Containerfile

# --------------------------------------------------------------------------
# THIS FILE IS AUTOGENERATED - DO NOT EDIT MANUALLY
#
# Source: Containerfile.j2
# --------------------------------------------------------------------------

# reverse-proxy: daemonless appliance, one container on base-rcd. Two units:
# custom Caddy (DNS modules compiled in) runs as root to bind 80/443; the
# admin (Go, embedded UI, from daemonless/reverse-proxy-src releases) runs as
# bsd and drives Caddy over unix sockets in /var/run/reverse-proxy.
ARG BASE_VERSION=15.1
ARG FREEBSD_ARCH=amd64

FROM ghcr.io/daemonless/base:${BASE_VERSION} AS caddy-build
# Empty: the latest Caddy release, read from GitHub's releases/latest
# redirect (the API rate-limits shared CI runners). Set it to pin one.
ARG CADDY_VERSION=
RUN pkg update && pkg install -y go xcaddy git ca_root_nss && pkg clean -ay && rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
# Stock Caddy has no DNS-challenge modules. duckdns is pinned to a release;
# it has no license file (asked upstream), but it is in Caddy's own caddy-dns
# org and caddyserver.com ships it in custom builds.
RUN v="${CADDY_VERSION:-$(fetch -v -o /dev/null https://github.com/caddyserver/caddy/releases/latest 2>&1 | grep -o 'releases/tag/v[^ ]*' | head -1 | cut -d/ -f3)}" && \
    test -n "$v" && \
    GOFLAGS=-buildvcs=false xcaddy build "$v" \
      --with github.com/caddy-dns/cloudflare \
      --with github.com/caddy-dns/route53 \
      --with github.com/caddy-dns/desec \
      --with github.com/caddy-dns/porkbun \
      --with github.com/caddy-dns/hetzner \
      --with github.com/caddy-dns/ovh \
      --with github.com/caddy-dns/gandi \
      --with github.com/caddy-dns/rfc2136 \
      --with github.com/caddy-dns/acmedns \
      --with github.com/caddy-dns/duckdns@v0.5.0 \
      --output /out/caddy && \
    /out/caddy version

# The admin (Go, UI embedded) is released from daemonless/reverse-proxy-src.
# Empty: the newest stable release, read from GitHub's releases/latest
# redirect (no pre-releases; the API rate-limits shared CI runners). Set it
# to pin one (0.3.0).
FROM ghcr.io/daemonless/base:${BASE_VERSION} AS admin-fetch
ARG RP_VERSION=
# latest: the newest stable release. beta: the newest pre-release (a tag
# with a hyphen, v0.3.0-beta.1), never a stable one; the releases feed lists
# newest first.
ARG RP_CHANNEL=latest
RUN v="${RP_VERSION:-$(if [ "$RP_CHANNEL" = beta ]; then fetch -qo - https://github.com/daemonless/reverse-proxy-src/releases.atom | grep -o 'releases/tag/v[^"]*-[^"]*'; else fetch -v -o /dev/null https://github.com/daemonless/reverse-proxy-src/releases/latest 2>&1 | grep -o 'releases/tag/v[^ ]*'; fi | head -1 | cut -d/ -f3 | sed 's/^v//')}" && \
    test -n "$v" && \
    case "$(uname -m)" in amd64) a=amd64 ;; arm64|aarch64) a=arm64 ;; *) echo "no admin build for $(uname -m)" >&2; exit 1 ;; esac && \
    f="reverse-proxy_${v}_freebsd_${a}.tar.gz" && \
    u="https://github.com/daemonless/reverse-proxy-src/releases/download/v${v}" && \
    mkdir -p /out && cd /out && \
    fetch -q "$u/$f" "$u/SHA256SUMS" && \
    want="$(grep " $f\$" SHA256SUMS | cut -d' ' -f1)" && \
    test -n "$want" && test "$want" = "$(sha256 -q "$f")" && \
    tar -xzf "$f" --strip-components 1 && rm -f "$f" SHA256SUMS && \
    echo "$v" > /out/version && ./reverse-proxy dns-providers >/dev/null

FROM ghcr.io/daemonless/base-rcd:${BASE_VERSION}
ARG FREEBSD_ARCH=amd64
ARG UPSTREAM_URL="https://api.github.com/repos/daemonless/reverse-proxy-src/releases/latest"
ARG UPSTREAM_JQ='.tag_name | ltrimstr("v")'
ARG PACKAGES="ca_root_nss"

LABEL org.opencontainers.image.title="Daemonless Reverse Proxy" \
      org.opencontainers.image.description="Friendly HTTPS names for the services on your network: a managed Caddy reverse proxy with a web UI, secure by default." \
      org.opencontainers.image.source="https://github.com/daemonless/reverse-proxy" \
      org.opencontainers.image.url="https://daemonless.io/images/reverse-proxy/" \
      org.opencontainers.image.licenses="BSD-2-Clause" \
      org.opencontainers.image.vendor="daemonless" \
      org.opencontainers.image.authors="daemonless" \
      io.daemonless.category="Network" \
      io.daemonless.port="8443" \
      io.daemonless.volumes="/config,/data" \
      io.daemonless.healthcheck-url="https://localhost:8443/healthz" \
      io.daemonless.arch="${FREEBSD_ARCH}" \
      io.daemonless.packages="${PACKAGES}" \
      io.daemonless.upstream-url="${UPSTREAM_URL}" \
      io.daemonless.upstream-jq="${UPSTREAM_JQ}"

RUN pkg update && \
    pkg install -y ${PACKAGES} && \
    pkg clean -ay && \
    rm -rf /var/cache/pkg/* /var/db/pkg/repos/*

COPY --from=caddy-build /out/caddy /usr/local/bin/caddy
COPY --from=admin-fetch /out/reverse-proxy /usr/local/bin/reverse-proxy
COPY --from=admin-fetch /out/version /app/version
# Every DNS provider the UI offers is compiled into Caddy, and the reverse.
RUN reverse-proxy dns-providers | sort > /tmp/offered && \
    caddy list-modules | sed -n 's/^dns\.providers\.//p' | sort > /tmp/built && \
    diff -u /tmp/offered /tmp/built && rm -f /tmp/offered /tmp/built && \
    mkdir -p /config /data

COPY root/ /

RUN chmod +x /healthz /daemonless/init.d/* /daemonless/libexec/*

EXPOSE 80 443 8443

VOLUME ["/config", "/data"]