mirror of
https://github.com/Rain-kl/OpenFlare.git
synced 2026-09-29 05:56:38 +08:00
ryan
3328d3d121
Agent ships without City/Country MMDB in the binary; Docker images COPY databases into data_dir, bare installs seed via download on first start. Server keeps Country-only embed for optional MaxMind control-plane use. Also harden fetch script nonempty check and reject non-file MMDB paths.
56 lines
2.2 KiB
Docker
56 lines
2.2 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
# Agent image: slim binary + MMDB files on disk (not embedded in the binary).
|
|
ARG VERSION=dev
|
|
|
|
FROM golang:1.25-alpine AS builder
|
|
|
|
ARG VERSION
|
|
ARG TARGETOS=linux
|
|
ARG TARGETARCH
|
|
|
|
ENV CGO_ENABLED=0 \
|
|
GOOS=${TARGETOS} \
|
|
GOARCH=${TARGETARCH}
|
|
|
|
WORKDIR /build
|
|
COPY go.mod go.sum ./
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
go mod download
|
|
|
|
COPY . .
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/apps/agent/config.Version=$VERSION'" -o /build/bin/openflare-agent ./cmd/agent/main.go
|
|
|
|
# Fetch MMDB into dist/geoip for COPY into the runtime image (not go:embed).
|
|
RUN apk add --no-cache bash curl \
|
|
&& bash scripts/fetch-agent-geoip-mmdb.sh
|
|
|
|
FROM openresty/openresty:alpine
|
|
|
|
RUN apk add --no-cache ca-certificates tzdata perl libmaxminddb su-exec libcap \
|
|
&& ln -sf /usr/lib/libmaxminddb.so.0 /usr/lib/libmaxminddb.so \
|
|
&& opm get anjia0532/lua-resty-maxminddb \
|
|
&& addgroup -S openflare \
|
|
&& adduser -S -G openflare -H -h /data -s /sbin/nologin openflare \
|
|
&& mkdir -p /etc/openflare /data/etc/openflare \
|
|
&& chown -R openflare:openflare /etc/openflare /data \
|
|
&& setcap 'cap_net_bind_service=+ep' /usr/local/openresty/nginx/sbin/nginx
|
|
|
|
ENV OPENFLARE_OPENRESTY_PATH=openresty \
|
|
OPENFLARE_DATA_DIR=/data
|
|
|
|
COPY --from=builder /build/bin/openflare-agent /usr/local/bin/openflare-agent
|
|
# Default agent paths: data_dir/etc/openflare/GeoLite2-*.mmdb
|
|
COPY --from=builder /build/dist/geoip/GeoLite2-Country.mmdb /data/etc/openflare/GeoLite2-Country.mmdb
|
|
COPY --from=builder /build/dist/geoip/GeoLite2-City.mmdb /data/etc/openflare/GeoLite2-City.mmdb
|
|
RUN chown openflare:openflare /data/etc/openflare/GeoLite2-Country.mmdb /data/etc/openflare/GeoLite2-City.mmdb \
|
|
&& chmod 644 /data/etc/openflare/GeoLite2-Country.mmdb /data/etc/openflare/GeoLite2-City.mmdb
|
|
|
|
COPY scripts/agent-entrypoint.sh /usr/local/bin/openflare-agent-entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/openflare-agent-entrypoint.sh
|
|
|
|
EXPOSE 80 443 18081
|
|
ENTRYPOINT ["/usr/local/bin/openflare-agent-entrypoint.sh"]
|
|
CMD ["-config", "/etc/openflare/agent.json"]
|