mrcharles
0d7543704b
ChirpStack 4.19.1 (LoRaWAN network server) as the 14th package: official-image wrapper, digest-pinned, with only bash added to the upstream alpine runtime. Native OIDC login wired to the Cloudron platform provider (openid_connect backend, config regenerated every start); postgresql + redis addons; diesel migrations auto-run. Operator config (NetID, US915 region, gateway MQTT backend) lives in seeded files under /app/data/config. Build green; config generation validated through chirpstack's own TOML parser. Docs gardened to 14 packages. Ticket: https://projects.knownelement.com/issues/668 💘 Generated with Crush Assisted-by: Crush:glm-5.2
52 lines
2.4 KiB
Docker
52 lines
2.4 KiB
Docker
# ChirpStack Cloudron Package
|
|
#
|
|
# ChirpStack is an open-source LoRaWAN network-server: web UI + gRPC/REST
|
|
# API on a single port, PostgreSQL for storage, Redis for sessions /
|
|
# deduplication / OIDC state, and an external MQTT broker for gateway
|
|
# connectivity and integrations (configured per region, not embedded).
|
|
#
|
|
# Upstream: https://github.com/chirpstack/chirpstack
|
|
# - Official Docker image chirpstack/chirpstack:4.19.1 (alpine, single
|
|
# static musl binary /usr/bin/chirpstack, upstream runs it as
|
|
# nobody:nogroup with ENTRYPOINT /usr/bin/chirpstack)
|
|
# - Takes a config DIRECTORY via `chirpstack --config <dir>`; every *.toml
|
|
# in it is concatenated (tables must not collide across files) and
|
|
# ${ENV_VAR} placeholders are substituted
|
|
# - DB schema migrations (diesel, embedded) run automatically at startup
|
|
# and seed an internal `admin` user
|
|
#
|
|
# Authentication: NATIVE OIDC (preferred). start.sh regenerates
|
|
# /app/data/config/10-cloudron.toml on every start, wiring the Cloudron
|
|
# platform OIDC provider (CLOUDRON_OIDC_ISSUER / CLIENT_ID / CLIENT_SECRET)
|
|
# into [user_authentication.openid_connect]. CHIRPSTACK_AUTH_MODE=internal
|
|
# is kept as an operator escape hatch for admin bootstrap only (see README).
|
|
#
|
|
# Pattern: official-image wrapper. Building the Rust workspace + pnpm UI
|
|
# from source is a multi-GB compile; the upstream image is the supported
|
|
# distribution channel. Image pinned by tag AND digest (amd64 manifest
|
|
# digest of the 4.19.1 tag, verified via docker manifest inspect).
|
|
FROM chirpstack/chirpstack:4.19.1@sha256:c749015e640b8cf33338c08b12922896b17636feb06e421abdd3cc80f1cdc6b9
|
|
|
|
# bash is the only addition: start.sh uses it for the addon wait loops
|
|
# (bash /dev/tcp) and TOML generation. Kept as root only for apk; the
|
|
# runtime user stays the upstream nobody:nogroup.
|
|
USER root
|
|
RUN apk add --no-cache bash
|
|
|
|
# start.sh waits for the postgresql + redis addons, seeds the persistent
|
|
# config fragments under /app/data/config/ and execs chirpstack.
|
|
# Made executable on the host, not at build time (Cloudron builds hit
|
|
# permission errors on RUN chmod).
|
|
COPY start.sh /app/start.sh
|
|
|
|
WORKDIR /app/data
|
|
|
|
# Cloudron exposes the web UI / REST / gRPC on this port (api.bind in the
|
|
# generated config). No other TCP listener is enabled by default: gateway
|
|
# connectivity is outbound MQTT to an external broker.
|
|
EXPOSE 8080
|
|
|
|
USER nobody:nogroup
|
|
|
|
ENTRYPOINT ["/bin/bash", "/app/start.sh"]
|