edfb4c44b8
Add the building blocks the provisioning CLI renders per site. Base images (site-templates/images): - php-fpm: non-root (www-data) php:<ver>-fpm-alpine with pdo_mysql, mysqli, gd, intl, zip, opcache, exif; tuned php.ini + pool; built per PHP version. - nginx: hardened nginx:1.27-alpine with shared security + fastcgi snippets; per-site server block mounted at runtime. - build.sh: build + Trivy-scan (+ optional push) for both images. Profile templates (site-templates/profiles), Jinja2 rendered: - static, redirect (tiny nginx 301/302), custom-php (nginx + our php-fpm, optional DB), wordpress (nginx + official wordpress-fpm, DB required, upload-exec denied). Only nginx carries Traefik labels and joins proxy; php-fpm uses the private <slug>_net and joins platform only when a DB is needed. Secrets stay in a git-ignored .env, not the compose. CI: .forgejo/workflows/images.yml builds/scans images (gitleaks + Trivy). README documents the render context and the Phase 4 web-root ownership item. Templates validated: all profiles render to valid compose YAML across the database on/off branches and single/multi-domain host rules. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
29 lines
853 B
YAML
29 lines
853 B
YAML
# Build + scan the base images on push. Runs on a Forgejo Actions runner (set up
|
|
# in a later phase). Uses the built-in registry; TOKEN/REGISTRY come from repo
|
|
# secrets/vars.
|
|
name: images
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "site-templates/images/**"
|
|
- ".forgejo/workflows/images.yml"
|
|
|
|
jobs:
|
|
build-scan:
|
|
runs-on: docker
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Secret scan (gitleaks)
|
|
uses: gitleaks/gitleaks-action@v2
|
|
|
|
- name: Log in to the registry
|
|
run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ vars.REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Build + Trivy-scan + push images
|
|
env:
|
|
REGISTRY: ${{ vars.REGISTRY_HOST }}/heleos
|
|
PUSH: "1"
|
|
SCAN: "1"
|
|
run: ./site-templates/images/build.sh
|