nel.pet / core
forked from tangled.org/core
this repo has no description
fork atom

docker: make docker-compose serve https and fix permissions

This fixes two issues I had when deploying the eeg.cl.cam.ac.uk knot:

1) The permissions on the volumes are currently set at build time, which means that when a fresh volume is mounted it has the wrong permissions. This fixes it to run the chmods on the volumes dynamically at entrypoint time, which lets a fresh volume work with a knotserver.
The error before was:
```
knot-1 | time=2025-05-04T13:58:36.054Z level=ERROR msg="failed to setup db" error="unable to open database file: no such file or directory"
```

2) It's a little odd for the default setup to expose 5555 and insecure http to the Internet, given that the appview will try to connect to the knot over https. This adds a standalone Caddy server as the default and removes port 5555 from being directly explosed. A more advanced user with an existing proxy can easily remove this from the compose file and hook in their own.

The only remaining footgun my users have encountered is that of port 2222 being the default. Almost all the users have forgotten to add the `port 2222` directive in their ssh_config, and the _host_ sshd rejects them. In my local setup, I've swapped the host and knot ports around so that the knot runs on 2222, but a really elegant solution would be for some sort of ssh proxy on the host ssh to redirect the `git` user to the knotserver sshd. I haven't done that yet though!

anil.recoil.org f44471b8 730a60de

options
unified split
Changed files
+19 -5
docker
Dockerfile
docker-compose.yml
+2 -4
docker/Dockerfile 
···

       
42

       
42

       
 

       
COPY docker/rootfs/ .


     

       
43

       
43

       
 

       



     

       
44

       
44

       
 

       
RUN chown root:root /usr/local/libexec/tangled-keyfetch && \


     

       
45

       

       
-

       
    chmod 755 /usr/local/libexec/tangled-keyfetch && \


     

       
46

       

       
-

       
    chown git:git /home/git/repoguard && \


     

       
47

       

       
-

       
    chown git:git /app && chown git:git /home/git/repositories


     

       

       
45

       
+

       
    chmod 755 /usr/local/libexec/tangled-keyfetch


     

       
48

       
46

       
 

       



     

       
49

       
47

       
 

       
EXPOSE 22


     

       
50

       
48

       
 

       
EXPOSE 5555


     

       
51

       
49

       
 

       



     

       
52

       

       
-

       
ENTRYPOINT ["/init"]


     

       

       
50

       
+

       
ENTRYPOINT ["/bin/sh", "-c", "chown git:git /home/git/repoguard && chown git:git /app && chown git:git /home/git/repositories && /init"]
+17 -1
docker/docker-compose.yml 
···

       
13

       
13

       
 

       
      - "./repositories:/home/git/repositories"


     

       
14

       
14

       
 

       
      - "./server:/app"


     

       
15

       
15

       
 

       
    ports:


     

       
16

       

       
-

       
      - "5555:5555"


     

       
17

       
16

       
 

       
      - "2222:22"


     

       

       
17

       
+

       
  frontend:


     

       

       
18

       
+

       
    image: caddy:2-alpine


     

       

       
19

       
+

       
    command: >


     

       

       
20

       
+

       
      caddy


     

       

       
21

       
+

       
      reverse-proxy


     

       

       
22

       
+

       
      --from ${KNOT_SERVER_HOSTNAME}


     

       

       
23

       
+

       
      --to knot:5555


     

       

       
24

       
+

       
    depends_on:


     

       

       
25

       
+

       
      - knot


     

       

       
26

       
+

       
    ports:


     

       

       
27

       
+

       
      - "443:443"


     

       

       
28

       
+

       
      - "443:443/udp"


     

       

       
29

       
+

       
    volumes:


     

       

       
30

       
+

       
      - caddy_data:/data


     

       

       
31

       
+

       
    restart: always


     

       

       
32

       
+

       
volumes:


     

       

       
33

       
+

       
  caddy_data: