kdletters
8ed0626627
恢复 API 与 worker 的 .env.local BuildKit secret 挂载 补齐 Jenkins 固定文件校验与预览文档 增加双配置文件构建门禁
85 lines
3.7 KiB
Docker
85 lines
3.7 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
FROM rust:1.93-bookworm AS rust-builder
|
|
WORKDIR /workspace
|
|
|
|
COPY server-rs ./server-rs
|
|
COPY docs/openapi ./docs/openapi
|
|
COPY .codex/skills/genarrative-external-editor-api ./.codex/skills/genarrative-external-editor-api
|
|
COPY public ./public
|
|
RUN cargo build --release -p api-server --manifest-path server-rs/Cargo.toml && \
|
|
cp server-rs/target/release/api-server /tmp/api-server
|
|
|
|
FROM debian:bookworm-slim AS api-runtime
|
|
WORKDIR /srv/genarrative
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends ca-certificates curl && \
|
|
rm -rf /var/lib/apt/lists/* && \
|
|
useradd --system --create-home --home-dir /srv/genarrative --shell /usr/sbin/nologin genarrative
|
|
|
|
COPY --from=rust-builder /tmp/api-server /usr/local/bin/api-server
|
|
|
|
RUN mkdir -p /var/lib/genarrative/auth /var/lib/genarrative/tracking-outbox /var/lib/genarrative/wallet-refund-outbox && \
|
|
chown -R genarrative:genarrative /srv/genarrative /var/lib/genarrative
|
|
|
|
ARG GENARRATIVE_PREVIEW_SECRETS_SHA256=
|
|
ARG GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256=
|
|
RUN --mount=type=secret,id=genarrative_preview_secrets,required=false \
|
|
--mount=type=secret,id=genarrative_preview_env_local,required=false \
|
|
if [ -n "${GENARRATIVE_PREVIEW_SECRETS_SHA256}" ]; then \
|
|
test -f /run/secrets/genarrative_preview_secrets; \
|
|
test "$(sha256sum /run/secrets/genarrative_preview_secrets | cut -d ' ' -f 1)" = "${GENARRATIVE_PREVIEW_SECRETS_SHA256}"; \
|
|
install -o genarrative -g genarrative -m 0400 \
|
|
/run/secrets/genarrative_preview_secrets /srv/genarrative/.env.secrets.local; \
|
|
fi; \
|
|
if [ -n "${GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256}" ]; then \
|
|
test -f /run/secrets/genarrative_preview_env_local; \
|
|
test "$(sha256sum /run/secrets/genarrative_preview_env_local | cut -d ' ' -f 1)" = "${GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256}"; \
|
|
install -o genarrative -g genarrative -m 0400 \
|
|
/run/secrets/genarrative_preview_env_local /srv/genarrative/.env.local; \
|
|
fi
|
|
|
|
USER genarrative
|
|
EXPOSE 8082
|
|
|
|
ENV GENARRATIVE_ENV=container \
|
|
GENARRATIVE_API_HOST=0.0.0.0 \
|
|
GENARRATIVE_API_PORT=8082 \
|
|
GENARRATIVE_TRACKING_OUTBOX_DIR=/var/lib/genarrative/tracking-outbox
|
|
|
|
CMD ["api-server"]
|
|
|
|
FROM node:22-bookworm-slim AS web-builder
|
|
WORKDIR /workspace
|
|
|
|
ARG NPM_VERSION=10.9.7
|
|
RUN npm install --global "npm@${NPM_VERSION}" --no-audit --no-fund && \
|
|
test "$(npm --version)" = "${NPM_VERSION}"
|
|
|
|
COPY package.json package-lock.json ./
|
|
COPY apps/admin-web/package.json ./apps/admin-web/package.json
|
|
COPY apps/ai-game-creator-shell/package.json ./apps/ai-game-creator-shell/package.json
|
|
COPY apps/desktop-shell/package.json ./apps/desktop-shell/package.json
|
|
COPY apps/mobile-shell/package.json ./apps/mobile-shell/package.json
|
|
COPY apps/preview-deployer-web/package.json ./apps/preview-deployer-web/package.json
|
|
COPY packages/image-canvas-core/package.json ./packages/image-canvas-core/package.json
|
|
COPY packages/image-canvas-react/package.json ./packages/image-canvas-react/package.json
|
|
COPY packages/shared/package.json ./packages/shared/package.json
|
|
COPY tools/spine-json-export-validator/package.json ./tools/spine-json-export-validator/package.json
|
|
RUN npm ci
|
|
|
|
COPY index.html metadata.json tsconfig.json vite.config.ts ./
|
|
COPY scripts/vite-cli.mjs scripts/admin-web-build.mjs ./scripts/
|
|
COPY src ./src
|
|
COPY public ./public
|
|
COPY media ./media
|
|
COPY packages ./packages
|
|
COPY apps/admin-web ./apps/admin-web
|
|
RUN npm run build:raw && npm run admin-web:build
|
|
|
|
FROM nginx:1.27-alpine AS nginx-runtime
|
|
COPY --from=web-builder /workspace/dist /srv/genarrative/web
|
|
COPY --from=web-builder /workspace/apps/admin-web/dist /srv/genarrative/web/admin
|
|
COPY deploy/container/nginx.conf /etc/nginx/nginx.conf
|