Sam Rolfe
c83c9df0a3
- Go service with its own multi-stage Dockerfile and docker-compose.yml; runs as container webrestrict-control on port 8791. - SQLite schema for the full AGENTS.md §7 data model via versioned migrations (PRAGMA user_version); audit log is append-only. - Configuration from the process environment; the real env file is gitignored and a template is committed. No secrets in the repo. - Separate session login (signed HMAC cookie + CSRF) for Sam. - GET /health; HTMX + server-rendered dashboard styled with the Family Home Lab tokens.css (copied) and Inter fonts; dark mode; phone-friendly. - Caddy vhost for webrestrict.lab.audasmedia.com.au applied on .35 (Let's Encrypt cert issued); route recorded in deploy/caddy/webrestrict.caddy. - Unit tests for config, auth and store. Co-Authored-By: Paperclip <noreply@paperclip.ing>
31 lines
887 B
Docker
31 lines
887 B
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# ---- build stage ----------------------------------------------------------
|
|
# Fix project name: Internet Use Control — its own image, built from source.
|
|
FROM golang:1.25-alpine AS build
|
|
WORKDIR /src
|
|
RUN apk add --no-cache git
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
ARG VERSION=dev
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-trimpath \
|
|
-ldflags "-s -w -X main.version=${VERSION}" \
|
|
-o /out/control ./cmd/control
|
|
|
|
# ---- runtime stage --------------------------------------------------------
|
|
FROM alpine:3.21
|
|
RUN apk add --no-cache ca-certificates tzdata wget \
|
|
&& addgroup -g 10001 -S control \
|
|
&& adduser -S -D -H -u 10001 -G control control \
|
|
&& mkdir -p /data && chown control:control /data
|
|
|
|
USER control
|
|
WORKDIR /app
|
|
COPY --from=build /out/control /app/control
|
|
|
|
EXPOSE 8791
|
|
VOLUME ["/data"]
|
|
ENTRYPOINT ["/app/control"]
|