mirror of
https://github.com/linuxserver/docker-swag.git
synced 2026-11-06 00:49:24 +09:00
Compare commits
18
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 LinuxServer-CI
|
601d0e5812 | ||
|
LinuxServer-CI
|
4905a8df97 | ||
|
LinuxServer-CI
|
62adeac333 | ||
|
LinuxServer-CI
|
48d3f7a05d | ||
 Eric Nemchik
|
37f65cf01a | ||
|
Eric Nemchik
|
f15b41b67f | ||
|
Eric Nemchik
|
7a83b73126 | ||
|
Eric Nemchik
|
2807f25ee0 | ||
|
LinuxServer-CI
|
6f68d40a7a | ||
|
LinuxServer-CI
|
4ec09cbad5 | ||
 quietsy
|
f503b59b62 | ||
|
Eric Nemchik
|
aeb7370675 | ||
|
LinuxServer-CI
|
12d8c0329c | ||
|
LinuxServer-CI
|
4d08a0d2a4 | ||
 chpego
|
c21f88d530 | ||
|
chpego
|
015dd83612 | ||
|
chpego
|
9f6e490904 | ||
|
chpego
|
f19871923e |
No files matched your search
Vendored
+265
-68
@@ -52,6 +52,57 @@ pipeline {
|
||||
'''
|
||||
}
|
||||
}
|
||||
/* ############################
|
||||
Bash Function For GHCR Retry
|
||||
############################ */
|
||||
// Create a reusable script for a ghcr retry bash function
|
||||
stage("Create Bash Function"){
|
||||
steps{
|
||||
sh '''#! /bin/bash
|
||||
# create our retry function
|
||||
retry_ghcr() {
|
||||
local max_attempts=7
|
||||
local base_delay=10
|
||||
local max_delay=90
|
||||
local attempt=1
|
||||
local errfile exit_code delay pause
|
||||
errfile=$(mktemp)
|
||||
while true; do
|
||||
# run inside an if so a caller's set -e cannot abort before we get to retry
|
||||
if "$@" 2> >(tee "${errfile}" >&2); then
|
||||
exit_code=0
|
||||
else
|
||||
exit_code=$?
|
||||
fi
|
||||
# make sure tee has finished writing before we read the file
|
||||
wait $! 2>/dev/null || true
|
||||
if [[ "${exit_code}" == "0" ]]; then
|
||||
rm -f "${errfile}"
|
||||
return 0
|
||||
elif ! grep -q -i -E "retry-after:|toomanyrequests|too many requests" "${errfile}"; then
|
||||
rm -f "${errfile}"
|
||||
return "${exit_code}"
|
||||
elif (( attempt >= max_attempts )); then
|
||||
rm -f "${errfile}"
|
||||
echo "retry: $* failed after ${attempt} attempts (exit ${exit_code})" >&2
|
||||
return "${exit_code}"
|
||||
else
|
||||
# exponential delay: base * 2^(attempt-1), capped at max_delay
|
||||
delay=$(( base_delay * 2 ** (attempt - 1) ))
|
||||
(( delay > max_delay )) && delay="${max_delay}"
|
||||
# jitter between half and full delay so parallel builds spread out
|
||||
pause=$(( delay / 2 + RANDOM % (delay / 2 + 1) ))
|
||||
echo "retry: attempt ${attempt}/${max_attempts} failed (exit ${exit_code}); waiting ${pause}s..." >&2
|
||||
sleep "${pause}"
|
||||
((attempt++))
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
declare -f retry_ghcr > ${WORKSPACE}/retry_ghcr.sh
|
||||
'''
|
||||
}
|
||||
}
|
||||
// Setup all the basic environment variables needed for the build
|
||||
stage("Set ENV Variables base"){
|
||||
steps{
|
||||
@@ -79,7 +130,9 @@ pipeline {
|
||||
env.CI_TEST_ATTEMPTED = ''
|
||||
env.PUSH_ATTEMPTED = ''
|
||||
env.LS_RELEASE = sh(
|
||||
script: '''docker run --rm quay.io/skopeo/stable:v1 inspect docker://ghcr.io/${LS_USER}/${CONTAINER_NAME}:latest 2>/dev/null | jq -r '.Labels.build_version' | awk '{print $3}' | grep '\\-ls' || : ''',
|
||||
script: '''#! /bin/bash
|
||||
source ${WORKSPACE}/retry_ghcr.sh
|
||||
retry_ghcr docker run --rm quay.io/skopeo/stable:v1 inspect docker://ghcr.io/${LS_USER}/${CONTAINER_NAME}:latest | jq -r '.Labels.build_version' | awk '{print $3}' | grep '\\-ls' || : ''',
|
||||
returnStdout: true).trim()
|
||||
env.LS_RELEASE_NOTES = sh(
|
||||
script: '''cat readme-vars.yml | awk -F \\" '/date: "[0-9][0-9].[0-9][0-9].[0-9][0-9]:/ {print $4;exit;}' | sed -E ':a;N;$!ba;s/\\r{0,1}\\n/\\\\n/g' ''',
|
||||
@@ -100,8 +153,12 @@ pipeline {
|
||||
if ( env.SYFT_IMAGE_TAG == null ) {
|
||||
env.SYFT_IMAGE_TAG = 'latest'
|
||||
}
|
||||
if ( env.GITLAB_TIMEOUT == null ) {
|
||||
env.GITLAB_TIMEOUT = '600'
|
||||
}
|
||||
}
|
||||
echo "Using syft image tag ${SYFT_IMAGE_TAG}"
|
||||
echo "Using gitlab registry timeout ${GITLAB_TIMEOUT}"
|
||||
sh '''#! /bin/bash
|
||||
echo "The default github branch detected as ${GH_DEFAULT_BRANCH}" '''
|
||||
script{
|
||||
@@ -281,6 +338,8 @@ pipeline {
|
||||
}
|
||||
sh '''curl -sL https://raw.githubusercontent.com/linuxserver/docker-jenkins-builder/master/checkrun.sh | /bin/bash'''
|
||||
sh '''#! /bin/bash
|
||||
source ${WORKSPACE}/retry_ghcr.sh
|
||||
retry_ghcr docker pull ghcr.io/linuxserver/baseimage-alpine:3.23
|
||||
docker run --rm \
|
||||
-v ${WORKSPACE}:/mnt \
|
||||
-e AWS_ACCESS_KEY_ID=\"${S3_KEY}\" \
|
||||
@@ -307,7 +366,8 @@ pipeline {
|
||||
sh '''#! /bin/bash
|
||||
set -e
|
||||
TEMPDIR=$(mktemp -d)
|
||||
docker pull ghcr.io/linuxserver/jenkins-builder:latest
|
||||
source ${WORKSPACE}/retry_ghcr.sh
|
||||
retry_ghcr docker pull ghcr.io/linuxserver/jenkins-builder:latest
|
||||
# Cloned repo paths for templating:
|
||||
# ${TEMPDIR}/docker-${CONTAINER_NAME}: Cloned branch master of ${LS_USER}/${LS_REPO} for running the jenkins builder on
|
||||
# ${TEMPDIR}/repo/${LS_REPO}: Cloned branch master of ${LS_USER}/${LS_REPO} for commiting various templated file changes and pushing back to Github
|
||||
@@ -366,6 +426,7 @@ pipeline {
|
||||
sed -i 's|^changelogs:|# init diagram\\ninit_diagram:\\n\\n# changelog\\nchangelogs:|' readme-vars.yml
|
||||
fi
|
||||
mkdir -p ${TEMPDIR}/d2
|
||||
retry_ghcr docker pull ghcr.io/linuxserver/d2-builder:latest
|
||||
docker run --rm -v ${TEMPDIR}/d2:/output -e PUID=$(id -u) -e PGID=$(id -g) -e RAW="true" ghcr.io/linuxserver/d2-builder:latest ${CONTAINER_NAME}:latest
|
||||
ls -al ${TEMPDIR}/d2
|
||||
yq -ei ".init_diagram |= load_str(\\"${TEMPDIR}/d2/${CONTAINER_NAME}-latest.d2\\")" readme-vars.yml
|
||||
@@ -582,22 +643,25 @@ pipeline {
|
||||
steps {
|
||||
echo "Running on node: ${NODE_NAME}"
|
||||
sh "sed -r -i 's|(^FROM .*)|\\1\\n\\nENV LSIO_FIRST_PARTY=true|g' Dockerfile"
|
||||
sh "docker buildx build \
|
||||
--label \"org.opencontainers.image.created=${GITHUB_DATE}\" \
|
||||
--label \"org.opencontainers.image.authors=linuxserver.io\" \
|
||||
--label \"org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages\" \
|
||||
--label \"org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag\" \
|
||||
--label \"org.opencontainers.image.source=https://github.com/linuxserver/docker-swag\" \
|
||||
--label \"org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}\" \
|
||||
--label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \
|
||||
--label \"org.opencontainers.image.vendor=linuxserver.io\" \
|
||||
--label \"org.opencontainers.image.licenses=GPL-3.0-only\" \
|
||||
--label \"org.opencontainers.image.ref.name=${COMMIT_SHA}\" \
|
||||
--label \"org.opencontainers.image.title=Swag\" \
|
||||
--label \"org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.\" \
|
||||
--no-cache --pull -t ${IMAGE}:${META_TAG} --platform=linux/amd64 \
|
||||
--provenance=true --sbom=true --builder=container --load \
|
||||
--build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
|
||||
sh '''#! /bin/bash
|
||||
source ${WORKSPACE}/retry_ghcr.sh
|
||||
retry_ghcr docker buildx build \
|
||||
--label "org.opencontainers.image.created=${GITHUB_DATE}" \
|
||||
--label "org.opencontainers.image.authors=linuxserver.io" \
|
||||
--label "org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages" \
|
||||
--label "org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag" \
|
||||
--label "org.opencontainers.image.source=https://github.com/linuxserver/docker-swag" \
|
||||
--label "org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}" \
|
||||
--label "org.opencontainers.image.revision=${COMMIT_SHA}" \
|
||||
--label "org.opencontainers.image.vendor=linuxserver.io" \
|
||||
--label "org.opencontainers.image.licenses=GPL-3.0-only" \
|
||||
--label "org.opencontainers.image.ref.name=${COMMIT_SHA}" \
|
||||
--label "org.opencontainers.image.title=Swag" \
|
||||
--label "org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention." \
|
||||
--no-cache --pull -t ${IMAGE}:${META_TAG} --platform=linux/amd64 \
|
||||
--provenance=true --sbom=true --builder=container --load \
|
||||
--build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION="${VERSION_TAG}" --build-arg BUILD_DATE=${GITHUB_DATE} .
|
||||
'''
|
||||
sh '''#! /bin/bash
|
||||
set -e
|
||||
IFS=',' read -ra CACHE <<< "$BUILDCACHE"
|
||||
@@ -616,6 +680,17 @@ pipeline {
|
||||
retry_backoff(5,5) {
|
||||
sh '''#! /bin/bash
|
||||
set -e
|
||||
# run a registry.gitlab.com command under what is left of the gitlab time budget
|
||||
gitlab_timeout() {
|
||||
local remaining=$(( GITLAB_DEADLINE - SECONDS ))
|
||||
if (( remaining <= 0 )); then
|
||||
echo "gitlab timeout budget of ${GITLAB_TIMEOUT}s used up, skipping: $*" >&2
|
||||
return 124
|
||||
fi
|
||||
timeout "${remaining}" "$@"
|
||||
}
|
||||
GITLAB_DEADLINE=$(( SECONDS + GITLAB_TIMEOUT ))
|
||||
|
||||
echo $DOCKERHUB_TOKEN | docker login -u linuxserverci --password-stdin
|
||||
echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
|
||||
echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
|
||||
@@ -625,11 +700,16 @@ pipeline {
|
||||
declare -A pids
|
||||
IFS=',' read -ra CACHE <<< "$BUILDCACHE"
|
||||
for i in "${CACHE[@]}"; do
|
||||
docker push ${i}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} &
|
||||
if [[ "${i}" == *"registry.gitlab.com"* ]]; then
|
||||
TIMEOUT_CMD="gitlab_timeout"
|
||||
else
|
||||
TIMEOUT_CMD=""
|
||||
fi
|
||||
${TIMEOUT_CMD} docker push ${i}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} &
|
||||
pids[$!]="$i"
|
||||
done
|
||||
for p in "${!pids[@]}"; do
|
||||
wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* && "${pids[$p]}" != *"registry.gitlab.com"* ]] && exit 1; }
|
||||
wait "$p" || { if [[ "${pids[$p]}" != *"quay.io"* && "${pids[$p]}" != *"registry.gitlab.com"* ]]; then exit 1; fi; }
|
||||
done
|
||||
fi
|
||||
'''
|
||||
@@ -651,22 +731,25 @@ pipeline {
|
||||
steps {
|
||||
echo "Running on node: ${NODE_NAME}"
|
||||
sh "sed -r -i 's|(^FROM .*)|\\1\\n\\nENV LSIO_FIRST_PARTY=true|g' Dockerfile"
|
||||
sh "docker buildx build \
|
||||
--label \"org.opencontainers.image.created=${GITHUB_DATE}\" \
|
||||
--label \"org.opencontainers.image.authors=linuxserver.io\" \
|
||||
--label \"org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages\" \
|
||||
--label \"org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag\" \
|
||||
--label \"org.opencontainers.image.source=https://github.com/linuxserver/docker-swag\" \
|
||||
--label \"org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}\" \
|
||||
--label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \
|
||||
--label \"org.opencontainers.image.vendor=linuxserver.io\" \
|
||||
--label \"org.opencontainers.image.licenses=GPL-3.0-only\" \
|
||||
--label \"org.opencontainers.image.ref.name=${COMMIT_SHA}\" \
|
||||
--label \"org.opencontainers.image.title=Swag\" \
|
||||
--label \"org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.\" \
|
||||
--no-cache --pull -t ${IMAGE}:amd64-${META_TAG} --platform=linux/amd64 \
|
||||
--provenance=true --sbom=true --builder=container --load \
|
||||
--build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
|
||||
sh '''#! /bin/bash
|
||||
source ${WORKSPACE}/retry_ghcr.sh
|
||||
retry_ghcr docker buildx build \
|
||||
--label "org.opencontainers.image.created=${GITHUB_DATE}" \
|
||||
--label "org.opencontainers.image.authors=linuxserver.io" \
|
||||
--label "org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages" \
|
||||
--label "org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag" \
|
||||
--label "org.opencontainers.image.source=https://github.com/linuxserver/docker-swag" \
|
||||
--label "org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}" \
|
||||
--label "org.opencontainers.image.revision=${COMMIT_SHA}" \
|
||||
--label "org.opencontainers.image.vendor=linuxserver.io" \
|
||||
--label "org.opencontainers.image.licenses=GPL-3.0-only" \
|
||||
--label "org.opencontainers.image.ref.name=${COMMIT_SHA}" \
|
||||
--label "org.opencontainers.image.title=Swag" \
|
||||
--label "org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention." \
|
||||
--no-cache --pull -t ${IMAGE}:amd64-${META_TAG} --platform=linux/amd64 \
|
||||
--provenance=true --sbom=true --builder=container --load \
|
||||
--build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION="${VERSION_TAG}" --build-arg BUILD_DATE=${GITHUB_DATE} .
|
||||
'''
|
||||
sh '''#! /bin/bash
|
||||
set -e
|
||||
IFS=',' read -ra CACHE <<< "$BUILDCACHE"
|
||||
@@ -685,6 +768,17 @@ pipeline {
|
||||
retry_backoff(5,5) {
|
||||
sh '''#! /bin/bash
|
||||
set -e
|
||||
# run a registry.gitlab.com command under what is left of the gitlab time budget
|
||||
gitlab_timeout() {
|
||||
local remaining=$(( GITLAB_DEADLINE - SECONDS ))
|
||||
if (( remaining <= 0 )); then
|
||||
echo "gitlab timeout budget of ${GITLAB_TIMEOUT}s used up, skipping: $*" >&2
|
||||
return 124
|
||||
fi
|
||||
timeout "${remaining}" "$@"
|
||||
}
|
||||
GITLAB_DEADLINE=$(( SECONDS + GITLAB_TIMEOUT ))
|
||||
|
||||
echo $DOCKERHUB_TOKEN | docker login -u linuxserverci --password-stdin
|
||||
echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
|
||||
echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
|
||||
@@ -694,11 +788,16 @@ pipeline {
|
||||
declare -A pids
|
||||
IFS=',' read -ra CACHE <<< "$BUILDCACHE"
|
||||
for i in "${CACHE[@]}"; do
|
||||
docker push ${i}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} &
|
||||
if [[ "${i}" == *"registry.gitlab.com"* ]]; then
|
||||
TIMEOUT_CMD="gitlab_timeout"
|
||||
else
|
||||
TIMEOUT_CMD=""
|
||||
fi
|
||||
${TIMEOUT_CMD} docker push ${i}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} &
|
||||
pids[$!]="$i"
|
||||
done
|
||||
for p in "${!pids[@]}"; do
|
||||
wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* && "${pids[$p]}" != *"registry.gitlab.com"* ]] && exit 1; }
|
||||
wait "$p" || { if [[ "${pids[$p]}" != *"quay.io"* && "${pids[$p]}" != *"registry.gitlab.com"* ]]; then exit 1; fi; }
|
||||
done
|
||||
fi
|
||||
'''
|
||||
@@ -713,22 +812,64 @@ pipeline {
|
||||
steps {
|
||||
echo "Running on node: ${NODE_NAME}"
|
||||
sh "sed -r -i 's|(^FROM .*)|\\1\\n\\nENV LSIO_FIRST_PARTY=true|g' Dockerfile.aarch64"
|
||||
sh "docker buildx build \
|
||||
--label \"org.opencontainers.image.created=${GITHUB_DATE}\" \
|
||||
--label \"org.opencontainers.image.authors=linuxserver.io\" \
|
||||
--label \"org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages\" \
|
||||
--label \"org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag\" \
|
||||
--label \"org.opencontainers.image.source=https://github.com/linuxserver/docker-swag\" \
|
||||
--label \"org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}\" \
|
||||
--label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \
|
||||
--label \"org.opencontainers.image.vendor=linuxserver.io\" \
|
||||
--label \"org.opencontainers.image.licenses=GPL-3.0-only\" \
|
||||
--label \"org.opencontainers.image.ref.name=${COMMIT_SHA}\" \
|
||||
--label \"org.opencontainers.image.title=Swag\" \
|
||||
--label \"org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.\" \
|
||||
--no-cache --pull -f Dockerfile.aarch64 -t ${IMAGE}:arm64v8-${META_TAG} --platform=linux/arm64 \
|
||||
--provenance=true --sbom=true --builder=container --load \
|
||||
--build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
|
||||
sh '''#! /bin/bash
|
||||
# create our retry function
|
||||
retry_ghcr() {
|
||||
local max_attempts=7
|
||||
local base_delay=10
|
||||
local max_delay=90
|
||||
local attempt=1
|
||||
local errfile exit_code delay pause
|
||||
errfile=$(mktemp)
|
||||
while true; do
|
||||
# run inside an if so a caller's set -e cannot abort before we get to retry
|
||||
if "$@" 2> >(tee "${errfile}" >&2); then
|
||||
exit_code=0
|
||||
else
|
||||
exit_code=$?
|
||||
fi
|
||||
# make sure tee has finished writing before we read the file
|
||||
wait $! 2>/dev/null || true
|
||||
if [[ "${exit_code}" == "0" ]]; then
|
||||
rm -f "${errfile}"
|
||||
return 0
|
||||
elif ! grep -q -i -E "retry-after:|toomanyrequests|too many requests" "${errfile}"; then
|
||||
rm -f "${errfile}"
|
||||
return "${exit_code}"
|
||||
elif (( attempt >= max_attempts )); then
|
||||
rm -f "${errfile}"
|
||||
echo "retry: $* failed after ${attempt} attempts (exit ${exit_code})" >&2
|
||||
return "${exit_code}"
|
||||
else
|
||||
# exponential delay: base * 2^(attempt-1), capped at max_delay
|
||||
delay=$(( base_delay * 2 ** (attempt - 1) ))
|
||||
(( delay > max_delay )) && delay="${max_delay}"
|
||||
# jitter between half and full delay so parallel builds spread out
|
||||
pause=$(( delay / 2 + RANDOM % (delay / 2 + 1) ))
|
||||
echo "retry: attempt ${attempt}/${max_attempts} failed (exit ${exit_code}); waiting ${pause}s..." >&2
|
||||
sleep "${pause}"
|
||||
((attempt++))
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
retry_ghcr docker buildx build \
|
||||
--label "org.opencontainers.image.created=${GITHUB_DATE}" \
|
||||
--label "org.opencontainers.image.authors=linuxserver.io" \
|
||||
--label "org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages" \
|
||||
--label "org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag" \
|
||||
--label "org.opencontainers.image.source=https://github.com/linuxserver/docker-swag" \
|
||||
--label "org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}" \
|
||||
--label "org.opencontainers.image.revision=${COMMIT_SHA}" \
|
||||
--label "org.opencontainers.image.vendor=linuxserver.io" \
|
||||
--label "org.opencontainers.image.licenses=GPL-3.0-only" \
|
||||
--label "org.opencontainers.image.ref.name=${COMMIT_SHA}" \
|
||||
--label "org.opencontainers.image.title=Swag" \
|
||||
--label "org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention." \
|
||||
--no-cache --pull -f Dockerfile.aarch64 -t ${IMAGE}:arm64v8-${META_TAG} --platform=linux/arm64 \
|
||||
--provenance=true --sbom=true --builder=container --load \
|
||||
--build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION="${VERSION_TAG}" --build-arg BUILD_DATE=${GITHUB_DATE} .
|
||||
'''
|
||||
sh '''#! /bin/bash
|
||||
set -e
|
||||
IFS=',' read -ra CACHE <<< "$BUILDCACHE"
|
||||
@@ -747,6 +888,17 @@ pipeline {
|
||||
retry_backoff(5,5) {
|
||||
sh '''#! /bin/bash
|
||||
set -e
|
||||
# run a registry.gitlab.com command under what is left of the gitlab time budget
|
||||
gitlab_timeout() {
|
||||
local remaining=$(( GITLAB_DEADLINE - SECONDS ))
|
||||
if (( remaining <= 0 )); then
|
||||
echo "gitlab timeout budget of ${GITLAB_TIMEOUT}s used up, skipping: $*" >&2
|
||||
return 124
|
||||
fi
|
||||
timeout "${remaining}" "$@"
|
||||
}
|
||||
GITLAB_DEADLINE=$(( SECONDS + GITLAB_TIMEOUT ))
|
||||
|
||||
echo $DOCKERHUB_TOKEN | docker login -u linuxserverci --password-stdin
|
||||
echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
|
||||
echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
|
||||
@@ -755,11 +907,16 @@ pipeline {
|
||||
declare -A pids
|
||||
IFS=',' read -ra CACHE <<< "$BUILDCACHE"
|
||||
for i in "${CACHE[@]}"; do
|
||||
docker push ${i}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} &
|
||||
if [[ "${i}" == *"registry.gitlab.com"* ]]; then
|
||||
TIMEOUT_CMD="gitlab_timeout"
|
||||
else
|
||||
TIMEOUT_CMD=""
|
||||
fi
|
||||
${TIMEOUT_CMD} docker push ${i}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} &
|
||||
pids[$!]="$i"
|
||||
done
|
||||
for p in "${!pids[@]}"; do
|
||||
wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* && "${pids[$p]}" != *"registry.gitlab.com"* ]] && exit 1; }
|
||||
wait "$p" || { if [[ "${pids[$p]}" != *"quay.io"* && "${pids[$p]}" != *"registry.gitlab.com"* ]]; then exit 1; fi; }
|
||||
done
|
||||
fi
|
||||
'''
|
||||
@@ -794,6 +951,8 @@ pipeline {
|
||||
LOCAL_CONTAINER=${IMAGE}:${META_TAG}
|
||||
fi
|
||||
touch ${TEMPDIR}/package_versions.txt
|
||||
source ${WORKSPACE}/retry_ghcr.sh
|
||||
retry_ghcr docker pull ghcr.io/anchore/syft:${SYFT_IMAGE_TAG}
|
||||
docker run --rm \
|
||||
-v /var/run/docker.sock:/var/run/docker.sock:ro \
|
||||
-v ${TEMPDIR}:/tmp \
|
||||
@@ -885,9 +1044,10 @@ pipeline {
|
||||
CI_DOCKERENV="LSIO_FIRST_PARTY=true"
|
||||
fi
|
||||
fi
|
||||
docker pull ghcr.io/linuxserver/ci:${CITEST_IMAGETAG}
|
||||
source ${WORKSPACE}/retry_ghcr.sh
|
||||
retry_ghcr docker pull ghcr.io/linuxserver/ci:${CITEST_IMAGETAG}
|
||||
if [ "${MULTIARCH}" == "true" ]; then
|
||||
docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} --platform=arm64
|
||||
retry_ghcr docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} --platform=arm64
|
||||
docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
|
||||
fi
|
||||
docker run --rm \
|
||||
@@ -932,7 +1092,23 @@ pipeline {
|
||||
retry_backoff(5,5) {
|
||||
sh '''#! /bin/bash
|
||||
set -e
|
||||
# run a registry.gitlab.com command under what is left of the gitlab time budget
|
||||
gitlab_timeout() {
|
||||
local remaining=$(( GITLAB_DEADLINE - SECONDS ))
|
||||
if (( remaining <= 0 )); then
|
||||
echo "gitlab timeout budget of ${GITLAB_TIMEOUT}s used up, skipping: $*" >&2
|
||||
return 124
|
||||
fi
|
||||
timeout "${remaining}" "$@"
|
||||
}
|
||||
GITLAB_DEADLINE=$(( SECONDS + GITLAB_TIMEOUT ))
|
||||
|
||||
for PUSHIMAGE in "${IMAGE}" "${GITLABIMAGE}" "${GITHUBIMAGE}" "${QUAYIMAGE}"; do
|
||||
if [[ "${PUSHIMAGE}" == "${GITLABIMAGE}" ]]; then
|
||||
TIMEOUT_CMD="gitlab_timeout"
|
||||
else
|
||||
TIMEOUT_CMD=""
|
||||
fi
|
||||
[[ ${PUSHIMAGE%%/*} =~ \\. ]] && PUSHIMAGEPLUS="${PUSHIMAGE}" || PUSHIMAGEPLUS="docker.io/${PUSHIMAGE}"
|
||||
IFS=',' read -ra CACHE <<< "$BUILDCACHE"
|
||||
for i in "${CACHE[@]}"; do
|
||||
@@ -940,10 +1116,10 @@ pipeline {
|
||||
CACHEIMAGE=${i}
|
||||
fi
|
||||
done
|
||||
docker buildx imagetools create --prefer-index=false -t ${PUSHIMAGE}:${META_TAG} -t ${PUSHIMAGE}:latest -t ${PUSHIMAGE}:${EXT_RELEASE_TAG} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
${TIMEOUT_CMD} docker buildx imagetools create --prefer-index=false -t ${PUSHIMAGE}:${META_TAG} -t ${PUSHIMAGE}:latest -t ${PUSHIMAGE}:${EXT_RELEASE_TAG} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
{ if [[ "${PUSHIMAGE}" != "${QUAYIMAGE}" && "${PUSHIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; }
|
||||
if [ -n "${SEMVER}" ]; then
|
||||
docker buildx imagetools create --prefer-index=false -t ${PUSHIMAGE}:${SEMVER} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
${TIMEOUT_CMD} docker buildx imagetools create --prefer-index=false -t ${PUSHIMAGE}:${SEMVER} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
{ if [[ "${PUSHIMAGE}" != "${QUAYIMAGE}" && "${PUSHIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; }
|
||||
fi
|
||||
done
|
||||
@@ -964,7 +1140,23 @@ pipeline {
|
||||
retry_backoff(5,5) {
|
||||
sh '''#! /bin/bash
|
||||
set -e
|
||||
# run a registry.gitlab.com command under what is left of the gitlab time budget
|
||||
gitlab_timeout() {
|
||||
local remaining=$(( GITLAB_DEADLINE - SECONDS ))
|
||||
if (( remaining <= 0 )); then
|
||||
echo "gitlab timeout budget of ${GITLAB_TIMEOUT}s used up, skipping: $*" >&2
|
||||
return 124
|
||||
fi
|
||||
timeout "${remaining}" "$@"
|
||||
}
|
||||
GITLAB_DEADLINE=$(( SECONDS + GITLAB_TIMEOUT ))
|
||||
|
||||
for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}" "${GITHUBIMAGE}" "${QUAYIMAGE}"; do
|
||||
if [[ "${MANIFESTIMAGE}" == "${GITLABIMAGE}" ]]; then
|
||||
TIMEOUT_CMD="gitlab_timeout"
|
||||
else
|
||||
TIMEOUT_CMD=""
|
||||
fi
|
||||
if [[ "${MANIFESTIMAGE%%/*}" =~ \\. ]]; then
|
||||
MANIFESTIMAGEPLUS="${MANIFESTIMAGE}"
|
||||
else
|
||||
@@ -976,26 +1168,31 @@ pipeline {
|
||||
CACHEIMAGE=${i}
|
||||
fi
|
||||
done
|
||||
docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:amd64-${META_TAG} -t ${MANIFESTIMAGE}:amd64-latest -t ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
${TIMEOUT_CMD} docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:amd64-${META_TAG} -t ${MANIFESTIMAGE}:amd64-latest -t ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
{ if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; }
|
||||
docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:arm64v8-${META_TAG} -t ${MANIFESTIMAGE}:arm64v8-latest -t ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} ${CACHEIMAGE}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
${TIMEOUT_CMD} docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:arm64v8-${META_TAG} -t ${MANIFESTIMAGE}:arm64v8-latest -t ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} ${CACHEIMAGE}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
{ if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; }
|
||||
if [ -n "${SEMVER}" ]; then
|
||||
docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:amd64-${SEMVER} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
${TIMEOUT_CMD} docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:amd64-${SEMVER} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
{ if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; }
|
||||
docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:arm64v8-${SEMVER} ${CACHEIMAGE}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
${TIMEOUT_CMD} docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:arm64v8-${SEMVER} ${CACHEIMAGE}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || \
|
||||
{ if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; }
|
||||
fi
|
||||
done
|
||||
for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}" "${GITHUBIMAGE}" "${QUAYIMAGE}"; do
|
||||
docker buildx imagetools create -t ${MANIFESTIMAGE}:latest ${MANIFESTIMAGE}:amd64-latest ${MANIFESTIMAGE}:arm64v8-latest || \
|
||||
if [[ "${MANIFESTIMAGE}" == "${GITLABIMAGE}" ]]; then
|
||||
TIMEOUT_CMD="gitlab_timeout"
|
||||
else
|
||||
TIMEOUT_CMD=""
|
||||
fi
|
||||
${TIMEOUT_CMD} docker buildx imagetools create -t ${MANIFESTIMAGE}:latest ${MANIFESTIMAGE}:amd64-latest ${MANIFESTIMAGE}:arm64v8-latest || \
|
||||
{ if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; }
|
||||
docker buildx imagetools create -t ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG} || \
|
||||
${TIMEOUT_CMD} docker buildx imagetools create -t ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG} || \
|
||||
{ if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; }
|
||||
docker buildx imagetools create -t ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} || \
|
||||
${TIMEOUT_CMD} docker buildx imagetools create -t ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} || \
|
||||
{ if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; }
|
||||
if [ -n "${SEMVER}" ]; then
|
||||
docker buildx imagetools create -t ${MANIFESTIMAGE}:${SEMVER} ${MANIFESTIMAGE}:amd64-${SEMVER} ${MANIFESTIMAGE}:arm64v8-${SEMVER} || \
|
||||
${TIMEOUT_CMD} docker buildx imagetools create -t ${MANIFESTIMAGE}:${SEMVER} ${MANIFESTIMAGE}:amd64-${SEMVER} ${MANIFESTIMAGE}:arm64v8-${SEMVER} || \
|
||||
{ if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; }
|
||||
fi
|
||||
done
|
||||
|
||||
@@ -96,7 +96,7 @@ It is recommended to attempt obtaining a certificate with `STAGING=true` first t
|
||||
### Site config and reverse proxy
|
||||
|
||||
* The default site config resides at `/config/nginx/site-confs/default.conf`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
|
||||
* Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy_confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
|
||||
* Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy-confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
|
||||
* If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included
|
||||
`add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";`
|
||||
This will *ask* Google et al not to index and list your site. Be careful with this, as you will eventually be de-listed if you leave this line in on a site you wish to be present on search engines
|
||||
@@ -436,6 +436,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
|
||||
|
||||
## Versions
|
||||
|
||||
* **20.10.26:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf, authelia-server.conf, authentik-server.conf, tinyauth-server.conf - Update Nginx configuration to replace $http_host with $host$is_request_port$request_port for better compatibility.
|
||||
* **09.09.26:** - Use new X-Tinyauth-Location header in Tinyauth locations and remove duplicate auth module headers.
|
||||
* **19.07.26:** - Rebase to Alpine 3.24 with PHP 8.5.
|
||||
* **10.07.26:** - Add support for Let's Encrypt cert profiles. Run certbot twice daily with a random delay.
|
||||
|
||||
+89
-90
@@ -23,15 +23,15 @@ azure-mgmt-dns 9.0.0 python
|
||||
backports-tarfile 1.2.0 python
|
||||
bash 5.3.9-r1 apk
|
||||
beautifulsoup4 4.15.0 python
|
||||
boto3 1.43.111 python
|
||||
botocore 1.43.111 python
|
||||
boto3 1.43.118 python
|
||||
botocore 1.43.118 python
|
||||
brotli-libs 1.2.0-r1 apk
|
||||
bs4 0.0.2 python
|
||||
busybox 1.37.0-r31 apk
|
||||
busybox-binsh 1.37.0-r31 apk
|
||||
c-ares 1.34.8-r0 apk
|
||||
ca-certificates 20260909-r0 apk
|
||||
ca-certificates-bundle 20260909-r0 apk
|
||||
c-ares 1.34.9-r0 apk
|
||||
ca-certificates 20261020-r0 apk
|
||||
ca-certificates-bundle 20261020-r0 apk
|
||||
catatonit 0.2.1-r0 apk
|
||||
certbot 5.8.0 python
|
||||
certbot-dns-acmedns 0.1.0 python
|
||||
@@ -58,7 +58,7 @@ certbot-dns-godaddy 2.8.0 python
|
||||
certbot-dns-google 5.8.0 python
|
||||
certbot-dns-he 1.0.0 python
|
||||
certbot-dns-hetzner 4.0.0 python
|
||||
certbot-dns-hetzner-cloud 1.0.5 python
|
||||
certbot-dns-hetzner-cloud 1.1.0 python
|
||||
certbot-dns-infomaniak 0.3.3 python
|
||||
certbot-dns-inwx 3.0.3 python
|
||||
certbot-dns-ionos 2024.11.9 python
|
||||
@@ -67,7 +67,7 @@ certbot-dns-loopia 1.0.1 python
|
||||
certbot-dns-luadns 5.8.0 python
|
||||
certbot-dns-mijn-host 0.0.10 python
|
||||
certbot-dns-namecheap 1.0.0 python
|
||||
certbot-dns-netcup 2.0.3 python
|
||||
certbot-dns-netcup 2.1.0 python
|
||||
certbot-dns-njalla 2.0.2 python
|
||||
certbot-dns-nsone 5.8.0 python
|
||||
certbot-dns-ovh 5.8.0 python
|
||||
@@ -79,7 +79,7 @@ certbot-dns-standalone 1.2.1 python
|
||||
certbot-dns-transip 0.5.2 python
|
||||
certbot-dns-vultr 1.1.0 python
|
||||
certbot-plugin-gandi 1.5.0 python
|
||||
certifi 2026.7.22 python
|
||||
certifi 2026.10.23 python
|
||||
cffi 2.1.1 python
|
||||
charset-normalizer 3.5.2 python
|
||||
cli UNKNOWN binary
|
||||
@@ -104,7 +104,7 @@ domeneshop 0.4.4 python
|
||||
fail2ban 1.1.0 python
|
||||
fail2ban 1.1.0-r3 apk
|
||||
fail2ban-pyc 1.1.0-r3 apk
|
||||
filelock 4.1.0 python
|
||||
filelock 4.2.4 python
|
||||
findutils 4.10.0-r1 apk
|
||||
fontconfig 2.17.1-r1 apk
|
||||
freetype 2.14.3-r0 apk
|
||||
@@ -121,11 +121,11 @@ gnupg-keyboxd 2.4.9-r1 apk
|
||||
gnupg-utils 2.4.9-r1 apk
|
||||
gnupg-wks-client 2.4.9-r1 apk
|
||||
gnutls 3.8.13-r0 apk
|
||||
google-api-core 2.42.0 python
|
||||
google-api-core 2.43.0 python
|
||||
google-api-python-client 2.201.0 python
|
||||
google-auth 2.61.0 python
|
||||
google-auth 2.62.0 python
|
||||
google-auth-httplib2 0.4.4 python
|
||||
googleapis-common-protos 1.75.5 python
|
||||
googleapis-common-protos 1.76.0 python
|
||||
gpg 2.4.9-r1 apk
|
||||
gpg-agent 2.4.9-r1 apk
|
||||
gpg-wks-server 2.4.9-r1 apk
|
||||
@@ -157,7 +157,7 @@ jinja2 3.1.6 python
|
||||
jmespath 1.1.0 python
|
||||
josepy 2.2.0 python
|
||||
jq 1.8.2-r0 apk
|
||||
jsonpickle 4.1.3 python
|
||||
jsonpickle 4.1.4 python
|
||||
libapk 3.0.8-r0 apk
|
||||
libassuan 3.0.2-r0 apk
|
||||
libattr 2.5.2-r2 apk
|
||||
@@ -169,7 +169,7 @@ libcurl 8.22.0-r0 apk
|
||||
libdav1d 1.5.3-r0 apk
|
||||
libedit 20260508.3.1-r1 apk
|
||||
libevent 2.1.13-r0 apk
|
||||
libexpat 2.8.5-r0 apk
|
||||
libexpat 2.9.0-r0 apk
|
||||
libffi 3.5.2-r1 apk
|
||||
libgcc 15.2.0-r5 apk
|
||||
libgcrypt 1.12.2-r0 apk
|
||||
@@ -205,13 +205,13 @@ libtasn1 4.21.0-r0 apk
|
||||
libunistring 1.4.2-r0 apk
|
||||
libuuid 2.42.3-r1 apk
|
||||
libwebp 1.6.0-r0 apk
|
||||
libx11 1.8.13-r0 apk
|
||||
libx11 1.8.14-r0 apk
|
||||
libxau 1.0.12-r0 apk
|
||||
libxcb 1.17.0-r2 apk
|
||||
libxdmcp 1.1.5-r1 apk
|
||||
libxext 1.3.7-r0 apk
|
||||
libxml2 2.13.9-r2 apk
|
||||
libxpm 3.5.19-r0 apk
|
||||
libxpm 3.5.20-r0 apk
|
||||
libxslt 1.1.43-r3 apk
|
||||
libxt 1.3.1-r0 apk
|
||||
libxtables 1.8.13-r0 apk
|
||||
@@ -229,92 +229,91 @@ more-itertools 10.8.0 python
|
||||
mpdecimal 4.0.1-r0 apk
|
||||
msal 1.39.0 python
|
||||
msal-extensions 1.3.1 python
|
||||
musl 1.2.6-r2 apk
|
||||
musl 1.2.6-r3 apk
|
||||
musl-utils 1.2.6-r2 apk
|
||||
nano 9.2-r0 apk
|
||||
nano 9.3-r0 apk
|
||||
ncurses-terminfo-base 6.6_p20260516-r0 apk
|
||||
netcat-openbsd 1.234.1-r0 apk
|
||||
nettle 3.10.2-r0 apk
|
||||
nghttp2-libs 1.70.0-r0 apk
|
||||
nginx 1.30.4-r1 apk
|
||||
nginx-mod-devel-kit 1.30.4-r1 apk
|
||||
nginx-mod-http-brotli 1.30.4-r1 apk
|
||||
nginx-mod-http-dav-ext 1.30.4-r1 apk
|
||||
nginx-mod-http-echo 1.30.4-r1 apk
|
||||
nginx-mod-http-fancyindex 1.30.4-r1 apk
|
||||
nginx-mod-http-geoip2 1.30.4-r1 apk
|
||||
nginx-mod-http-headers-more 1.30.4-r1 apk
|
||||
nginx-mod-http-image-filter 1.30.4-r1 apk
|
||||
nginx-mod-http-perl 1.30.4-r1 apk
|
||||
nginx-mod-http-redis2 1.30.4-r1 apk
|
||||
nginx-mod-http-set-misc 1.30.4-r1 apk
|
||||
nginx-mod-http-upload-progress 1.30.4-r1 apk
|
||||
nginx-mod-http-xslt-filter 1.30.4-r1 apk
|
||||
nginx-mod-mail 1.30.4-r1 apk
|
||||
nginx-mod-rtmp 1.30.4-r1 apk
|
||||
nginx-mod-stream 1.30.4-r1 apk
|
||||
nginx-mod-stream-geoip2 1.30.4-r1 apk
|
||||
nginx-vim 1.30.4-r1 apk
|
||||
nginx 1.30.6-r0 apk
|
||||
nginx-mod-devel-kit 1.30.6-r0 apk
|
||||
nginx-mod-http-brotli 1.30.6-r0 apk
|
||||
nginx-mod-http-dav-ext 1.30.6-r0 apk
|
||||
nginx-mod-http-echo 1.30.6-r0 apk
|
||||
nginx-mod-http-fancyindex 1.30.6-r0 apk
|
||||
nginx-mod-http-geoip2 1.30.6-r0 apk
|
||||
nginx-mod-http-headers-more 1.30.6-r0 apk
|
||||
nginx-mod-http-image-filter 1.30.6-r0 apk
|
||||
nginx-mod-http-perl 1.30.6-r0 apk
|
||||
nginx-mod-http-redis2 1.30.6-r0 apk
|
||||
nginx-mod-http-set-misc 1.30.6-r0 apk
|
||||
nginx-mod-http-upload-progress 1.30.6-r0 apk
|
||||
nginx-mod-http-xslt-filter 1.30.6-r0 apk
|
||||
nginx-mod-mail 1.30.6-r0 apk
|
||||
nginx-mod-rtmp 1.30.6-r0 apk
|
||||
nginx-mod-stream 1.30.6-r0 apk
|
||||
nginx-mod-stream-geoip2 1.30.6-r0 apk
|
||||
nginx-vim 1.30.6-r0 apk
|
||||
npth 1.8-r0 apk
|
||||
oniguruma 6.9.10-r0 apk
|
||||
openssl 3.5.9-r0 apk
|
||||
opentelemetry-api 1.45.1 python
|
||||
p11-kit 0.26.2-r0 apk
|
||||
packaging 26.0 python
|
||||
packaging 26.3 python
|
||||
packaging 26.3 python (+1 duplicate)
|
||||
parsedatetime 2.6 python
|
||||
pcre2 10.49-r0 apk
|
||||
perl 5.42.2-r1 apk
|
||||
perl-error 0.17030-r0 apk
|
||||
perl-git 2.54.0-r0 apk
|
||||
php85 8.5.11-r0 apk
|
||||
php85-bcmath 8.5.11-r0 apk
|
||||
php85-bz2 8.5.11-r0 apk
|
||||
php85-common 8.5.11-r0 apk
|
||||
php85-ctype 8.5.11-r0 apk
|
||||
php85-curl 8.5.11-r0 apk
|
||||
php85-dom 8.5.11-r0 apk
|
||||
php85-exif 8.5.11-r0 apk
|
||||
php85-fileinfo 8.5.11-r0 apk
|
||||
php85-fpm 8.5.11-r0 apk
|
||||
php85-ftp 8.5.11-r0 apk
|
||||
php85-gd 8.5.11-r0 apk
|
||||
php85-gmp 8.5.11-r0 apk
|
||||
php85-iconv 8.5.11-r0 apk
|
||||
php85-intl 8.5.11-r0 apk
|
||||
php85-ldap 8.5.11-r0 apk
|
||||
php85-mbstring 8.5.11-r0 apk
|
||||
php85-mysqli 8.5.11-r0 apk
|
||||
php85-mysqlnd 8.5.11-r0 apk
|
||||
php85-openssl 8.5.11-r0 apk
|
||||
php85-pdo 8.5.11-r0 apk
|
||||
php85-pdo_mysql 8.5.11-r0 apk
|
||||
php85-pdo_odbc 8.5.11-r0 apk
|
||||
php85-pdo_pgsql 8.5.11-r0 apk
|
||||
php85-pdo_sqlite 8.5.11-r0 apk
|
||||
php85-pear 8.5.11-r0 apk
|
||||
php85 8.5.12-r0 apk
|
||||
php85-bcmath 8.5.12-r0 apk
|
||||
php85-bz2 8.5.12-r0 apk
|
||||
php85-common 8.5.12-r0 apk
|
||||
php85-ctype 8.5.12-r0 apk
|
||||
php85-curl 8.5.12-r0 apk
|
||||
php85-dom 8.5.12-r0 apk
|
||||
php85-exif 8.5.12-r0 apk
|
||||
php85-fileinfo 8.5.12-r0 apk
|
||||
php85-fpm 8.5.12-r0 apk
|
||||
php85-ftp 8.5.12-r0 apk
|
||||
php85-gd 8.5.12-r0 apk
|
||||
php85-gmp 8.5.12-r0 apk
|
||||
php85-iconv 8.5.12-r0 apk
|
||||
php85-intl 8.5.12-r0 apk
|
||||
php85-ldap 8.5.12-r0 apk
|
||||
php85-mbstring 8.5.12-r0 apk
|
||||
php85-mysqli 8.5.12-r0 apk
|
||||
php85-mysqlnd 8.5.12-r0 apk
|
||||
php85-openssl 8.5.12-r0 apk
|
||||
php85-pdo 8.5.12-r0 apk
|
||||
php85-pdo_mysql 8.5.12-r0 apk
|
||||
php85-pdo_odbc 8.5.12-r0 apk
|
||||
php85-pdo_pgsql 8.5.12-r0 apk
|
||||
php85-pdo_sqlite 8.5.12-r0 apk
|
||||
php85-pear 8.5.12-r0 apk
|
||||
php85-pecl-apcu 5.1.28-r0 apk
|
||||
php85-pecl-igbinary 3.2.17_rc1-r0 apk
|
||||
php85-pecl-memcached 3.4.0-r0 apk
|
||||
php85-pecl-msgpack 3.0.1-r0 apk
|
||||
php85-pecl-redis 6.3.0-r0 apk
|
||||
php85-pgsql 8.5.11-r0 apk
|
||||
php85-phar 8.5.11-r0 apk
|
||||
php85-posix 8.5.11-r0 apk
|
||||
php85-session 8.5.11-r0 apk
|
||||
php85-simplexml 8.5.11-r0 apk
|
||||
php85-soap 8.5.11-r0 apk
|
||||
php85-sockets 8.5.11-r0 apk
|
||||
php85-sodium 8.5.11-r0 apk
|
||||
php85-sqlite3 8.5.11-r0 apk
|
||||
php85-tokenizer 8.5.11-r0 apk
|
||||
php85-xml 8.5.11-r0 apk
|
||||
php85-xmlreader 8.5.11-r0 apk
|
||||
php85-xmlwriter 8.5.11-r0 apk
|
||||
php85-xsl 8.5.11-r0 apk
|
||||
php85-zip 8.5.11-r0 apk
|
||||
php85-pgsql 8.5.12-r0 apk
|
||||
php85-phar 8.5.12-r0 apk
|
||||
php85-posix 8.5.12-r0 apk
|
||||
php85-session 8.5.12-r0 apk
|
||||
php85-simplexml 8.5.12-r0 apk
|
||||
php85-soap 8.5.12-r0 apk
|
||||
php85-sockets 8.5.12-r0 apk
|
||||
php85-sodium 8.5.12-r0 apk
|
||||
php85-sqlite3 8.5.12-r0 apk
|
||||
php85-tokenizer 8.5.12-r0 apk
|
||||
php85-xml 8.5.12-r0 apk
|
||||
php85-xmlreader 8.5.12-r0 apk
|
||||
php85-xmlwriter 8.5.12-r0 apk
|
||||
php85-xsl 8.5.12-r0 apk
|
||||
php85-zip 8.5.12-r0 apk
|
||||
pinentry 1.3.2-r0 apk
|
||||
pip 26.2.1 python
|
||||
pip 26.2.2 python
|
||||
pkb-client 2.3.1 python
|
||||
platformdirs 4.4.0 python
|
||||
popt 1.19-r4 apk
|
||||
@@ -325,15 +324,15 @@ pyacmedns 0.4 python
|
||||
pyasn1 0.6.4 python
|
||||
pyasn1-modules 0.4.2 python
|
||||
pyc 3.14.8-r0 apk
|
||||
pycparser 3.11 python
|
||||
pydantic 2.14.0 python
|
||||
pydantic-core 2.50.0 python
|
||||
pycparser 3.12 python
|
||||
pydantic 2.14.1 python
|
||||
pydantic-core 2.50.1 python
|
||||
pyjwt 2.15.1 python
|
||||
pynamecheap 0.0.3 python
|
||||
pyopenssl 26.4.0 python
|
||||
pyotp 2.10.0 python
|
||||
pyparsing 3.3.3 python
|
||||
pyrfc3339 2.1.0 python
|
||||
pyrfc3339 2.1.1 python
|
||||
python-dateutil 2.9.0.post0 python
|
||||
python-digitalocean 1.17.0 python
|
||||
python-transip 0.6.0 python
|
||||
@@ -346,14 +345,14 @@ requests 2.34.2 python
|
||||
requests-file 3.0.1 python
|
||||
requests-mock 1.12.1 python
|
||||
requests-unixsocket 0.4.1 python
|
||||
s3transfer 0.19.2 python
|
||||
s3transfer 0.19.3 python
|
||||
scanelf 1.3.9-r1 apk
|
||||
setuptools 84.0.0 python
|
||||
setuptools 84.2.1 python
|
||||
shadow 4.18.0-r1 apk
|
||||
six 1.17.0 python
|
||||
skalibs-libs 2.15.0.0-r0 apk
|
||||
sniffio 1.3.1 python
|
||||
soupsieve 2.10 python
|
||||
soupsieve 3.0.4 python
|
||||
sqlite-libs 3.53.4-r0 apk
|
||||
ssl_client 1.37.0-r31 apk
|
||||
tiff 4.7.2-r0 apk
|
||||
@@ -361,7 +360,7 @@ tldextract 5.4.0 python
|
||||
tomli 2.4.0 python
|
||||
typing-extensions 4.16.0 python
|
||||
typing-inspection 0.4.4 python
|
||||
tzdata 2026d-r0 apk
|
||||
tzdata 2026e-r0 apk
|
||||
unixodbc 2.3.14-r1 apk
|
||||
uritemplate 4.2.0 python
|
||||
urllib3 2.8.0 python
|
||||
@@ -372,5 +371,5 @@ whois 5.6.6-r0 apk
|
||||
xz-libs 5.8.4-r0 apk
|
||||
zipp 3.23.0 python
|
||||
zlib 1.3.2-r1 apk
|
||||
zope-interface 8.6 python
|
||||
zope-interface 8.7 python
|
||||
zstd-libs 1.5.7-r2 apk
|
||||
+2
-1
@@ -94,7 +94,7 @@ app_setup_block: |
|
||||
### Site config and reverse proxy
|
||||
|
||||
* The default site config resides at `/config/nginx/site-confs/default.conf`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
|
||||
* Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy_confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
|
||||
* Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy-confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
|
||||
* If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included
|
||||
`add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";`
|
||||
This will *ask* Google et al not to index and list your site. Be careful with this, as you will eventually be de-listed if you leave this line in on a site you wish to be present on search engines
|
||||
@@ -220,6 +220,7 @@ init_diagram: |
|
||||
"swag:latest" <- Base Images
|
||||
# changelog
|
||||
changelogs:
|
||||
- {date: "20.10.26:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf, authelia-server.conf, authentik-server.conf, tinyauth-server.conf - Update Nginx configuration to replace $http_host with $host$is_request_port$request_port for better compatibility."}
|
||||
- {date: "09.09.26:", desc: "Use new X-Tinyauth-Location header in Tinyauth locations and remove duplicate auth module headers."}
|
||||
- {date: "19.07.26:", desc: "Rebase to Alpine 3.24 with PHP 8.5."}
|
||||
- {date: "10.07.26:", desc: "Add support for Let's Encrypt cert profiles. Run certbot twice daily with a random delay."}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
## Version 2025/03/25 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-server.conf.sample
|
||||
## Version 2026/10/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-server.conf.sample
|
||||
# Make sure that your authelia container is in the same user defined bridge network and is named authelia
|
||||
# Rename /config/nginx/proxy-confs/authelia.subdomain.conf.sample to /config/nginx/proxy-confs/authelia.subdomain.conf
|
||||
|
||||
@@ -28,7 +28,7 @@ location @authelia_proxy_signin {
|
||||
add_header Set-Cookie $set_cookie;
|
||||
|
||||
## Set the $target_url variable based on the original request
|
||||
set_escape_uri $target_url $scheme://$http_host$request_uri;
|
||||
set_escape_uri $target_url $scheme://$host$is_request_port$request_port$request_uri;
|
||||
|
||||
## Translate the Location response header from the auth subrequest into a variable
|
||||
auth_request_set $signin_url $upstream_http_location;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
## Version 2025/03/25 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-server.conf.sample
|
||||
## Version 2026/10/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-server.conf.sample
|
||||
# Make sure that your authentik container is in the same user defined bridge network and is named authentik-server
|
||||
# Rename /config/nginx/proxy-confs/authentik.subdomain.conf.sample to /config/nginx/proxy-confs/authentik.subdomain.conf
|
||||
|
||||
@@ -38,10 +38,10 @@ location @goauthentik_proxy_signin {
|
||||
add_header Set-Cookie $set_cookie;
|
||||
|
||||
## Set the $target_url variable based on the original request
|
||||
set_escape_uri $target_url $scheme://$http_host$request_uri;
|
||||
set_escape_uri $target_url $scheme://$host$is_request_port$request_port$request_uri;
|
||||
|
||||
## Set the $signin_url variable
|
||||
set $signin_url https://$http_host/outpost.goauthentik.io/start?rd=$target_url;
|
||||
set $signin_url https://$host$is_request_port$request_port/outpost.goauthentik.io/start?rd=$target_url;
|
||||
|
||||
## Redirect to login
|
||||
return 302 $signin_url;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
## Version 2023/02/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/proxy.conf.sample
|
||||
## Version 2026/10/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/proxy.conf.sample
|
||||
|
||||
# Timeout if the real server is dead
|
||||
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
|
||||
@@ -21,17 +21,17 @@ proxy_no_cache $cookie_session;
|
||||
# Proxy Header Settings
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
proxy_set_header Early-Data $ssl_early_data;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header Host $host; # NOTE: only use $host here, port is handled separately
|
||||
proxy_set_header Proxy "";
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Host $host; # NOTE: only use $host here, port is handled separately
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
proxy_set_header X-Forwarded-Port $server_port;
|
||||
proxy_set_header X-Forwarded-Port $request_port;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Server $host;
|
||||
proxy_set_header X-Forwarded-Server $host; # NOTE: only use $host here, port is handled separately
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
proxy_set_header X-Forwarded-Uri $request_uri;
|
||||
proxy_set_header X-Original-Method $request_method;
|
||||
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
|
||||
proxy_set_header X-Original-URL $scheme://$host$is_request_port$request_port$request_uri;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
@@ -1,4 +1,4 @@
|
||||
## Version 2026/03/07 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample
|
||||
## Version 2026/10/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample
|
||||
|
||||
# redirect all traffic to https
|
||||
server {
|
||||
@@ -7,6 +7,11 @@ server {
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
|
||||
# NOTE FOR USERS: If your external HTTP and HTTPS ports are asymmetrical
|
||||
# (e.g., External 8443 maps to Nginx 443),
|
||||
# replace the return above this one and hardcode your external HTTPS port:
|
||||
# return 301 https://$host:8443$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
## Version 2026/09/08 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-server.conf.sample
|
||||
## Version 2026/10/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-server.conf.sample
|
||||
# Make sure that your tinyauth container is in the same user defined bridge network and is named tinyauth
|
||||
# Rename /config/nginx/proxy-confs/tinyauth.subdomain.conf.sample to /config/nginx/proxy-confs/tinyauth.subdomain.conf
|
||||
|
||||
@@ -15,7 +15,7 @@ location /tinyauth {
|
||||
proxy_set_header Content-Length "";
|
||||
|
||||
# Headers needed for authentication
|
||||
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
|
||||
proxy_set_header X-Original-URL $scheme://$host$is_request_port$request_port$request_uri;
|
||||
proxy_set_header X-Original-Method $request_method;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
Reference in new issue
Block a user