Init Commit

deploy/compose/docker-compose.example.yaml

@@ -0,0 +1,30 @@
+services:
+  app:
+    # cdnmanager и cdn-manager — один образ (алиас для drop-in).
+    image: git.shx.one/denozord/cdnmanager:latest
+    ports:
+      - "8080:8080"
+    environment:
+      DATABASE_URL: sqlite:/data/app.db
+      JWT_SECRET: ${JWT_SECRET:-change-me-in-production}
+      AUTH_REQUIRED: ${AUTH_REQUIRED:-false}
+      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:-${JWT_SECRET:-change-me-in-production}}
+      AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.shnt.top}
+      AUTH_PORTAL_URL: ${AUTH_PORTAL_URL:-https://auth.shnt.top}
+      ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}
+      ADMIN_PASSWORD_HASH: ${ADMIN_PASSWORD_HASH:-}
+      LOG_LEVEL: info
+      STATIC_DIR: /app/static
+      SERVER_PORT: "8080"
+    volumes:
+      - cdnmanager-data:/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8080/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+
+volumes:
+  cdnmanager-data:

deploy/docker/README.md

@@ -0,0 +1,54 @@
+# Docker-образы CDN Manager
+
+## CI (Gitea Actions)
+
+Сборка образов — **`docker buildx bake`** ([docker-bake.hcl](docker-bake.hcl)), не отдельные `docker build`.
+
+**Publish:** push в `main` после quality gates — workflow [CD](../../.gitea/workflows/cd.yaml) job **publish**: semantic-release + зеркало base-образов + bake с `VERSION` из релиза.
+
+Bake читает переменные из **окружения** (`REGISTRY`, `IMAGE_TAG`, `CACHE_REF_NODE`, `BASE_NODE`).
+
+BuildKit кэширует pnpm store через `RUN --mount=type=cache`. На CI mounts живут, пока named builder `cdnmanager` не удаляют (`cleanup: false`).
+
+### Слои и runtime
+
+| Образ | Runtime base | Заметка |
+|-------|----------------|---------|
+| `cdnmanager`, `cdn-manager` | `node:22-alpine` | один процесс: API + SPA + SQLite; `better-sqlite3` и `@node-rs/argon2` собираются в alpine на stage `deps`/`build` |
+
+`python3` / `make` / `g++` только в `deps`/`build`. Context режется корневым [.dockerignore](../../.dockerignore).
+
+Теги `cdnmanager` и `cdn-manager` — один и тот же образ (`cdn-manager` — drop-in).
+
+### Кэш registry
+
+- `git.shx.one/<owner>/cdnmanager-buildcache:node-buildcache` — **запись** только из `node-build`
+- `git.shx.one/<owner>/cdnmanager-buildcache:base-node-22-alpine` — зеркало FROM с Docker Hub. Только `linux/amd64`; skip если тег уже в Gitea. Неуспешный copy не валит CD — bake берёт Docker Hub FROM.
+
+`pull = false` в bake: не перекачивать FROM, если слой уже в builder. Не запускайте `docker system prune -a` на runner.
+
+Параллельный `cache-to` в один ref ломает manifest (`content descriptor … not found`).
+
+Если CI падает на «not found» после смены схемы кэша — один раз удалите теги `cdnmanager-buildcache:*` в registry и пересоберите.
+
+## Локальная сборка
+
+Из корня репозитория:
+
+```bash
+cd deploy/docker
+export REGISTRY=git.shx.one/<owner>
+export IMAGE_TAG=latest
+export SHORT_SHA=$(git rev-parse --short HEAD)
+export VERSION=dev
+export BUILD_TIME=
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl default
+```
+
+Проверка манифеста без сборки:
+
+```bash
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl --print default
+```
+
+В `docker-bake.hcl`: `context = "../.."` резолвится **от cwd** (каталог `deploy/docker/`). `dockerfile` — путь от этого context (корень репо). Из корня репо не вызывать bake с `-f deploy/docker/docker-bake.hcl`: получится `lstat ../../deploy`. Можно задать `BUILDX_BAKE_FILE_RELATIVE_PATHS=1`.

deploy/docker/cdnmanager/Dockerfile

@@ -0,0 +1,51 @@
+# syntax=docker/dockerfile:1.7
+# All-in-one CDN Manager (Fastify + SPA + SQLite).
+ARG BASE_NODE=docker.io/library/node:22-alpine
+
+FROM ${BASE_NODE} AS deps
+WORKDIR /repo
+RUN apk add --no-cache python3 make g++ \
+    && corepack enable && corepack prepare pnpm@10.12.1 --activate
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml turbo.json ./
+COPY apps/web/package.json apps/web/
+COPY apps/api/package.json apps/api/
+COPY packages/ui/package.json packages/ui/
+COPY packages/shared/package.json packages/shared/
+COPY packages/db/package.json packages/db/
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
+    pnpm install --frozen-lockfile
+
+FROM deps AS build
+COPY apps/web apps/web
+COPY apps/api apps/api
+COPY packages/ui packages/ui
+COPY packages/shared packages/shared
+COPY packages/db packages/db
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
+    pnpm turbo build --filter=web --filter=@cdnmanager/api \
+    && pnpm --filter @cdnmanager/api deploy --prod /out \
+    && cp -r apps/web/dist /out/static \
+    && rm -rf /out/src /out/test /out/.turbo \
+    && rm -rf /out/node_modules/@cdnmanager/db/src /out/node_modules/@cdnmanager/db/scripts /out/node_modules/@cdnmanager/db/.turbo \
+    && rm -rf /out/node_modules/@cdnmanager/shared/src /out/node_modules/@cdnmanager/shared/.turbo \
+    && find /out/dist /out/node_modules/@cdnmanager -type f \( -name '*.d.ts' -o -name '*.map' -o -name 'tsconfig*.json' -o -name 'vitest.config.ts' -o -name 'drizzle.config.ts' \) -delete
+
+FROM ${BASE_NODE} AS runtime
+WORKDIR /app
+RUN apk add --no-cache ca-certificates
+ARG VERSION=dev
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=
+ENV NODE_ENV=production \
+    STATIC_DIR=/app/static \
+    DATABASE_URL=sqlite:/data/app.db \
+    SERVER_PORT=8080 \
+    APP_VERSION=${VERSION} \
+    GIT_SHA=${GIT_SHA} \
+    BUILD_TIME=${BUILD_TIME}
+COPY --from=build /out ./
+EXPOSE 8080
+VOLUME ["/data"]
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD ["node", "-e", "fetch('http://127.0.0.1:8080/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+CMD ["node", "dist/server.js"]

deploy/docker/docker-bake.hcl

@@ -0,0 +1,117 @@
+# Единая сборка образа CDNManager (buildx bake: -f deploy/docker/docker-bake.hcl).
+# context = "../.." — корень репо. Bake резолвит context от cwd (не от HCL),
+# поэтому вызов из deploy/docker/ либо BUILDX_BAKE_FILE_RELATIVE_PATHS=1.
+
+variable "REGISTRY" {
+  default = "git.shx.one/denozord"
+}
+
+variable "IMAGE_TAG" {
+  default = "latest"
+}
+
+variable "SHORT_SHA" {
+  default = "dev"
+}
+
+variable "SHA_FULL" {
+  default = ""
+}
+
+variable "VERSION" {
+  default = "dev"
+}
+
+variable "BUILD_TIME" {
+  default = ""
+}
+
+variable "CACHE_REF_NODE" {
+  default = ""
+}
+
+variable "BASE_NODE" {
+  default = "docker.io/library/node:22-alpine"
+}
+
+function "node-cache-from" {
+  params = []
+  result = notequal("", CACHE_REF_NODE) ? ["type=registry,ref=${CACHE_REF_NODE}"] : []
+}
+
+# Экспорт кэша — один writer на ref (параллельный cache-to в один ref ломает manifest).
+function "node-cache-to-export" {
+  params = []
+  result = notequal("", CACHE_REF_NODE) ? ["type=registry,ref=${CACHE_REF_NODE},mode=max"] : []
+}
+
+function "image-tags" {
+  params = [name]
+  result = concat(
+    notequal("", SHA_FULL) ? [
+      "${REGISTRY}/${name}:${IMAGE_TAG}",
+      "${REGISTRY}/${name}:${SHORT_SHA}",
+      "${REGISTRY}/${name}:sha-${SHA_FULL}",
+    ] : [
+      "${REGISTRY}/${name}:${IMAGE_TAG}",
+      "${REGISTRY}/${name}:${SHORT_SHA}",
+    ],
+    notequal(VERSION, "dev") && notequal(VERSION, "") ? [
+      "${REGISTRY}/${name}:v${VERSION}",
+      "${REGISTRY}/${name}:${VERSION}",
+    ] : []
+  )
+}
+
+group "default" {
+  targets = ["cdnmanager"]
+}
+
+target "_common" {
+  platforms = ["linux/amd64"]
+  pull      = false
+}
+
+target "node-deps" {
+  inherits   = ["_common"]
+  context    = "../.."
+  dockerfile = "deploy/docker/cdnmanager/Dockerfile"
+  target     = "deps"
+  args = {
+    BASE_NODE = BASE_NODE
+  }
+  cache-from = node-cache-from()
+}
+
+target "node-build" {
+  inherits   = ["_common"]
+  context    = "../.."
+  dockerfile = "deploy/docker/cdnmanager/Dockerfile"
+  target     = "build"
+  args = {
+    BASE_NODE = BASE_NODE
+  }
+  contexts = {
+    deps = "target:node-deps"
+  }
+  cache-from = node-cache-from()
+  cache-to   = node-cache-to-export()
+}
+
+target "cdnmanager" {
+  inherits   = ["_common"]
+  context    = "../.."
+  dockerfile = "deploy/docker/cdnmanager/Dockerfile"
+  target     = "runtime"
+  args = {
+    BASE_NODE  = BASE_NODE
+    VERSION    = VERSION
+    GIT_SHA    = notequal("", SHA_FULL) ? SHA_FULL : SHORT_SHA
+    BUILD_TIME = BUILD_TIME
+  }
+  contexts = {
+    build = "target:node-build"
+  }
+  cache-from = node-cache-from()
+  tags       = concat(image-tags("cdnmanager"), image-tags("cdn-manager"))
+}

deploy/docker/mirror-base-images.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env sh
+# Copy-by-digest зеркало базовых образов в Gitea Container Registry (без rebuild).
+# Требует: docker login в REGISTRY host, docker buildx.
+# REGISTRY=git.shx.one/<owner>  (без суффикса /cdnmanager-buildcache)
+#
+# Источник library-образов — Docker Hub (docker.io).
+# Если тег уже есть в Gitea — skip (без повторного pull).
+# Копируем только linux/amd64 — bake platforms совпадает.
+# Шаг CD не должен падать: неуспешный copy оставляет bake на Docker Hub FROM.
+set -eu
+REGISTRY="${REGISTRY:?REGISTRY required (git.shx.one/<owner>)}"
+CACHE_REPO="${REGISTRY}/cdnmanager-buildcache"
+ENV_FILE="${MIRROR_ENV_FILE:-}"
+PLATFORM="${MIRROR_PLATFORM:-linux/amd64}"
+RETRIES="${MIRROR_RETRIES:-4}"
+
+tmp="$(mktemp)"
+cleanup() { rm -f "$tmp"; }
+trap cleanup EXIT
+
+dest_exists() {
+  docker buildx imagetools inspect "$1" >/dev/null 2>&1
+}
+
+copy_retry() {
+  src="$1"
+  dest="$2"
+  n=0
+  while [ "$n" -lt "$RETRIES" ]; do
+    n=$((n + 1))
+    if docker buildx imagetools create --platform "$PLATFORM" --tag "$dest" "$src"; then
+      return 0
+    fi
+    delay=$((n * 25))
+    echo "mirror retry ${n}/${RETRIES}, sleep ${delay}s: ${dest}"
+    sleep "$delay"
+  done
+  return 1
+}
+
+mirror() {
+  src="$1"
+  tag="$2"
+  var="$3"
+  dest="${CACHE_REPO}:${tag}"
+  if dest_exists "$dest"; then
+    echo "skip (already in registry): ${dest}"
+    printf '%s=%s\n' "$var" "$dest" >>"$tmp"
+    return 0
+  fi
+  echo "mirror ${src} -> ${dest} (${PLATFORM})"
+  if copy_retry "$src" "$dest"; then
+    printf '%s=%s\n' "$var" "$dest" >>"$tmp"
+    return 0
+  fi
+  echo "warn: ${dest} not mirrored — bake uses Docker Hub FROM for ${var}"
+  return 0
+}
+
+mirror "docker.io/library/node:22-alpine" "base-node-22-alpine" BASE_NODE
+
+echo "----- mirrored BASE_* -----"
+cat "$tmp"
+if [ -n "$ENV_FILE" ]; then
+  env_dir="$(dirname "$ENV_FILE")"
+  if [ -d "$env_dir" ]; then
+    cp "$tmp" "$ENV_FILE"
+    echo "wrote ${ENV_FILE}"
+  else
+    echo "warn: MIRROR_ENV_FILE dir missing (${env_dir}) — skip write"
+  fi
+fi