build for bookworm [skip ci]

Reviewed-on: #2

.gitea/workflows/build-and-push.yaml

@@ -23,6 +23,10 @@ jobs:
         run: |
           export TZ=Europe/Berlin
           
+          # FIX 1: Stellt sicher, dass die Datei mit einem Zeilenumbruch endet.
+          # Das verhindert, dass Bash die letzte Zeile beim Einlesen verschluckt.
+          sed -i -e '$a\' buildargs.env
+          
           set -a
           source <(grep -v '^#' buildargs.env | sed 's/\r$//')
           set +a
@@ -34,11 +38,16 @@ jobs:
           
           echo "event_name=${{ gitea.event_name }}" >> $GITHUB_OUTPUT
           
+          # FIX 2: Kugelsicheres Auslesen des Tags direkt aus der Datei.
+          # Trimm-Befehle (tr) entfernen eventuelle unsichtbare Zeichen oder Anführungszeichen.
+          SAFE_BUILD_TAG=$(grep "^BUILD_TAG=" buildargs.env | cut -d'=' -f2 | tr -d '\r' | tr -d '"' | xargs)
+          
           if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then
             CLEAN_TAG=${{ gitea.ref_name }}
             echo "docker_tag=${CLEAN_TAG#v}" >> $GITHUB_OUTPUT
           else
-            echo "docker_tag=${BUILD_TAG:-latest}" >> $GITHUB_OUTPUT
+            # Nutzt jetzt garantiert den direkt extrahierten Wert
+            echo "docker_tag=${SAFE_BUILD_TAG:-latest}" >> $GITHUB_OUTPUT
           fi
           
           OWNER=$(echo "${{ gitea.repository }}" | cut -d'/' -f1 | tr '[:upper:]' '[:lower:]')
@@ -129,7 +138,6 @@ jobs:
           
           BASE_SHA=$(docker buildx imagetools inspect $BASE --format '{{json .Manifest.Digest}}' 2>/dev/null | tr -d '"' || echo "unknown")
 
-          # 1. Architektur-spezifische Builds pushen
           docker buildx build "${DOCKER_ARGS[@]}" -t "$IMAGE_GITEA:tmp-amd64" \
             --pull --platform linux/amd64 -f Dockerfile \
             --label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
@@ -138,8 +146,6 @@ jobs:
             --pull --platform linux/arm64 -f Dockerfile.aarch64 \
             --label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
           
-          # 2. Multi-Arch Manifest für Gitea erstellen
-          # Wir bauen ein Array für die Tags
           GITEA_MANIFEST_TAGS=("-t" "$IMAGE_GITEA:$TAG")
           if [[ "$BUILD_TAG_LATEST" == "y" ]]; then
             GITEA_MANIFEST_TAGS+=("-t" "$IMAGE_GITEA:latest")
@@ -149,7 +155,6 @@ jobs:
             --annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \
             "${GITEA_MANIFEST_TAGS[@]}" $IMAGE_GITEA:tmp-amd64 $IMAGE_GITEA:tmp-arm64
 
-          # 3. Multi-Arch Manifest für Docker Hub (optional)
           if [[ "$PUSH" == *"dockerhub"* ]]; then
             DOCKERHUB_REPO="${{ secrets.DOCKERHUB_USERNAME }}/$REPO_PURE"
             DH_MANIFEST_TAGS=("-t" "$DOCKERHUB_REPO:$TAG")
@@ -168,7 +173,6 @@ jobs:
         run: |
           set -x
           
-          # --- 1. VARIABLEN VORBEREITEN ---
           export TZ=Europe/Berlin
           CURRENT_TIME=$(date '+%d.%m.%Y %H:%M')
           BUILD_TAG="${{ steps.prep.outputs.docker_tag }}"
@@ -190,11 +194,9 @@ jobs:
           EOF
           COMMIT_MSG=$(sed 's/\[skip ci\]//g' commit_msg.txt | xargs)
 
-          # --- 2. TEMPLATES LADEN ---
           wget -q https://git.pi-farm.de/pi-farm/templates/raw/branch/main/README.template -O README.template || echo "Warnung: README Template fehlt"
           wget -q https://git.pi-farm.de/pi-farm/templates/raw/branch/main/docker-compose.template -O docker-compose.template || echo "Warnung: Compose Template fehlt"
 
-          # --- 3. VERSION HISTORY ---
           NEW_ROW="| **$BUILD_TAG** | $CURRENT_TIME | $COMMIT_MSG ✅ |"
           if [ -f "VERSION.history" ]; then
              grep -v "| **$BUILD_TAG** |" VERSION.history > VERSION.history.tmp || true
@@ -237,9 +239,6 @@ jobs:
              done <<< "$vol_vars"
           fi
 
-          # --- 5. DOCKER RUN BEFEHL (NEU: Als Datei schreiben) ---
-          # Wir schreiben direkt in eine Datei. Da gibt es keine Interpretationsfehler.
-          # Wichtig: " \\" am Ende der Zeilen explizit hinschreiben.
           {
             echo "docker run -d \\"
             echo "  --name $REPO_PURE \\"
@@ -261,24 +260,20 @@ jobs:
                 fi
               done <<< "$all_params"
             fi
-            # Letzte Zeile OHNE Backslash
             echo "  $FULL_URL:$BUILD_TAG"
           } > docker_run_block.txt
 
-          # --- 6. DOCKER HUB LINK ---
           DOCKERHUB_LINK_CONTENT=""
           if [[ "${{ steps.prep.outputs.push_targets }}" == *"dockerhub"* ]]; then
             DH_USER="${{ secrets.DOCKERHUB_USERNAME }}"
             DOCKERHUB_LINK_CONTENT="[![Docker Hub](https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white)](https://hub.docker.com/r/${DH_USER}/${REPO_PURE})"
           fi
 
-          # --- 7. TEMPLATE ENGINE (Optimiert für File-Injection) ---
           process_template() {
             local template=$1; local output=$2
             [ ! -f "$template" ] && return
             cp "$template" "$output"
             
-            # Simple Ersetzungen
             sed -i "s|__REPO_NAME__|$REPO_PURE|g" "$output"
             sed -i "s|__FULL_URL__|$FULL_URL|g" "$output"
             sed -i "s|__BUILD_TAG__|$BUILD_TAG|g" "$output"
@@ -286,28 +281,23 @@ jobs:
             sed -i "s|__ARM_STATUS__|$ARM_STATUS|g" "$output"
             sed -i "s|__CURRENT_DATE__|$CURRENT_TIME|g" "$output"
             
-            # Komplexe Blöcke: AWK für Strings, SED für Files
             awk -v r="$HISTORY_CONTENT" '{gsub(/__HISTORY_CONTENT__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
             awk -v r="$DOCKERHUB_LINK_CONTENT" '{gsub(/__DOCKERHUB_LINK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
 
-            # NEU: Docker Run Block via File einfügen (sicherste Methode)
             if grep -q "__DOCKER_RUN__" "$output" && [ -f "docker_run_block.txt" ]; then
                sed -e '/__DOCKER_RUN__/{r docker_run_block.txt' -e 'd;}' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
             fi
             
-            # Compose Block via File einfügen
             if grep -q "__COMPOSE_BLOCK__" "$output" && [ -f "docker-compose.yml" ]; then
                sed -e '/__COMPOSE_BLOCK__/{r docker-compose.yml' -e 'd;}' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
             fi
             
-            # ENV/PORTS/VOL Blöcke
             if grep -q "__ENV_BLOCK__" "$output"; then
                awk -v r="$(echo -e "$ENV_BLOCK_CONTENT")" '{gsub(/__ENV_BLOCK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
             fi
             awk -v r="$(echo -e "$PORTS_BLOCK_CONTENT")" '{gsub(/__PORTS_BLOCK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
             awk -v r="$(echo -e "$VOL_BLOCK_CONTENT")" '{gsub(/__VOL_BLOCK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
             
-             # Description als letztes
             if grep -q "__DESCRIPTION__" "$output"; then
                awk -v r="$(echo -e "${DESCRIPTION:-Keine Beschreibung.}")" '{gsub(/__DESCRIPTION__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
             fi
@@ -316,7 +306,6 @@ jobs:
           process_template "docker-compose.template" "docker-compose.yml"
           process_template "README.template" "README.md"
           
-          # --- 8. EXPORTS ---
           echo "FINAL_MSG=$COMMIT_MSG" >> $GITHUB_ENV
           echo "DESCRIPTION<<EOF" >> $GITHUB_ENV
           echo -e "$DESCRIPTION" >> $GITHUB_ENV
@@ -377,23 +366,18 @@ jobs:
           git config --local user.email "action@pi-farm.de"
           git config --local user.name "Gitea Action"
           
-          # Sicherstellen, dass wir etwas zum Committen haben
           git add VERSION.history README.md docker-compose.yml
           
-          # Nur committen, wenn es Änderungen gibt
           git diff --quiet && git diff --staged --quiet || git commit -m "${{ env.FINAL_MSG }} [skip ci]"
           
-          # Das Tag exakt so setzen, wie es in prep definiert wurde (ohne extra 'v')
           TARGET_TAG="${{ steps.prep.outputs.docker_tag }}"
           git tag -f "$TARGET_TAG"
           
           if [[ "${{ gitea.ref }}" == refs/tags/* ]]; then
             echo "🏷️ Build aus Tag getriggert: $TARGET_TAG"
-            # Wir pushen das Tag (force), um die Doku-Updates einzuschließen
             git push -f origin "$TARGET_TAG"
           else
             echo "🌿 Build aus Branch/Schedule getriggert: ${{ gitea.ref_name }}"
-            # In den Branch pushen (HEAD:branch_name) und das Tag setzen
             git push origin HEAD:${{ gitea.ref_name }}
             git push -f origin "$TARGET_TAG"
           fi

README.md

@@ -1,5 +1,5 @@
 # base-image-debian-rdp-ldap
-Debian Desktop with LDAP-Authentication. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop.
+Debian Desktop with LDAP-Authentication and Pulse-Audio. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop.
 
 [![Build Status](https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions/workflows/build-and-push.yaml/badge.svg)](https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/actions)
 [![Gitea Repo](https://img.shields.io/badge/gitea-repository-blue?logo=gitea&logoColor=white)](__REPO_URL__)
@@ -11,8 +11,8 @@ This repository is built and pushed automatically.
 ### 🏗️ Platform Support
 | Architecture | Status | Base Image | Build Date |
 | :--- | :--- | :--- | :--- |
-| x86_64 (amd64) | ✅ Active | debian:bookworm | 09.04.2026 10:11 |
+| x86_64 (amd64) | ✅ Active | debian:bookworm | 09.04.2026 17:19 |
-| aarch64 (arm64) | ✅ Active | debian:bookworm | 09.04.2026 10:11 |
+| aarch64 (arm64) | ✅ Active | debian:bookworm | 09.04.2026 17:19 |
 
 ### 🚀 Docker Pull
 ```bash
@@ -53,10 +53,11 @@ docker run -d \
   git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap:bookworm-de
 ```
 
-*Last updated on: 09.04.2026 10:11*
+*Last updated on: 09.04.2026 17:19*
 
 ### 📜 Version History
 | Version | Date | Status |
 | :--- | :--- | :--- |
-| **bookworm-de** | 09.04.2026 10:11 |  ✅ |
+| **bookworm-de** | 09.04.2026 17:19 | build for bookworm ✅ |
-
+| **trixie-de** | 09.04.2026 16:44 | build for trixie-de ✅ |
+| **bookworm-de** | 09.04.2026 16:15 | Merge pull request dev (#2) from dev into main Reviewed-on: https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/pulls/2 ✅ |

VERSION.history

@@ -1,10 +1,3 @@
-| **bookworm-de** | 09.04.2026 10:11 |  ✅ |
+| **bookworm-de** | 09.04.2026 17:19 | build for bookworm ✅ |
-| **bookworm-de** | 07.04.2026 19:27 |  ✅ |
+| **trixie-de** | 09.04.2026 16:44 | build for trixie-de ✅ |
-| **bookworm-de** | 07.04.2026 17:38 |  ✅ |
+| **bookworm-de** | 09.04.2026 16:15 | Merge pull request dev (#2) from dev into main Reviewed-on: https://git.pi-farm.de/pi-farm/base-image-debian-rdp-ldap/pulls/2 ✅ |
-| **bookworm-de** | 05.04.2026 11:47 |  ✅ |
-| **bookworm-de** | 05.04.2026 11:20 |  ✅ |
-| **bookworm-de** | 04.04.2026 00:31 |  ✅ |
-| **bookworm-de** | 02.04.2026 17:26 |  ✅ |
-| **bookworm-de** | 02.04.2026 16:44 |  ✅ |
-| **bookworm-de** | 02.04.2026 15:37 |  ✅ |
-| **bookworm** | 02.04.2026 14:15 |  ✅ |

buildargs.env

@@ -24,4 +24,4 @@ ENV_LDAP_SUDO_GROUP=YOUR-SUDO-USERS-GROUP
 VOL_HOME=./YOUR-PERSISTENT-FOLDER:/home
 PORT_RDP=3889
 
-DESCRIPTION="Debian Desktop with LDAP-Authentication. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop."
+DESCRIPTION="Debian Desktop with LDAP-Authentication and Pulse-Audio. To use behind Guacamole with LDAP-Authentication and pass-through to Debian-Desktop."

sssd.conf

@@ -1,35 +0,0 @@
-[sssd]
-domains = LDAP
-services = nss, pam
-config_file_version = 2
-debug_level = $(SSSD_DEBUG_LEVEL)
-
-[domain/LDAP]
-id_provider = ldap
-auth_provider = ldap
-chpass_provider = ldap
-ldap_schema = $(LDAP_SCHEMA)
-ldap_auth_disable_tls_never_use_in_production = $(LDAP_AUTH_DISABLE_TLS)
-autofs_provider = ldap
-access_provider = simple
-
-ldap_uri = ldap://$(LDAP_URI)
-ldap_default_bind_dn = cn=$(LDAP_BIND_USER),$(LDAP_DOMAIN_DC)
-ldap_default_authtok = $(LDAP_BIND_PASSWORD)
-
-ldap_search_base = $(LDAP_SEARCH_BASE)
-ldap_user_search_base = $(LDAP_USER_SEARCH_BASE)
-ldap_group_search_base = $(LDAP_GROUP_SEARCH_BASE)
-ldap_user_password_attribute = $(LDAP_USER_PASSWORD_ATTRIBUTE)
-ldap_user_object_class = $(LDAP_USER_OBJECT_CLASS)
-ldap_user_name = $(LDAP_USER_NAME)
-ldap_user_dn_attribute = $(LDAP_USER_DN_ATTRIBUTE)
-ldap_group_object_class = $(LDAP_GROUP_OBJECTS_CLASS)
-ldap_id_use_start_tls = $(LDAP_ID_USE_START_TLS)
-ldap_auth_use_start_tls = $(LDAP_AUTH_USE_START_TLS)
-ldap_tls_reqcert = $(LDAP_TLS_REQCERT)
-
-simple_allow_groups = $(LDAP_SIMPLE_ALLOW_GROUPS)
-
-enumerate = True
-cache_credentials = True