mrcharles
7c65dc18d3
Build from source on ruby:3.4.10-trixie (trimmed from the upstream dev Dockerfile: no Chromium, no sudo, fixed non-root user). Uses the postgresql and localstorage addons; start.sh regenerates database.yml/secrets.yml under /app/data every boot, seeds the DB once (marker file) with a local admin, runs memcached in-container, and backgrounds a delayed_job worker gated on migrations. Platform OIDC is wired into secrets.yml; local login stays for the seeded admin. Also drop --rm from the app container in grind-stack.sh so a crashed container keeps its logs for `logs`.
87 lines
3.8 KiB
Docker
87 lines
3.8 KiB
Docker
# ConsulDemocracy Cloudron Package
|
|
#
|
|
# ConsulDemocracy is the citizen participation platform behind Madrid's
|
|
# Consul (MIT): proposals, participatory budgeting, debates, polls,
|
|
# legislation co-editing. Rails 8 + PostgreSQL, single web process plus
|
|
# a delayed_job worker; memcached for the fragment cache.
|
|
#
|
|
# Upstream: https://github.com/consuldemocracy/consuldemocracy
|
|
# - No published image; the in-repo Dockerfile targets local dev
|
|
# (bind-mount uid remapping, Chromium for E2E tests). This package
|
|
# builds from source on the same ruby base, trimmed: no Chromium,
|
|
# no sudo, fixed non-root user, runtime configs via symlinks into
|
|
# /app/data (generated by start.sh on every boot).
|
|
#
|
|
# Authentication: NATIVE OIDC (preferred). devise + omniauth with
|
|
# omniauth_openid_connect (name: :oidc, discovery: true) configured
|
|
# per-environment in config/secrets.yml (oidc_client_id /
|
|
# oidc_client_secret / oidc_issuer - see devise.rb:289-296 and
|
|
# app/lib/omniauth_tenant_setup.rb). start.sh maps the Cloudron
|
|
# platform provider (CLOUDRON_OIDC_*) into the generated secrets.yml.
|
|
# SAML is also available; local login remains for the seeded admin.
|
|
#
|
|
# Pattern: build-from-source (Rails). Gemfile.lock + package.json are
|
|
# committed upstream, so bundle/npm install are deterministic.
|
|
FROM ruby:3.4.10-trixie
|
|
|
|
ENV RAILS_ROOT=/var/www/consul \
|
|
RAILS_ENV=production \
|
|
RAILS_LOG_TO_STDOUT=true
|
|
|
|
# runtime deps: imagemagick (upload processing), libpq + postgres client
|
|
# (pg gem + db tasks), memcached (production cache_store is mem_cache_store
|
|
# with dalli), plus build headers for the native gems below
|
|
RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends \
|
|
build-essential cmake pkg-config imagemagick libpq-dev \
|
|
postgresql-client memcached \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN adduser --shell /bin/bash --disabled-password --gecos "" --uid 1000 consul
|
|
|
|
WORKDIR $RAILS_ROOT
|
|
|
|
# gem layer first (cache marker): lockfile-driven, system-wide install
|
|
# (.ruby-version MUST keep its name: the Gemfile resolves ruby file: ".ruby-version")
|
|
COPY repo/.ruby-version ./
|
|
COPY repo/Gemfile repo/Gemfile.lock ./
|
|
# the Gemfile evals ./Gemfile_custom (developer-local, not in git); empty is valid
|
|
RUN touch Gemfile_custom && \
|
|
bundle config set --local without 'development test' && bundle install --jobs 4
|
|
|
|
# node for the asset pipeline (node-build pinned by .node-version)
|
|
COPY repo/.node-version ./
|
|
ENV PATH=/usr/local/node/bin:$PATH
|
|
RUN curl -sL https://github.com/nodenv/node-build/archive/master.tar.gz | tar xz -C /tmp/ && \
|
|
/tmp/node-build-master/bin/node-build "$(cat .node-version)" /usr/local/node && \
|
|
rm -rf /tmp/node-build-master
|
|
|
|
COPY repo/package.json repo/package-lock.json ./
|
|
RUN npm install
|
|
|
|
COPY repo/ ./
|
|
|
|
# Rails 8's regexp_timeout default kills assets:precompile on the
|
|
# graphiql minified-JS regexes under CPU contention; disable it (the
|
|
# platform proxy bounds request time anyway). Also let the runtime user
|
|
# write tmp/log/public/assets and db/ (apartment schema dump warning).
|
|
RUN echo 'Regexp.timeout = nil' > config/initializers/00_cloudron_regexp_timeout.rb && \
|
|
mkdir -p public/assets tmp/pids tmp/sockets log db && \
|
|
chown -R consul:consul public/assets tmp log db
|
|
|
|
# persistence: runtime-generated configs + marker files live in localstorage
|
|
# (repo ships only .example files, the real ones are generated at start).
|
|
# VOLUME + ownership: a fresh named volume inherits this dir's owner, so
|
|
# start.sh (running as consul, uid 1000) can write its generated configs
|
|
RUN mkdir -p /app/data && chown consul:consul /app/data && \
|
|
ln -s /app/data/secrets.yml config/secrets.yml && \
|
|
ln -s /app/data/database.yml config/database.yml
|
|
VOLUME /app/data
|
|
|
|
COPY start.sh /app/start.sh
|
|
|
|
EXPOSE 3000
|
|
|
|
USER consul
|
|
|
|
ENTRYPOINT ["/bin/bash", "/app/start.sh"]
|