEN }}\"}" | jq -r .token)
 
           if [ "$TOKEN" != "null" ] && [ -n "$TOKEN" ]; then
             REPO_PURE=${{ steps.prep.outputs.repo_pure }}
             DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
             
-            CLEAN_TAGS=("tmp-amd64")
+            for t in tmp-amd64 tmp-arm64; do
-            if [ -f "Dockerfile.aarch64" ]; then
-              CLEAN_TAGS+=("tmp-arm64")
-            fi
-
-            for t in "${CLEAN_TAGS[@]}"; do
               echo "Deleting tag $t..."
               STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE \
                 "https://hub.docker.com/v2/repositories/${DH_USER}/${REPO_PURE}/tags/$t/" \
-                -H "Authorization: JWT ${TOKEN}" || echo "000")
+                -H "Authorization: JWT ${TOKEN}")
               echo "Status: $STATUS"
             done
             echo "✅ Temp. tags deleted."
@@ -496,18 +455,13 @@ jobs:
       - name: Cleanup Temporary Registry Tags (Gitea)
         if: steps.check_changes.outputs.should_build == 'true'
         run: |
-            TOKEN="${{ secrets.RUNNER_TOKEN }}"
+            TOKEN="${{ secrets.GIT_TOKEN }}"
             ORG_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f1)
             REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2)
             
-            CLEAN_TAGS=("tmp-amd64")
+            for t in tmp-amd64 tmp-arm64; do
-            if [ -f "Dockerfile.aarch64" ]; then
+              curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/$ORG_NAME/container/$REPO_NAME/$t" -H "Authorization: token $TOKEN"
-              CLEAN_TAGS+=("tmp-arm64")
+              curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/${ORG_NAME,,}/container/${REPO_NAME,,}/$t" -H "Authorization: token $TOKEN"
-            fi
-            
-            for t in "${CLEAN_TAGS[@]}"; do
-              curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/$ORG_NAME/container/$REPO_NAME/$t" -H "Authorization: token $TOKEN" || true
-              curl -s -X DELETE "https://git.pi-farm.de/api/v1/packages/${ORG_NAME,,}/container/${REPO_NAME,,}/$t" -H "Authorization: token $TOKEN" || true
             done
 
       - name: Cleanup Docker Artifacts

.gitignore

@@ -11,5 +11,4 @@ Thumbs.db
 config/*
 !config/.gitkeep
 home/*
-!home/.gitkeep
+!home/.gitkeep
-.vscode/*

Dockerfile

@@ -1,4 +1,4 @@
-ARG BUILD_BASE_IMAGE
+ARG BUILD_BASE_IMAGE=debian:bookworm
 
 FROM ${BUILD_BASE_IMAGE}
 
@@ -20,13 +20,38 @@ ENV LC_ALL=${BUILD_LC_ALL}
 ENV COUNTRY=${BUILD_COUNTRY}
 ENV DEBIAN_FRONTEND=noninteractive
 
-COPY packages.txt /tmp/packages.txt
-
 RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources && \
-    apt-get update && apt-get install -y --no-install-recommends \
+    apt-get update && apt-get install -y \
-    $(cat /tmp/packages.txt) \
+    xrdp \
-    firefox-esr-l10n-${BUILD_COUNTRY} \
+    sssd \
-    thunderbird-l10n-${BUILD_COUNTRY} && \
+    sssd-tools \
+    libpam-sss \
+    libnss-sss \
+    libsss-sudo \
+    ldap-utils \
+    ca-certificates \
+    dbus-x11 \
+    xfce4 \
+    xfce4-terminal \
+    sudo \
+    firefox-esr \
+    firefox-esr-l10n-${COUNTRY} \
+    thunderbird \
+    thunderbird-l10n-${COUNTRY} \
+    locales \
+    tzdata \
+    keyboard-configuration \
+    x11-xkb-utils \
+    pulseaudio \
+    build-essential \
+    dpkg-dev \
+    git \
+    libpulse-dev \
+    meson \
+    ninja-build \
+    pkg-config \
+    autoconf \
+    libtool && \
     apt-get build-dep -y pulseaudio && \
     cd /tmp && \
     apt-get source pulseaudio && \
@@ -54,19 +79,15 @@ RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.s
     ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime && \
     dpkg-reconfigure -f noninteractive tzdata && \
     printf 'XKBMODEL="pc105"\nXKBLAYOUT="%s"\nXKBVARIANT=""\nXKBOPTIONS=""\nBACKSPACE="guess"\n' "${COUNTRY}" > /etc/default/keyboard && \
-    dpkg-reconfigure -f noninteractive keyboard-configuration && \
+    dpkg-reconfigure -f noninteractive keyboard-configuration
-    rm -rf /var/lib/apt/lists/* /tmp/packages.txt
 
+# NEU: Systemweite statische Konfigurationen für LDAP/PAM/Sudo
+# 1. Entfernt die gefährliche %users Regel
+# 2. Sagt nsswitch, dass Sudoers auch im SSS (LDAP) gesucht werden sollen
+# 3. Aktiviert das automatische Erstellen von Home-Verzeichnissen (mkhomedir)
 RUN sed -i '/%users/s/^/# /' /etc/sudoers && \
     echo "sudoers: files sss" >> /etc/nsswitch.conf && \
-    echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0077" >> /etc/pam.d/common-session && \
+    echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0022" >> /etc/pam.d/common-session
-    mkdir -p /etc/skel/.config/lxqt && \
-    cat <<'EOF' > /etc/skel/.config/lxqt/lxqt.conf
-[General]
-__userfile__=true
-icon_theme=Adwaita
-theme=KDE-Plasma
-EOF
 
 RUN chmod 440 /etc/sudoers && \
     mkdir -p /etc/sssd && chown root:root /etc/sssd && chmod 755 /etc/sssd && \
@@ -77,17 +98,10 @@ RUN chmod 440 /etc/sudoers && \
     echo "LANG=${LANG}" >> /etc/environment && \
     echo "LANGUAGE=${LANGUAGE}" >> /etc/environment && \
     echo "LC_ALL=${LC_ALL}" >> /etc/environment && \
-    echo "#!/bin/sh" > /etc/xrdp/startwm.sh && \
+    sed -i '2i export LANG=${LANG}\nexport LANGUAGE=${LANGUAGE}\nexport LC_ALL=${LC_ALL}\npulseaudio --start\npactl load-module module-xrdp-sink.so\npactl load-module module-xrdp-source.so' /etc/xrdp/startwm.sh && \
-    echo "export LANG=${LANG}" >> /etc/xrdp/startwm.sh && \
+    chmod +x /etc/xrdp/startwm.sh && \
-    echo "export LANGUAGE=${LANGUAGE}" >> /etc/xrdp/startwm.sh && \
+    mkdir -p /etc/xdg/xfce4 && \
-    echo "export LC_ALL=${LC_ALL}" >> /etc/xrdp/startwm.sh && \
+    echo "setxkbmap ${COUNTRY}" >> /etc/xdg/xfce4/xinitrc
-    echo "export XDG_SESSION_TYPE=x11" >> /etc/xrdp/startwm.sh && \
-    echo "setxkbmap ${COUNTRY}" >> /etc/xrdp/startwm.sh && \
-    echo "pulseaudio --start" >> /etc/xrdp/startwm.sh && \
-    echo "pactl load-module module-xrdp-sink.so" >> /etc/xrdp/startwm.sh && \
-    echo "pactl load-module module-xrdp-source.so" >> /etc/xrdp/startwm.sh && \
-    echo "exec dbus-launch --exit-with-session startlxqt" >> /etc/xrdp/startwm.sh && \
-    chmod +x /etc/xrdp/startwm.sh
 
 EXPOSE 3389
 

Dockerfile.aarch64

@@ -1,4 +1,4 @@
-ARG BUILD_BASE_IMAGE
+ARG BUILD_BASE_IMAGE=debian:bookworm
 
 FROM ${BUILD_BASE_IMAGE}
 
@@ -20,13 +20,38 @@ ENV LC_ALL=${BUILD_LC_ALL}
 ENV COUNTRY=${BUILD_COUNTRY}
 ENV DEBIAN_FRONTEND=noninteractive
 
-COPY packages.txt /tmp/packages.txt
-
 RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources && \
-    apt-get update && apt-get install -y --no-install-recommends \
+    apt-get update && apt-get install -y \
-    $(cat /tmp/packages.txt) \
+    xrdp \
-    firefox-esr-l10n-${BUILD_COUNTRY} \
+    sssd \
-    thunderbird-l10n-${BUILD_COUNTRY} && \
+    sssd-tools \
+    libpam-sss \
+    libnss-sss \
+    libsss-sudo \
+    ldap-utils \
+    ca-certificates \
+    dbus-x11 \
+    xfce4 \
+    xfce4-terminal \
+    sudo \
+    firefox-esr \
+    firefox-esr-l10n-${COUNTRY} \
+    thunderbird \
+    thunderbird-l10n-${COUNTRY} \
+    locales \
+    tzdata \
+    keyboard-configuration \
+    x11-xkb-utils \
+    pulseaudio \
+    build-essential \
+    dpkg-dev \
+    git \
+    libpulse-dev \
+    meson \
+    ninja-build \
+    pkg-config \
+    autoconf \
+    libtool && \
     apt-get build-dep -y pulseaudio && \
     cd /tmp && \
     apt-get source pulseaudio && \
@@ -54,19 +79,15 @@ RUN sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.s
     ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime && \
     dpkg-reconfigure -f noninteractive tzdata && \
     printf 'XKBMODEL="pc105"\nXKBLAYOUT="%s"\nXKBVARIANT=""\nXKBOPTIONS=""\nBACKSPACE="guess"\n' "${COUNTRY}" > /etc/default/keyboard && \
-    dpkg-reconfigure -f noninteractive keyboard-configuration && \
+    dpkg-reconfigure -f noninteractive keyboard-configuration
-    rm -rf /var/lib/apt/lists/* /tmp/packages.txt
 
+# NEU: Systemweite statische Konfigurationen für LDAP/PAM/Sudo
+# 1. Entfernt die gefährliche %users Regel
+# 2. Sagt nsswitch, dass Sudoers auch im SSS (LDAP) gesucht werden sollen
+# 3. Aktiviert das automatische Erstellen von Home-Verzeichnissen (mkhomedir)
 RUN sed -i '/%users/s/^/# /' /etc/sudoers && \
     echo "sudoers: files sss" >> /etc/nsswitch.conf && \
-    echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0077" >> /etc/pam.d/common-session && \
+    echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0022" >> /etc/pam.d/common-session
-    mkdir -p /etc/skel/.config/lxqt && \
-    cat <<'EOF' > /etc/skel/.config/lxqt/lxqt.conf
-[General]
-__userfile__=true
-icon_theme=Adwaita
-theme=KDE-Plasma
-EOF
 
 RUN chmod 440 /etc/sudoers && \
     mkdir -p /etc/sssd && chown root:root /etc/sssd && chmod 755 /etc/sssd && \
@@ -77,17 +98,10 @@ RUN chmod 440 /etc/sudoers && \
     echo "LANG=${LANG}" >> /etc/environment && \
     echo "LANGUAGE=${LANGUAGE}" >> /etc/environment && \
     echo "LC_ALL=${LC_ALL}" >> /etc/environment && \
-    echo "#!/bin/sh" > /etc/xrdp/startwm.sh && \
+    sed -i '2i export LANG=${LANG}\nexport LANGUAGE=${LANGUAGE}\nexport LC_ALL=${LC_ALL}\npulseaudio --start\npactl load-module module-xrdp-sink.so\npactl load-module module-xrdp-source.so' /etc/xrdp/startwm.sh && \
-    echo "export LANG=${LANG}" >> /etc/xrdp/startwm.sh && \
+    chmod +x /etc/xrdp/startwm.sh && \
-    echo "export LANGUAGE=${LANGUAGE}" >> /etc/xrdp/startwm.sh && \
+    mkdir -p /etc/xdg/xfce4 && \
-    echo "export LC_ALL=${LC_ALL}" >> /etc/xrdp/startwm.sh && \
+    echo "setxkbmap ${COUNTRY}" >> /etc/xdg/xfce4/xinitrc
-    echo "export XDG_SESSION_TYPE=x11" >> /etc/xrdp/startwm.sh && \
-    echo "setxkbmap ${COUNTRY}" >> /etc/xrdp/startwm.sh && \
-    echo "pulseaudio --start" >> /etc/xrdp/startwm.sh && \
-    echo "pactl load-module module-xrdp-sink.so" >> /etc/xrdp/startwm.sh && \
-    echo "pactl load-module module-xrdp-source.so" >> /etc/xrdp/startwm.sh && \
-    echo "exec dbus-launch --exit-with-session startlxqt" >> /etc/xrdp/startwm.sh && \
-    chmod +x /etc/xrdp/startwm.sh
 
 EXPOSE 3389
 

README.md

@@ -1,37 +1,32 @@
 # base-image-debian-rdp-ldap
-Debian Desktop with LDAP Authentication and PulseAudio. To use behind Guacamole with LDAP Authentication and pass-through to Debian Desktop.
+Debian Desktop with LDAP-Authentication and Pulse-Audio. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop.
 
-<a href="https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions" target="_blank" rel="noopener noreferrer">
+[![Build Status](https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions/workflows/build-and-push.yaml/badge.svg)](https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions)
-  <img src="https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions/workflows/build-and-push.yaml/badge.svg" alt="Build Status">
+[![Gitea Repo](https://img.shields.io/badge/gitea-repository-blue?logo=gitea&logoColor=white)](__REPO_URL__)
-</a>
-<a href="https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap" target="_blank" rel="noopener noreferrer">
-  <img src="https://img.shields.io/badge/gitea-pi--farm-609930?logo=gitea&logoColor=white" alt="Gitea Repository">
-</a>
 
 This repository is built and pushed automatically.
 
-<a href="https://hub.docker.com/r/pifarm/base-image-debian-rdp-ldap" target="_blank" rel="noopener noreferrer"><img src="https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white" alt="Docker Hub"></a>
+[![Docker Hub](https://img.shields.io/badge/docker-hub-blue?logo=docker__DOCKERHUB_LINK__logoColor=white)](https://hub.docker.com/r/pifarm/base-image-debian-rdp-ldap)
 
 ### 🏗️ Platform Support
 | Architecture | Status | Base Image | Build Date |
 | :--- | :--- | :--- | :--- |
-| x86_64 (amd64) | ✅ Active | debian:bookworm | 10.10.2026 23:50 |
+| x86_64 (amd64) | ✅ Active | debian:trixie | 09.08.2026 07:29 |
-| aarch64 (arm64) | ✅ Active | debian:bookworm | 10.10.2026 23:50 |
+| aarch64 (arm64) | ✅ Active | debian:trixie | 09.08.2026 07:29 |
 
----
+### 🚀 Docker Pull
-
+```bash
-## 🐙 Method 1: Docker Compose (Recommended)
+docker pull git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de
-
+```
-### 🚀 1. Create `docker-compose.yml`
+### 🚀 Docker Compose
 ```yaml
 services:
   base-image-debian-rdp-ldap:
-    image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:bookworm-lxqt-de
+    image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de
     container_name: base-image-debian-rdp-ldap
     restart: unless-stopped
     ports:
-      - 3389:3389
+      - 3889
-
     environment:
       - SSSD_DEBUG_LEVEL=5
       - LDAP_URI=ldap://YOUR-LDAP-SERVER:389
@@ -39,28 +34,10 @@ services:
       - LDAP_BIND_DN=cn=YOUR-BIND-USER,dc=YOUR-DOMAIN,dc=LOC
       - LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD
       - LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP
-
     volumes:
       - ./YOUR-PERSISTENT-FOLDER:/home
-
 ```
-### 🚀 2. Pull & start the container
+### 🚀 Docker Run
-### Pull or update the image
-```bash
-docker compose pull
-```
-### Start container in background
-```bash
-docker compose up -d
-```
----
-
-## 🐳 Method 2: Standalone Container (Docker Run / CLI)
-### 🚀 1. Pull the image manually
-```bash
-docker pull git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:bookworm-lxqt-de
-```
-### 🚀 2. Run the container directly
 ```bash
 docker run -d \
   --name base-image-debian-rdp-ldap \
@@ -72,25 +49,26 @@ docker run -d \
   -e LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD \
   -e LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP \
   -v ./YOUR-PERSISTENT-FOLDER:/home \
-  -p 3389:3389 \
+  -p 3889 \
-  git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:bookworm-lxqt-de
+  git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:trixie-de
-
 ```
 
-*Last updated on: 10.10.2026 23:50*
+*Last updated on: 09.08.2026 07:29*
 
 ### 📜 Version History
 | Version | Date | Status |
 | :--- | :--- | :--- |
-| **bookworm-lxqt-de** | 10.10.2026 23:50 |  ✅ |
+| **trixie-de** | 09.08.2026 07:29 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 19:45 |  ✅ |
+| **trixie-de** | 19.07.2026 07:26 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 19:30 |  ✅ |
+| **trixie-de** | 28.06.2026 07:27 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 18:27 |  ✅ |
+| **trixie-de** | 14.06.2026 07:25 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 17:46 |  ✅ |
+| **trixie-de** | 04.06.2026 13:41 | build trixie-de latest ✅ |
-| **bookworm-de-dev** | 10.10.2026 17:26 |  ✅ |
+| **trixie-de** | 04.06.2026 12:25 | Trixie build ✅ |
-| **bookworm-de-dev** | 10.10.2026 17:24 |  ✅ |
+| **bookworm-de** | 02.06.2026 18:17 | .gitea/workflows/build-and-push.yaml aktualisiert ✅ |
-| **bookworm-de-dev** | 10.10.2026 17:03 |  ✅ |
+| **bookworm-de** | 02.06.2026 17:04 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 16:32 |  ✅ |
+| **bookworm-de** | 24.05.2026 07:22 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 15:59 |  ✅ |
+| **bookworm-de** | 10.05.2026 07:21 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 15:36 |  ✅ |
+| **bookworm-de** | 26.04.2026 07:23 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 15:29 |  ✅ |
+| **bookworm-de** | 09.04.2026 17:19 | build for bookworm ✅ |
+| **trixie-de** | 09.04.2026 16:44 | build for trixie-de ✅ |
+| **bookworm-de** | 09.04.2026 16:15 | Merge pull request dev (#2) from dev into main Reviewed-on: https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/pulls/2 ✅ |

VERSION.history

@@ -1,12 +1,15 @@
-| **bookworm-lxqt-de** | 10.10.2026 23:50 |  ✅ |
+| **trixie-de** | 06.10.2026 17:30 | .gitea/workflows/build-and-push.yaml aktualisiert ✅ |
-| **bookworm-de-dev** | 10.10.2026 19:45 |  ✅ |
+| **trixie-de** | 09.08.2026 07:29 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 19:30 |  ✅ |
+| **trixie-de** | 19.07.2026 07:26 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 18:27 |  ✅ |
+| **trixie-de** | 28.06.2026 07:27 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 17:46 |  ✅ |
+| **trixie-de** | 14.06.2026 07:25 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 17:26 |  ✅ |
+| **trixie-de** | 04.06.2026 13:41 | build trixie-de latest ✅ |
-| **bookworm-de-dev** | 10.10.2026 17:24 |  ✅ |
+| **trixie-de** | 04.06.2026 12:25 | Trixie build ✅ |
-| **bookworm-de-dev** | 10.10.2026 17:03 |  ✅ |
+| **bookworm-de** | 02.06.2026 18:17 | .gitea/workflows/build-and-push.yaml aktualisiert ✅ |
-| **bookworm-de-dev** | 10.10.2026 16:32 |  ✅ |
+| **bookworm-de** | 02.06.2026 17:04 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 15:59 |  ✅ |
+| **bookworm-de** | 24.05.2026 07:22 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 15:36 |  ✅ |
+| **bookworm-de** | 10.05.2026 07:21 |  ✅ |
-| **bookworm-de-dev** | 10.10.2026 15:29 |  ✅ |
+| **bookworm-de** | 26.04.2026 07:23 |  ✅ |
+| **bookworm-de** | 09.04.2026 17:19 | build for bookworm ✅ |
+| **trixie-de** | 09.04.2026 16:44 | build for trixie-de ✅ |
+| **bookworm-de** | 09.04.2026 16:15 | Merge pull request dev (#2) from dev into main Reviewed-on: https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/pulls/2 ✅ |

buildargs.env

@@ -1,11 +1,8 @@
-## BASE CONFIG
-DEBIAN_CODENAME=bookworm
-BUILD_COUNTRY=de
-
 ## BUILD STAGE
-BUILD_BASE_IMAGE="debian:${DEBIAN_CODENAME}"
+BUILD_BASE_IMAGE=debian:trixie
-BUILD_TAG="${DEBIAN_CODENAME}-lxqt-${BUILD_COUNTRY}"
+BUILD_COUNTRY=de
-BUILD_TAG_LATEST=n
+BUILD_TAG=trixie-de
+BUILD_TAG_LATEST=y
 BUILD_LANG=de_DE.UTF-8
 BUILD_LANGUAGE=de_DE:de
 BUILD_LC_ALL=de_DE.UTF-8
@@ -25,6 +22,6 @@ ENV_LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP
 
 ## DOCKER / COMPOSE CONFIG
 VOL_HOME=./YOUR-PERSISTENT-FOLDER:/home
-PORT_RDP=3389:3389
+PORT_RDP=3889
 
-DESCRIPTION="Debian Desktop with LDAP Authentication and PulseAudio. To use behind Guacamole with LDAP Authentication and pass-through to Debian Desktop."
+DESCRIPTION="Debian Desktop with LDAP-Authentication and Pulse-Audio. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop."

docker-compose.yml

@@ -1,18 +1,281 @@
-services:
+<!DOCTYPE html>
-  base-image-debian-rdp-ldap:
+<html lang="en-US" data-theme="gitea-auto">
-    image: git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:bookworm-lxqt-de
+<head>
-    container_name: base-image-debian-rdp-ldap
+	<meta http-equiv="Content-Security-Policy" content="default-src * data: blob:;script-src * &#39;nonce-2f1114650edc4dcd89ad1b32c2c5a1c0&#39;;style-src * &#39;unsafe-inline&#39;;">
-    restart: unless-stopped
+	<meta name="viewport" content="width=device-width, initial-scale=1">
-    ports:
+	<title>Sign In - Gitea: Git with a cup of tea</title>
-      - 3389:3389
+	<link rel="manifest" href="/assets/site-manifest.json">
+	<meta name="author" content="Gitea - Git with a cup of tea">
+	<meta name="description" content="Gitea (Git with a cup of tea) is a painless self-hosted Git service written in Go">
+	<meta name="keywords" content="go,git,self-hosted,gitea">
+	<meta name="referrer" content="same-origin">
 
-    environment:
-      - SSSD_DEBUG_LEVEL=5
-      - LDAP_URI=ldap://YOUR-LDAP-SERVER:389
-      - LDAP_BASE_DN=dc=YOUR-DOMAIN,dc=LOC
-      - LDAP_BIND_DN=cn=YOUR-BIND-USER,dc=YOUR-DOMAIN,dc=LOC
-      - LDAP_BIND_PASSWORD=YOUR-SUPER-SECRET-BIND-PASSWORD
-      - LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP
 
-    volumes:
+	<link rel="icon" href="/assets/img/favicon.svg" type="image/svg+xml">
-      - ./YOUR-PERSISTENT-FOLDER:/home
+	<link rel="alternate icon" href="/assets/img/favicon.png" type="image/png">
+	
+	<meta property="og:title" content="Gitea: Git with a cup of tea">
+	<meta property="og:type" content="website">
+	<meta property="og:image" content="/assets/img/logo.png">
+	<meta property="og:url" content="https://git.pi-farm.de">
+	<meta property="og:description" content="Gitea (Git with a cup of tea) is a painless self-hosted Git service written in Go">
+
+<meta property="og:site_name" content="Gitea: Git with a cup of tea">
+
+	<link rel="stylesheet" href="/assets/css/index.BHUwT9fG.css">
+<link rel="stylesheet" href="/assets/css/theme-gitea-auto.v3RW7v-i.css">
+
+	
+<script nonce="2f1114650edc4dcd89ad1b32c2c5a1c0">
+	
+	window.addEventListener('error', function(e) {window._globalHandlerErrors=window._globalHandlerErrors||[]; window._globalHandlerErrors.push(e);});
+	window.addEventListener('unhandledrejection', function(e) {window._globalHandlerErrors=window._globalHandlerErrors||[]; window._globalHandlerErrors.push(e);});
+	window.config = {
+		appUrl: 'https:\/\/git.pi-farm.de\/',
+		appSubUrl: '',
+		assetUrlPrefix: '\/assets',
+		runModeIsProd:  true ,
+		customEmojis: {"codeberg":":codeberg:","git":":git:","gitea":":gitea:","github":":github:","gitlab":":gitlab:","gogs":":gogs:"},
+		pageData: {},
+		notificationSettings: {"EventSourceUpdateTime":10000,"MaxTimeout":60000,"MinTimeout":10000,"TimeoutStep":10000}, 
+		enableTimeTracking:  true ,
+		mermaidMaxSourceCharacters:  50000 ,
+		sharedWorkerUri: '\/assets\/js\/eventsource.sharedworker.DV1Z2uJv.js',
+		
+		i18n: {
+			error_occurred: "An error occurred",
+			remove_label_str: "Remove item \"%s\"",
+			modal_confirm: "Confirm",
+			modal_cancel: "Cancel",
+			more_items: "More items",
+			copy_success: "Copied!",
+			copy_error: "Copy failed",
+		},
+	};
+	
+	window.config.pageData = window.config.pageData || {};
+</script>
+<script nonce="2f1114650edc4dcd89ad1b32c2c5a1c0" src="/assets/js/iife.D2XhYhS2.js"></script>
+
+	
+</head>
+<body>
+	
+
+	<div class="full height">
+		<noscript>This website requires JavaScript.</noscript>
+
+		
+
+		
+			<nav id="navbar" aria-label="Navigation Bar">
+	<div class="navbar-left">
+		
+		<a class="item" id="navbar-logo" href="/" aria-label="Home">
+			<img width="30" height="30" src="/assets/img/logo.svg" alt="Logo" aria-hidden="true">
+		</a>
+
+		
+		<div class="ui secondary menu navbar-mobile-right only-mobile">
+			
+
+			<button class="item ui icon mini button tw-m-0" id="navbar-expand-toggle" aria-label="Navigation Menu"><svg viewBox="0 0 16 16" class="svg octicon-three-bars" aria-hidden="true" width="16" height="16"><path d="M1 2.75A.75.75 0 0 1 1.75 2h12.5a.75.75 0 0 1 0 1.5H1.75A.75.75 0 0 1 1 2.75m0 5A.75.75 0 0 1 1.75 7h12.5a.75.75 0 0 1 0 1.5H1.75A.75.75 0 0 1 1 7.75M1.75 12h12.5a.75.75 0 0 1 0 1.5H1.75a.75.75 0 0 1 0-1.5"/></svg></button>
+		</div>
+
+		
+		
+			<a class="item" href="/explore/repos">Explore</a>
+		
+
+		
+
+		
+			<a class="item" target="_blank" href="https://docs.gitea.com">Help</a>
+		
+	</div>
+
+	
+	<div class="navbar-right">
+		
+			
+			<a class="item active" rel="nofollow" href="/user/login">
+				<svg viewBox="0 0 16 16" class="svg octicon-sign-in" aria-hidden="true" width="16" height="16"><path d="M2 2.75C2 1.784 2.784 1 3.75 1h2.5a.75.75 0 0 1 0 1.5h-2.5a.25.25 0 0 0-.25.25v10.5c0 .138.112.25.25.25h2.5a.75.75 0 0 1 0 1.5h-2.5A1.75 1.75 0 0 1 2 13.25Zm6.56 4.5h5.69a.75.75 0 0 1 0 1.5H8.56l1.97 1.97a.749.749 0 0 1-.326 1.275.75.75 0 0 1-.734-.215L6.22 8.53a.75.75 0 0 1 0-1.06l3.25-3.25a.749.749 0 0 1 1.275.326.75.75 0 0 1-.215.734Z"/></svg>
+				<span class="tw-ml-1">Sign In</span>
+			</a>
+		
+	</div>
+
+	
+	
+</nav>
+
+
+
+
+		
+
+
+
+<div role="main" aria-label="Sign In" class="page-content user signin">
+	<div class="ui middle very relaxed page grid">
+		
+		<div class="column tw-flex tw-flex-col tw-gap-4 tw-max-w-2xl tw-m-auto">
+			<div class="ui container fluid">
+	
+	
+	
+	<h4 class="ui top attached header center">
+		
+			Sign In
+		
+	</h4>
+	<div class="ui attached segment">
+		
+		<form class="ui form" action="/user/login" method="post">
+			<div class="required field ">
+				<label for="user_name">Username or Email Address</label>
+				<input id="user_name" type="text" name="user_name" value="" autofocus required tabindex="1">
+			</div>
+			
+			<div class="required field ">
+				<div class="tw-flex tw-mb-1">
+					<label for="password" class="tw-flex-1">Password</label>
+					<a href="/user/forgot_password" tabindex="4">Forgot password?</a>
+				</div>
+				<input id="password" name="password" type="password" value="" autocomplete="current-password" required tabindex="2">
+			</div>
+			
+			
+			<div class="inline field">
+				<div class="ui checkbox">
+					<label>Remember This Device</label>
+					<input name="remember" type="checkbox" tabindex="5">
+				</div>
+			</div>
+			
+
+			
+
+
+			<div class="field">
+				<button class="ui primary button tw-w-full" tabindex="3">
+					
+						Sign In
+					
+				</button>
+			</div>
+		</form>
+		
+		
+		
+		
+	</div>
+</div>
+
+
+<div class="ui container fluid">
+	<div class="ui attached segment header top tw-max-w-2xl tw-m-auto tw-flex tw-flex-col tw-items-center">
+		
+			<div id="webauthn-error" class="ui negative message tw-hidden">
+	<div class="header">Could not read your security key.</div>
+	<div id="webauthn-error-msg" class="tw-pt-2"></div>
+	<div class="tw-hidden">
+		<div data-webauthn-error-msg="browser">Your browser does not currently support WebAuthn.</div>
+		<div data-webauthn-error-msg="unknown">An unknown error occurred. Please retry.</div>
+		<div data-webauthn-error-msg="insecure">WebAuthn only supports secure connections. For testing over HTTP, you can use the origin "localhost" or "127.0.0.1".</div>
+		<div data-webauthn-error-msg="unable-to-process">The server could not process your request.</div>
+		<div data-webauthn-error-msg="duplicated">The security key is not permitted for this request. Please make sure that the key is not already registered.</div>
+		<div data-webauthn-error-msg="empty">You must set a name for this key.</div>
+		<div data-webauthn-error-msg="timeout">Timeout reached before your key could be read. Please reload this page and retry.</div>
+	</div>
+</div>
+
+			<a class="signin-passkey">Sign in with a passkey</a>
+		
+
+		
+	</div>
+</div>
+
+
+		</div>
+	</div>
+</div>
+
+
+		
+	</div>
+	
+	<footer class="page-footer" role="group" aria-label="Footer">
+	<div class="left-links" role="contentinfo" aria-label="About Software">
+		
+			<a target="_blank" href="https://about.gitea.com">Powered by Gitea</a>
+		
+		
+			<span>
+			Version:
+			
+				1.27.2
+			
+			</span>
+		
+		
+			<span>
+				Page: <strong>2ms</strong>
+				Template: <strong>0ms</strong>
+			</span>
+		
+		
+	</div>
+	<div class="right-links" role="group" aria-label="Links">
+		<div class="ui dropdown custom" id="footer-theme-selector">
+			<span class="default-text"><div class="theme-menu-item" data-tooltip-content=""><svg viewBox="490 490 820 820" class="svg gitea-eclipse" aria-hidden="true" width="16" height="16"><path d="M866.7 582.1A321.3 321.3 0 0 0 738.6 623a317.3 317.3 0 0 0-109.1 108.5A418 418 0 0 0 609 772a335.3 335.3 0 0 0-19.6 71.5 205.2 205.2 0 0 0-2.8 45c0 25.8.2 29.3 2.8 45 4.1 25.4 9.9 46.4 19.6 71.5a314.2 314.2 0 0 0 111.6 137.3A306.8 306.8 0 0 0 893 1196a308.6 308.6 0 0 0 303.6-262.5c2.6-15.7 2.8-19.2 2.8-45s-.2-29.3-2.8-45A335.3 335.3 0 0 0 1177 772a314.2 314.2 0 0 0-111.6-137.3A308.3 308.3 0 0 0 918 582c-13-1.1-38.2-1.1-51.3.1M747 663.5l-2.4 16.7c-4 26.4-4.9 41.1-4.3 65.3a323.7 323.7 0 0 0 37.2 145c18.2 36 41.3 66.6 72 95.5a346.4 346.4 0 0 0 208.5 93.1l18 1.6 4.5.5-8.5 8a259.3 259.3 0 0 1-141.5 65.8 281 281 0 0 1-123.9-11.4 267.2 267.2 0 0 1-181.7-269.9c2-27.6 5.7-47.6 13.3-70.7a281.2 281.2 0 0 1 46.4-85c8-10.1 28-30.2 37.9-38.1 13.8-11.1 24.5-18.3 24.5-16.4"/></svg> Auto </div></span>
+			<div class="menu theme-menu"></div>
+		</div>
+		<div class="ui dropdown upward">
+			<span class="flex-text-inline"><svg viewBox="0 0 16 16" class="svg octicon-globe" aria-hidden="true" width="14" height="14"><path d="M8 0a8 8 0 1 1 0 16A8 8 0 0 1 8 0M5.78 8.75a9.64 9.64 0 0 0 1.363 4.177q.383.64.857 1.215c.245-.296.551-.705.857-1.215A9.64 9.64 0 0 0 10.22 8.75Zm4.44-1.5a9.64 9.64 0 0 0-1.363-4.177c-.307-.51-.612-.919-.857-1.215a10 10 0 0 0-.857 1.215A9.64 9.64 0 0 0 5.78 7.25Zm-5.944 1.5H1.543a6.51 6.51 0 0 0 4.666 5.5q-.184-.271-.352-.552c-.715-1.192-1.437-2.874-1.581-4.948m-2.733-1.5h2.733c.144-2.074.866-3.756 1.58-4.948q.18-.295.353-.552a6.51 6.51 0 0 0-4.666 5.5m10.181 1.5c-.144 2.074-.866 3.756-1.58 4.948q-.18.296-.353.552a6.51 6.51 0 0 0 4.666-5.5Zm2.733-1.5a6.51 6.51 0 0 0-4.666-5.5q.184.272.353.552c.714 1.192 1.436 2.874 1.58 4.948Z"/></svg> English</span>
+			<div class="menu language-menu">
+				<a lang="id-ID" data-url="/?lang=id-ID" class="item ">Bahasa Indonesia</a>
+				<a lang="de-DE" data-url="/?lang=de-DE" class="item ">Deutsch</a>
+				<a lang="en-US" data-url="/?lang=en-US" class="item selected">English</a>
+				<a lang="es-ES" data-url="/?lang=es-ES" class="item ">Español</a>
+				<a lang="fr-FR" data-url="/?lang=fr-FR" class="item ">Français</a>
+				<a lang="ga-IE" data-url="/?lang=ga-IE" class="item ">Gaeilge</a>
+				<a lang="it-IT" data-url="/?lang=it-IT" class="item ">Italiano</a>
+				<a lang="lv-LV" data-url="/?lang=lv-LV" class="item ">Latviešu</a>
+				<a lang="hu-HU" data-url="/?lang=hu-HU" class="item ">Magyar nyelv</a>
+				<a lang="nl-NL" data-url="/?lang=nl-NL" class="item ">Nederlands</a>
+				<a lang="pl-PL" data-url="/?lang=pl-PL" class="item ">Polski</a>
+				<a lang="pt-PT" data-url="/?lang=pt-PT" class="item ">Português de Portugal</a>
+				<a lang="pt-BR" data-url="/?lang=pt-BR" class="item ">Português do Brasil</a>
+				<a lang="fi-FI" data-url="/?lang=fi-FI" class="item ">Suomi</a>
+				<a lang="sv-SE" data-url="/?lang=sv-SE" class="item ">Svenska</a>
+				<a lang="tr-TR" data-url="/?lang=tr-TR" class="item ">Türkçe</a>
+				<a lang="cs-CZ" data-url="/?lang=cs-CZ" class="item ">Čeština</a>
+				<a lang="el-GR" data-url="/?lang=el-GR" class="item ">Ελληνικά</a>
+				<a lang="bg-BG" data-url="/?lang=bg-BG" class="item ">Български</a>
+				<a lang="ru-RU" data-url="/?lang=ru-RU" class="item ">Русский</a>
+				<a lang="uk-UA" data-url="/?lang=uk-UA" class="item ">Українська</a>
+				<a lang="fa-IR" data-url="/?lang=fa-IR" class="item ">فارسی</a>
+				<a lang="ml-IN" data-url="/?lang=ml-IN" class="item ">മലയാളം</a>
+				<a lang="ja-JP" data-url="/?lang=ja-JP" class="item ">日本語</a>
+				<a lang="zh-CN" data-url="/?lang=zh-CN" class="item ">简体中文</a>
+				<a lang="zh-TW" data-url="/?lang=zh-TW" class="item ">繁體中文（台灣）</a>
+				<a lang="zh-HK" data-url="/?lang=zh-HK" class="item ">繁體中文（香港）</a>
+				<a lang="ko-KR" data-url="/?lang=ko-KR" class="item ">한국어</a>
+				</div>
+		</div>
+		<a href="/assets/licenses.txt">Licenses</a>
+		<a href="/api/swagger">API</a>
+		
+	</div>
+</footer>
+
+	<script nonce="2f1114650edc4dcd89ad1b32c2c5a1c0" type="module" src="/assets/js/index.8BwIzI4A.js"></script>
+	
+	<script nonce="2f1114650edc4dcd89ad1b32c2c5a1c0" type="module">
+	if (!window.config?.frontendInited && window.config?.runModeIsProd) alert("Frontend is not initialized, check console errors or asset files.");
+	</script>
+</body>
+</html>
+

entrypoint.sh

@@ -1,6 +1,8 @@
 #!/bin/bash
 set -e
 
+# Mapping der Gitea-Workflow Variablen (ENV_...) auf interne Variablen
+# Falls ENV_LDAP_URI nicht gesetzt ist, wird ein Fallback genutzt
 LDAP_URI=${LDAP_URI:-"ldap://localhost:389"}
 LDAP_BASE_DN=${LDAP_BASE_DN:-"dc=example,dc=com"}
 LDAP_BIND_DN=${LDAP_BIND_DN:-"cn=admin,dc=example,dc=com"}
@@ -30,9 +32,10 @@ ldap_default_authtok = ${LDAP_BIND_PASSWORD}
 
 ldap_schema = rfc2307bis
 ldap_group_member = uniqueMember
-ldap_auth_disable_tls_never_use_in_production = true
+
 ldap_id_use_start_tls = false
 ldap_tls_reqcert = never
+ldap_auth_disable_tls_never_use_in_production = true
 
 cache_credentials = true
 enumerate = false
@@ -45,41 +48,14 @@ echo ">>> Erstelle Sudoers-Regel für Gruppe: ${LDAP_SUDO_GROUP}..."
 echo "%${LDAP_SUDO_GROUP} ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/ldap-admins
 chmod 0440 /etc/sudoers.d/ldap-admins
 
-echo ">>> Erzwinge TLS für xrdp (Guacamole Fix)..."
+echo ">>> Bereinige SSSD Cache..."
-if [ -f /etc/xrdp/xrdp.ini ]; then
-  sed -i 's/^security_layer=.*/security_layer=tls/' /etc/xrdp/xrdp.ini
-fi
-
-echo ">>> Bereinige alte PID-Dateien und SSSD Cache..."
-rm -f /var/run/dbus/pid /run/dbus/dbus.pid /var/run/xrdp/*.pid /var/run/xrdp/xrdp-sesman.pid
 rm -f /var/lib/sss/db/*
 rm -f /var/lib/sss/mc/*
 
-echo ">>> Starte D-Bus..."
+echo ">>> Starte Dienste..."
-mkdir -p /var/run/dbus /run/dbus
+# SSSD mit dem gemappten Debug-Level starten
-dbus-uuidgen --ensure
-dbus-daemon --system --fork
-
-echo ">>> Starte SSSD..."
 sssd -D --debug-level=${SSSD_DEBUG}
 
-echo ">>> Starte XRDP..."
+service dbus start
 xrdp-sesman
-xrdp
+exec xrdp -n
-
-echo ">>> Leite Logs an Docker weiter..."
-mkdir -p /var/log/sssd /var/log/xrdp
-
-touch /var/log/xrdp.log \
-      /var/log/xrdp-sesman.log \
-      /var/log/sssd/sssd.log \
-      /var/log/sssd/sssd_LDAP.log \
-      /var/log/sssd/sssd_nss.log \
-      /var/log/sssd/sssd_pam.log
-
-exec tail -F /var/log/xrdp.log \
-             /var/log/xrdp-sesman.log \
-             /var/log/sssd/sssd.log \
-             /var/log/sssd/sssd_LDAP.log \
-             /var/log/sssd/sssd_nss.log \
-             /var/log/sssd/sssd_pam.log

packages.txt

@@ -1,50 +0,0 @@
-sssd
-sssd-tools
-libpam-sss
-libnss-sss
-libsss-sudo
-ldap-utils
-ca-certificates
-xrdp
-xorgxrdp
-dbus
-dbus-x11
-lxqt-core
-openbox
-papirus-icon-theme
-adwaita-icon-theme
-libqt5svg5
-gvfs
-qterminal
-featherpad
-pcmanfm-qt
-lxqt-sudo
-xdg-user-dirs
-desktop-base
-sudo
-firefox-esr
-thunderbird
-geany
-locales
-tzdata
-keyboard-configuration
-x11-xkb-utils
-pulseaudio
-build-essential
-dpkg-dev
-git
-libpulse-dev
-meson
-ninja-build
-pkg-config
-autoconf
-libtool
-xarchiver
-unzip
-zip
-p7zip-full
-tar
-gzip
-bzip2
-dialog
-whiptail