mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-22 07:48:26 +00:00
7224ce34f6
- Add multi-stage Dockerfile: Rust builder stage compiles FIPS with --no-default-features --features tui (excludes BLE/libdbus) - Move build context to repo root so Dockerfile can access Cargo.toml/src - Add .dockerignore to exclude target/, .git/, testing/ from context - Fix UDP port mapping to 2121:2121 - Delete scripts/build.sh cross-compile workflow - Simplify README setup steps (no local Rust toolchain needed) - Replace ratatui::init() with try_init() for clean error on terminal init failure (e.g. Docker on macOS Sequoia)
69 lines
2.5 KiB
Docker
69 lines
2.5 KiB
Docker
# ── Build stage: compile FIPS from source ──
|
|
FROM rust:1.94-slim-trixie AS builder
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
pkg-config && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build
|
|
COPY Cargo.toml Cargo.lock rust-toolchain.toml build.rs ./
|
|
COPY src ./src
|
|
|
|
RUN cargo build --release --no-default-features --features tui && \
|
|
cp target/release/fips target/release/fipsctl target/release/fipstop /usr/local/bin/
|
|
|
|
# ── Runtime stage ──
|
|
FROM debian:trixie-slim
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
iproute2 iputils-ping dnsutils dnsmasq iptables \
|
|
openssh-client openssh-server python3 \
|
|
tcpdump netcat-openbsd curl iperf3 && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install nak (Nostr Army Knife) — detect arch and download the correct binary.
|
|
# Asset naming: nak-<version>-linux-<arch>
|
|
RUN ARCH=$(dpkg --print-architecture) && \
|
|
case "$ARCH" in \
|
|
amd64) NAK_ARCH="linux-amd64" ;; \
|
|
arm64) NAK_ARCH="linux-arm64" ;; \
|
|
armhf) NAK_ARCH="linux-arm" ;; \
|
|
*) echo "Unsupported arch: $ARCH" && exit 1 ;; \
|
|
esac && \
|
|
NAK_VERSION=$(curl -sSL --retry 3 \
|
|
"https://api.github.com/repos/fiatjaf/nak/releases/latest" \
|
|
| grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\(.*\)".*/\1/') && \
|
|
echo "Installing nak ${NAK_VERSION} for ${NAK_ARCH}" && \
|
|
curl -sSL --retry 3 \
|
|
"https://github.com/fiatjaf/nak/releases/download/${NAK_VERSION}/nak-${NAK_VERSION}-${NAK_ARCH}" \
|
|
-o /usr/local/bin/nak && \
|
|
chmod +x /usr/local/bin/nak && \
|
|
nak --version
|
|
|
|
# Setup SSH server with no authentication (test only!)
|
|
RUN mkdir -p /var/run/sshd && \
|
|
ssh-keygen -A && \
|
|
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && \
|
|
sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords yes/' /etc/ssh/sshd_config && \
|
|
sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config && \
|
|
passwd -d root
|
|
|
|
# dnsmasq: forward .fips to FIPS daemon, everything else to Docker DNS
|
|
RUN printf '%s\n' \
|
|
'port=53' \
|
|
'listen-address=127.0.0.1' \
|
|
'bind-interfaces' \
|
|
'server=/fips/127.0.0.1#5354' \
|
|
'server=127.0.0.11' \
|
|
'no-resolv' \
|
|
>> /etc/dnsmasq.conf
|
|
|
|
COPY --from=builder /usr/local/bin/fips /usr/local/bin/fipsctl /usr/local/bin/fipstop /usr/local/bin/
|
|
|
|
COPY examples/sidecar-nostr-relay/entrypoint.sh /entrypoint.sh
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|