mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-30 16:16:19 +00:00
58 lines
2.6 KiB
Docker
58 lines
2.6 KiB
Docker
# Bulwark Lite as a container: the static export behind an unprivileged nginx,
|
|
# no Node.js at runtime. Mount your own config.json (and policy.json) over the
|
|
# ones in /usr/share/nginx/html to configure it - see README.md, "Static Lite
|
|
# build".
|
|
#
|
|
# docker build -f Dockerfile.lite -t bulwark-lite .
|
|
|
|
# The export is plain files, so it is built once on the build host's
|
|
# architecture, whatever the target platform is.
|
|
FROM --platform=$BUILDPLATFORM node:24-alpine AS builder
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci
|
|
COPY . .
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
# scripts/lite/prepare.mjs deletes the server-only trees in place; this layer
|
|
# is disposable, which is what CI=true asserts.
|
|
ENV CI=true
|
|
# Defaults baked into config.json; every one of them can still be changed by
|
|
# mounting a config.json. No NEXT_PUBLIC_BASE_PATH: the image serves from /.
|
|
ARG LITE_JMAP_SERVER_URL=
|
|
ARG LITE_APP_NAME=
|
|
ARG LITE_ALLOW_CUSTOM_ENDPOINT=
|
|
ARG LITE_REMEMBER_ME=
|
|
ARG LITE_DEMO_MODE=
|
|
# Comma-separated locale subset, e.g. en,de (default: all).
|
|
ARG LITE_LOCALES=
|
|
ARG NEXT_PUBLIC_DEFAULT_LOCALE=
|
|
# Commit SHA shown in the About screen. .dockerignore excludes .git, so CI
|
|
# must pass it in.
|
|
ARG GIT_COMMIT=unknown
|
|
RUN LITE_TARGET=static NEXT_PUBLIC_BASE_PATH= npm run build:lite && \
|
|
node scripts/lite/container.mjs /image
|
|
|
|
FROM nginxinc/nginx-unprivileged:1.30-alpine-slim
|
|
|
|
LABEL org.opencontainers.image.title="Bulwark Webmail Lite"
|
|
LABEL org.opencontainers.image.description="Bulwark Webmail as static files behind nginx; talks to the JMAP server straight from the browser"
|
|
LABEL org.opencontainers.image.source="https://github.com/bulwarkmail/webmail"
|
|
LABEL org.opencontainers.image.url="https://github.com/bulwarkmail/webmail"
|
|
LABEL org.opencontainers.image.licenses="AGPL-3.0-only"
|
|
LABEL org.opencontainers.image.vendor="rbm.systems"
|
|
|
|
# connect-src of the Content-Security-Policy. Set it to your JMAP server's
|
|
# origin (e.g. https://mail.example.com) once config.json pins the server.
|
|
ENV LITE_CSP_CONNECT_SRC="*"
|
|
# Only LITE_* is substituted into the nginx template, never nginx's own $uri etc.
|
|
ENV NGINX_ENVSUBST_FILTER="^LITE_"
|
|
|
|
# COPY only: no command runs in this stage, so other platforms build without emulation.
|
|
COPY --from=builder --chmod=0755 /app/scripts/lite/container/15-lite-listen-ipv6.envsh /docker-entrypoint.d/
|
|
COPY --from=builder /image/default.conf.template /etc/nginx/templates/default.conf.template
|
|
COPY --from=builder /image/html/ /usr/share/nginx/html/
|
|
|
|
EXPOSE 8080
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider http://127.0.0.1:8080/lite-build.json || exit 1
|