23059a1de3
Some checks failed
CodeQL / Analyze (javascript) (push) Failing after 16s
CodeQL / Analyze (python) (push) Failing after 3s
i18n sync check / check:sync (push) Failing after 3s
React Doctor / react-doctor (push) Failing after 16s
Branch Build CE / Build-Push Admin Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge Admin Manifest (push) Has been cancelled
Branch Build CE / Build-Push Web Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge Web Manifest (push) Has been cancelled
Branch Build CE / Build-Push Space Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge Proxy Manifest (push) Has been cancelled
Branch Build CE / Merge Space Manifest (push) Has been cancelled
Branch Build CE / Prepare AIO Assets (push) Has been cancelled
Branch Build CE / Build Setup (push) Has been cancelled
Branch Build CE / Build-Push Live Collaboration Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge Live Collaboration Manifest (push) Has been cancelled
Branch Build CE / Build-Push API Server Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge API Server Manifest (push) Has been cancelled
Branch Build CE / Build-Push Proxy Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Build-Push AIO Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge AIO Manifest (push) Has been cancelled
Branch Build CE / Upload Build Assets (push) Has been cancelled
Branch Build CE / Build Release (push) Has been cancelled
45 lines
2.5 KiB
Docker
45 lines
2.5 KiB
Docker
FROM caddy:2.11.4-builder-alpine AS caddy-builder
|
|
|
|
# grpc and otel move together: grpc >= v1.83.0 requires otel v1.44.0, and xcaddy
|
|
# resolves these --with pins in one `go get`, so a stale otel pin makes go walk
|
|
# grpc backwards until it finds one that fits (silently, with a zero exit) --
|
|
# it lands on the v1.83.0-dev pre-release and the build still succeeds. Bump the
|
|
# otel pair in lockstep with grpc, and confirm with `go version -m` afterwards.
|
|
RUN XCADDY_SKIP_CLEANUP=1 xcaddy build \
|
|
--with github.com/caddy-dns/cloudflare@v0.2.1 \
|
|
--with github.com/caddy-dns/digitalocean@04bde2867106aa1b44c2f9da41a285fa02e629c5 \
|
|
--with github.com/mholt/caddy-l4@6faae83b167fda94e62b686be5cbeb9b3f8fe002 \
|
|
--with github.com/go-jose/go-jose/v3@v3.0.5 \
|
|
--with github.com/go-jose/go-jose/v4@v4.1.4 \
|
|
--with google.golang.org/grpc@v1.83.1 \
|
|
--with go.opentelemetry.io/otel@v1.44.0 \
|
|
--with go.opentelemetry.io/otel/sdk@v1.44.0
|
|
|
|
# Caddy's own go.mod pins x/crypto, x/net and x/text at versions with open CVEs;
|
|
# xcaddy preserved its build dir above, so upgrade them there and rebuild.
|
|
# x/crypto v0.55.0 requires x/net v0.57.0 and x/text v0.41.0, hence those floors.
|
|
RUN cd "$(find /tmp -maxdepth 1 -name 'buildenv_*' -type d | head -1)" && \
|
|
go get golang.org/x/crypto@v0.55.0 && \
|
|
go get golang.org/x/net@v0.57.0 && \
|
|
go get golang.org/x/text@v0.41.0 && \
|
|
go mod tidy && \
|
|
go build -o /usr/bin/caddy -ldflags "-w -s" -trimpath -tags nobadger,nomysql,nopgx .
|
|
|
|
# xcaddy resolves every --with pin in a single `go get`, which walks a module
|
|
# backwards to an older release rather than failing when the pins conflict.
|
|
# Assert the binary really carries the pinned grpc, so a silent downgrade fails
|
|
# the build instead of shipping a proxy that only looks patched.
|
|
RUN go version -m /usr/bin/caddy | grep -qE 'google\.golang\.org/grpc[[:space:]]v1\.83\.1[[:space:]]' \
|
|
|| { echo "caddy was not built against the pinned grpc -- check the --with pins" >&2; exit 1; }
|
|
|
|
FROM caddy:2.11.4-alpine
|
|
|
|
# OS security updates. --available forces reinstall from the current repos;
|
|
# bump APK_SECURITY_PATCH to bust buildx's cached layer (keyed on this command
|
|
# string), otherwise a rebuild silently re-ships the old packages.
|
|
ARG APK_SECURITY_PATCH=2026-09-07
|
|
RUN echo "apk-security-patch ${APK_SECURITY_PATCH}" && apk update && apk upgrade --no-cache --available && apk add --no-cache nss-tools bash curl
|
|
|
|
COPY --from=caddy-builder /usr/bin/caddy /usr/bin/caddy
|
|
|
|
COPY Caddyfile.ce /etc/caddy/Caddyfile |