Unify docker image

This makes it easier to manage and unifies the services that essentially
belong together. Might consider making it a split configuration again
later, but for now it makes much more sense such that fail2ban can
better operate with all the available logs instead of managing the
circus that is docker volumes.

1 files changed, 91 insertions, 7 deletions

diff --git a/gitolite/Dockerfile b/gitolite/Dockerfile
index 8ac87f6..44af1f0 100644
--- a/gitolite/Dockerfile
+++ b/gitolite/Dockerfile
@@ -1,27 +1,109 @@
+# Compile cgit
+FROM alpine:3.23.3 AS build
+
+RUN set -x \
+ && apk add --no-cache gcc g++ cmake make curl linux-headers musl-dev zlib-dev libressl-dev libintl musl-libintl
+
+# Compile cgit
+RUN set -x \
+ && wget 'https://git.zx2c4.com/cgit/snapshot/cgit-1.3.tar.xz' \
+ && tar -xvf cgit-1.3.tar.xz \
+ && make -C /cgit-1.3 get-git \
+ && DESTDIR=/pkg NO_REGEX=NeedsStartEnd make -C /cgit-1.3 install
+
+
+ #&& tar -czvf deps.tar.gz -C /cgit-1.3/pkg .
+
+
+# Compile cmark-gfm
+RUN set -x \
+  && wget https://github.com/github/cmark-gfm/archive/refs/tags/0.29.0.gfm.13.tar.gz \
+  && tar -xvf 0.29.0.gfm.13.tar.gz \
+  && cmake -S /cmark-gfm-0.29.0.gfm.13 -B /cmark-gfm-0.29.0.gfm.13/build \
+    -DCMAKE_POLICY_VERSION_MINIMUM=4.0 -DCMAKE_INSTALL_PREFIX=pkg \
+  && cmake --build /cmark-gfm-0.29.0.gfm.13/build \
+  && cmake --install /cmark-gfm-0.29.0.gfm.13/build
+
+RUN set -x \
+  && tar -czvf deps.tar.gz -C pkg .
+
+# Configure nginx & cgit + fcgiwrap
 FROM alpine:3.23.3
+COPY --from=build /deps.tar.gz /deps.tar.gz
+
+ARG DOMAIN=localhost
 
-# Install OpenSSH server and Gitolite
-# Unlock the automatically-created git user
 RUN set -x \
- && apk add --no-cache openrc fail2ban gitolite openssh
+ && apk add --no-cache \
+   curl cmark fail2ban fcgiwrap gcc gitolite libintl libressl-dev linux-headers \
+   make musl-dev musl-libintl nginx openrc openssh py3-pygments zlib-dev \
+ && tar -xvf /deps.tar.gz
 
-RUN apk update && apk update
+RUN apk update \
+ && apk upgrade --no-cache \
+ && sed -i '/getty/d' /etc/inittab
 
-RUN rc-update add fail2ban
+COPY cgit/40-fcgiwrap.sh /docker-entrypoint.d/
+RUN chmod +x /docker-entrypoint.d/40-fcgiwrap.sh
 
-RUN git config --system advice.defaultBranchName false
+COPY cgit/cgitrc /etc/
+
+COPY cgit/nginx.conf /
+RUN sed "s/\$DOMAIN/$DOMAIN/g" /nginx.conf > /etc/nginx/http.d/default.conf \
+  && rm /nginx.conf
+
+RUN addgroup nginx www-data
+
+COPY cgit/about.html /var/www/htdocs/cgit/
+COPY cgit/cgit.png /var/www/htdocs/cgit/logo.png
+COPY cgit/favicon.ico /var/www/htdocs/cgit/
+
+COPY cgit/css_variable_colors.sh /
+COPY cgit/everforest.css /var/www/htdocs/cgit/
+RUN sh css_variable_colors.sh
+
+COPY cgit/about-formatting.sh /usr/local/lib/cgit/filters/about-formatting.sh
+RUN chmod 755 /usr/local/lib/cgit/filters/about-formatting.sh
 
 # Volume used to store SSH host keys, generated on first run
 VOLUME /etc/ssh/keys
 
+RUN rc-update add fail2ban \
+ && rc-update add fcgiwrap \
+ && rc-update add nginx \
+ && rc-update add sshd
+
+# www-data may not be necessary
+RUN addgroup fcgiwrap git
+#RUN usermod -G nginx,www-data,git nginx
+# Configure gitolite
+# Install OpenSSH server and Gitolite
+# Unlock the automatically-created git user
+
+#RUN addgroup -g 102 -S git \
+# && adduser -S -D -H -u 102 -h /var/lib/git -s /sbin/nologin -G git -g git git
+
+RUN git config --system advice.defaultBranchName false
+
 # Volume used to store all Gitolite data (keys, config and repositories), initialized on first run
 VOLUME /var/lib/git
+RUN chmod 750 /var/lib/git
+
+# Disable unwanted authentications and Disable sftp subsystem
+RUN perl -i -pe 's/^#?((?!Kerberos|GSSAPI|Password)\w*Authentication)\s.*/\1 no/;s/^(PubkeyAuthentication) no/\1 yes/' /etc/ssh/sshd_config \
+ && perl -i -pe 's/^#?(PermitRootLogin)\s.*/\1 no/' /etc/ssh/sshd_config \
+ && perl -i -pe 's/^(Subsystem\ssftp\s)/#\1/' /etc/ssh/sshd_config
+
 
 # Permissions are fixed in docker-entrypoint.sh
 RUN mkdir -p /var/lib/git/local/hooks/common
 COPY post-receive /var/lib/git/local/hooks/common/
 RUN chmod +x /var/lib/git/local/hooks/common/post-receive
 
+# Configure nginx & cgit + fcgiwrap
+#RUN addgroup -g 101 -S nginx \
+# && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx
+
 # Entrypoint responsible for SSH host keys generation, and Gitolite data initialization
 COPY docker-entrypoint.sh /
 RUN chmod +x /docker-entrypoint.sh
@@ -31,4 +113,6 @@ ENTRYPOINT ["/docker-entrypoint.sh"]
 EXPOSE 22
 
 # Default command is to run the SSH server
-CMD ["sshd"]
+#CMD ["sshd"]
+#CMD ["/sbin/init"]
+CMD ["/sbin/init"]