moritz
cab4b1573c
BREAKING CHANGE: the integrations alakazam shipped as combine.yml are gone from the repository. Copy examples/config-sets-combine.yml into the root path to keep them, where they can be pinned and adjusted along with the versions. An integration is now a config-set carrying 'apply-when', which names the apps whose presence makes it apply. Naming the condition rather than deriving it from the configured apps is what lets a set configure only one side, as four of the seventeen pairs in combine.yml did.
52 lines
2.0 KiB
Docker
52 lines
2.0 KiB
Docker
# Builds an image that runs alakazam together with the abra version pinned by the submodule.
|
|
|
|
# keep in step with GOVERSION in abra/Makefile, a FROM cannot read it from there
|
|
ARG GO_VERSION=1.26
|
|
|
|
FROM golang:${GO_VERSION} AS abra
|
|
WORKDIR /src
|
|
COPY abra/ ./
|
|
COPY .git/modules/abra /gitdir
|
|
# abra ships its dependencies in vendor/, so the build itself needs no network
|
|
RUN set -eu; \
|
|
sed -i '/worktree =/d' /gitdir/config; \
|
|
version="$(git --git-dir=/gitdir describe --tags)"; \
|
|
commit="$(git --git-dir=/gitdir rev-parse HEAD)"; \
|
|
echo "building abra $version"; \
|
|
go build -mod=vendor -trimpath \
|
|
-ldflags "-s -w -X 'main.Version=$version' -X 'main.Commit=$commit'" \
|
|
-o /out/abra ./cmd/abra
|
|
|
|
FROM python:3.11-slim AS deps
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends gcc libc6-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY requirements.txt /tmp/requirements.txt
|
|
RUN python -m venv /opt/alakazam \
|
|
&& /opt/alakazam/bin/pip install --no-cache-dir -r /tmp/requirements.txt
|
|
|
|
FROM python:3.11-slim
|
|
# git: alakazam syncs the recipe repos itself. openssh-client: abra reaches the servers over
|
|
# ssh. argon2: recipes hash secrets locally in their abra.sh, vaultwarden's admin token does
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends git openssh-client make argon2 \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& git config --global --add safe.directory '*'
|
|
|
|
COPY --from=abra /out/abra /usr/local/bin/abra
|
|
COPY --from=deps /opt/alakazam /opt/alakazam
|
|
COPY alakazam.py /opt/alakazam/
|
|
RUN printf '#!/bin/sh\nexec /opt/alakazam/bin/python /opt/alakazam/alakazam.py "$@"\n' \
|
|
> /usr/local/bin/alakazam \
|
|
&& chmod +x /usr/local/bin/alakazam
|
|
|
|
# PYTHONUNBUFFERED so the streamed hook output arrives while a command is still running.
|
|
# LANG pins abra to its untranslated messages, which alakazam matches on to tell a missing
|
|
# secret or an empty generate run apart from a real failure.
|
|
ENV PYTHONUNBUFFERED=1 \
|
|
LANG=C.UTF-8 \
|
|
ABRA_DIR=/root/.abra
|
|
|
|
WORKDIR /config
|
|
CMD ["alakazam", "--help"]
|