mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-11-01 16:12:02 +00:00
Linus Rath
be5a5e88ec
Every image, the standalone tarballs and the Lite zips are built with source maps (`BULWARK_SOURCE_MAPS=1`). Turbopack builds give each chunk a debug ID themselves; the webpack build in the Docker image gets them from `sentry-cli sourcemaps inject`. `scripts/sourcemaps.mjs collect` then moves every map out of the build before anything is packed, and `scripts/sourcemaps.mjs check` fails the build when a `.map` file, an inline map or a `sourceMappingURL` to a missing file would ship. - Docker images: a `sourcemaps` stage holds only the maps; the amd64 job exports it (a cache hit) and uploads it, since both platforms build identical chunks - standalone tarballs, the Lite zips and the Lite image upload their own maps and check what they ship - `scripts/upload-sourcemaps.sh` uploads to `bulwark-instances` and `bulwark-telemetry` (Bugsink keeps maps per project) and skips with a notice when the `BUGSINK_AUTH_TOKEN` secret is missing
68 lines
3.1 KiB
Docker
68 lines
3.1 KiB
Docker
# Bulwark Lite as a container: the static export behind an unprivileged nginx,
|
|
# no Node.js at runtime. Mount your own config.json (and policy.json) over the
|
|
# ones in /usr/share/nginx/html to configure it - see README.md, "Static Lite
|
|
# build".
|
|
#
|
|
# docker build -f Dockerfile.lite -t bulwark-lite .
|
|
|
|
# The export is plain files, so it is built once on the build host's
|
|
# architecture, whatever the target platform is.
|
|
FROM --platform=$BUILDPLATFORM node:24-alpine AS builder
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci
|
|
COPY . .
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
# scripts/lite/prepare.mjs deletes the server-only trees in place; this layer
|
|
# is disposable, which is what CI=true asserts.
|
|
ENV CI=true
|
|
# Defaults baked into config.json; every one of them can still be changed by
|
|
# mounting a config.json. No NEXT_PUBLIC_BASE_PATH: the image serves from /.
|
|
ARG LITE_JMAP_SERVER_URL=
|
|
ARG LITE_APP_NAME=
|
|
ARG LITE_ALLOW_CUSTOM_ENDPOINT=
|
|
ARG LITE_REMEMBER_ME=
|
|
ARG LITE_DEMO_MODE=
|
|
# Comma-separated locale subset, e.g. en,de (default: all).
|
|
ARG LITE_LOCALES=
|
|
ARG NEXT_PUBLIC_DEFAULT_LOCALE=
|
|
# Commit SHA shown in the About screen. .dockerignore excludes .git, so CI
|
|
# must pass it in.
|
|
ARG GIT_COMMIT=unknown
|
|
# Browser source maps for the error tracker: CI passes 1. build:lite moves
|
|
# them to /sourcemaps (exported with `--target sourcemaps`) and fails if one
|
|
# would ship. https://bulwarkmail.org/docs/admin/monitoring
|
|
ARG BULWARK_SOURCE_MAPS=0
|
|
RUN mkdir -p /sourcemaps && \
|
|
LITE_TARGET=static NEXT_PUBLIC_BASE_PATH= SOURCEMAPS_OUT=/sourcemaps npm run build:lite && \
|
|
node scripts/lite/container.mjs /image && \
|
|
node scripts/sourcemaps.mjs check /image/html
|
|
|
|
# Only the maps, for CI to upload: never part of the image.
|
|
FROM scratch AS sourcemaps
|
|
COPY --from=builder /sourcemaps /
|
|
|
|
FROM nginxinc/nginx-unprivileged:1.30-alpine-slim
|
|
|
|
LABEL org.opencontainers.image.title="Bulwark Webmail Lite"
|
|
LABEL org.opencontainers.image.description="Bulwark Webmail as static files behind nginx; talks to the JMAP server straight from the browser"
|
|
LABEL org.opencontainers.image.source="https://github.com/bulwarkmail/webmail"
|
|
LABEL org.opencontainers.image.url="https://github.com/bulwarkmail/webmail"
|
|
LABEL org.opencontainers.image.licenses="AGPL-3.0-only"
|
|
LABEL org.opencontainers.image.vendor="rbm.systems"
|
|
|
|
# connect-src of the Content-Security-Policy. Set it to your JMAP server's
|
|
# origin (e.g. https://mail.example.com) once config.json pins the server.
|
|
ENV LITE_CSP_CONNECT_SRC="*"
|
|
# Only LITE_* is substituted into the nginx template, never nginx's own $uri etc.
|
|
ENV NGINX_ENVSUBST_FILTER="^LITE_"
|
|
|
|
# COPY only: no command runs in this stage, so other platforms build without emulation.
|
|
COPY --from=builder --chmod=0755 /app/scripts/lite/container/15-lite-listen-ipv6.envsh /docker-entrypoint.d/
|
|
COPY --from=builder /image/default.conf.template /etc/nginx/templates/default.conf.template
|
|
COPY --from=builder /image/html/ /usr/share/nginx/html/
|
|
|
|
EXPOSE 8080
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider http://127.0.0.1:8080/lite-build.json || exit 1
|