diff --git a/files/Dockerfile b/files/Dockerfile new file mode 100644 index 0000000..081981d --- /dev/null +++ b/files/Dockerfile @@ -0,0 +1,95 @@ +# syntax=docker/dockerfile:1.4 +# This needs to be bullseye-slim because the Ruby image is built on bullseye-slim +ARG NODE_VERSION="16.17.1-bullseye-slim" + +FROM ghcr.io/moritzheiber/ruby-jemalloc:3.0.4-slim as ruby +FROM node:${NODE_VERSION} as build + +COPY --link --from=ruby /opt/ruby /opt/ruby + +ENV DEBIAN_FRONTEND="noninteractive" \ + PATH="${PATH}:/opt/ruby/bin" + +SHELL ["/bin/bash", "-o", "pipefail", "-c"] + +WORKDIR /opt/mastodon +COPY Gemfile* package.json yarn.lock /opt/mastodon/ + +RUN apt update && \ + apt-get install -y --no-install-recommends build-essential \ + ca-certificates \ + git \ + libicu-dev \ + libidn11-dev \ + libpq-dev \ + libjemalloc-dev \ + zlib1g-dev \ + libgdbm-dev \ + libgmp-dev \ + libssl-dev \ + libyaml-0-2 \ + ca-certificates \ + libreadline8 \ + python3 \ + shared-mime-info && \ + bundle config set --local deployment 'true' && \ + bundle config set --local without 'development test' && \ + bundle config set silence_root_warning true && \ + bundle install -j"$(nproc)" && \ + yarn install --pure-lockfile + +FROM node:${NODE_VERSION} + +ARG UID="991" +ARG GID="991" + +COPY --link --from=ruby /opt/ruby /opt/ruby + +SHELL ["/bin/bash", "-o", "pipefail", "-c"] + +ENV DEBIAN_FRONTEND="noninteractive" \ + PATH="${PATH}:/opt/ruby/bin:/opt/mastodon/bin" + +RUN apt-get update && \ + echo "Etc/UTC" > /etc/localtime && \ + groupadd -g "${GID}" mastodon && \ + useradd -u "$UID" -g "${GID}" -m -d /opt/mastodon mastodon && \ + apt-get -y --no-install-recommends install whois \ + wget \ + libssl1.1 \ + libpq5 \ + imagemagick \ + ffmpeg \ + libjemalloc2 \ + libicu67 \ + libidn11 \ + libyaml-0-2 \ + file \ + ca-certificates \ + tzdata \ + libreadline8 \ + tini && \ + ln -s /opt/mastodon /mastodon + +# Note: no, cleaning here since Debian does this automatically +# See the file /etc/apt/apt.conf.d/docker-clean within the Docker image's filesystem + +COPY --chown=mastodon:mastodon . /opt/mastodon +COPY --chown=mastodon:mastodon --from=build /opt/mastodon /opt/mastodon + +ENV RAILS_ENV="production" \ + NODE_ENV="production" \ + RAILS_SERVE_STATIC_FILES="true" \ + BIND="0.0.0.0" + +# Set the run user +USER mastodon +WORKDIR /opt/mastodon + +# Precompile assets +RUN OTP_SECRET=precompile_placeholder SECRET_KEY_BASE=precompile_placeholder rails assets:precompile && \ + yarn cache clean + +# Set the work dir and the container entry point +ENTRYPOINT ["/usr/bin/tini", "--"] +EXPOSE 3000 4000 diff --git a/files/docker-compose.yml b/files/docker-compose.yml index c1c4e5a..c534286 100644 --- a/files/docker-compose.yml +++ b/files/docker-compose.yml @@ -1,6 +1,5 @@ version: '3' services: - db: restart: always image: postgres:14-alpine @@ -8,40 +7,52 @@ services: networks: - internal_network healthcheck: - test: ["CMD", "pg_isready", "-U", "postgres"] + test: ['CMD', 'pg_isready', '-U', 'postgres'] volumes: - ./postgres14:/var/lib/postgresql/data environment: - - "POSTGRES_HOST_AUTH_METHOD=trust" + - 'POSTGRES_HOST_AUTH_METHOD=trust' redis: restart: always - image: redis:6-alpine + image: redis:7-alpine networks: - internal_network healthcheck: - test: ["CMD", "redis-cli", "ping"] + test: ['CMD', 'redis-cli', 'ping'] volumes: - ./redis:/data -# es: -# restart: always -# image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2 -# environment: -# - "ES_JAVA_OPTS=-Xms512m -Xmx512m" -# - "cluster.name=es-mastodon" -# - "discovery.type=single-node" -# - "bootstrap.memory_lock=true" -# networks: -# - internal_network -# healthcheck: -# test: ["CMD-SHELL", "curl --silent --fail localhost:9200/_cluster/health || exit 1"] -# volumes: -# - ./elasticsearch:/usr/share/elasticsearch/data -# ulimits: -# memlock: -# soft: -1 -# hard: -1 + # es: + # restart: always + # image: docker.elastic.co/elasticsearch/elasticsearch:7.17.4 + # environment: + # - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Des.enforce.bootstrap.checks=true" + # - "xpack.license.self_generated.type=basic" + # - "xpack.security.enabled=false" + # - "xpack.watcher.enabled=false" + # - "xpack.graph.enabled=false" + # - "xpack.ml.enabled=false" + # - "bootstrap.memory_lock=true" + # - "cluster.name=es-mastodon" + # - "discovery.type=single-node" + # - "thread_pool.write.queue_size=1000" + # networks: + # - external_network + # - internal_network + # healthcheck: + # test: ["CMD-SHELL", "curl --silent --fail localhost:9200/_cluster/health || exit 1"] + # volumes: + # - ./elasticsearch:/usr/share/elasticsearch/data + # ulimits: + # memlock: + # soft: -1 + # hard: -1 + # nofile: + # soft: 65536 + # hard: 65536 + # ports: + # - '127.0.0.1:9200:9200' web: build: . @@ -53,13 +64,14 @@ services: - external_network - internal_network healthcheck: - test: ["CMD-SHELL", "wget -q --spider --proxy=off localhost:3000/health || exit 1"] + # prettier-ignore + test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:3000/health || exit 1'] ports: - - "127.0.0.1:3000:3000" + - '127.0.0.1:3000:3000' depends_on: - db - redis -# - es + # - es volumes: - ./public/system:/mastodon/public/system @@ -73,9 +85,10 @@ services: - external_network - internal_network healthcheck: - test: ["CMD-SHELL", "wget -q --spider --proxy=off localhost:4000/api/v1/streaming/health || exit 1"] + # prettier-ignore + test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:4000/api/v1/streaming/health || exit 1'] ports: - - "127.0.0.1:4000:4000" + - '127.0.0.1:4000:4000' depends_on: - db - redis @@ -94,22 +107,25 @@ services: - internal_network volumes: - ./public/system:/mastodon/public/system -## Uncomment to enable federation with tor instances along with adding the following ENV variables -## http_proxy=http://privoxy:8118 -## ALLOW_ACCESS_TO_HIDDEN_SERVICE=true -# tor: -# image: sirboops/tor -# networks: -# - external_network -# - internal_network -# -# privoxy: -# image: sirboops/privoxy -# volumes: -# - ./priv-config:/opt/config -# networks: -# - external_network -# - internal_network + healthcheck: + test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"] + + ## Uncomment to enable federation with tor instances along with adding the following ENV variables + ## http_proxy=http://privoxy:8118 + ## ALLOW_ACCESS_TO_HIDDEN_SERVICE=true + # tor: + # image: sirboops/tor + # networks: + # - external_network + # - internal_network + # + # privoxy: + # image: sirboops/privoxy + # volumes: + # - ./priv-config:/opt/config + # networks: + # - external_network + # - internal_network networks: external_network: diff --git a/tasks/docker/docker.yml b/tasks/docker/docker.yml index 96457f9..145768e 100644 --- a/tasks/docker/docker.yml +++ b/tasks/docker/docker.yml @@ -7,8 +7,8 @@ - name: Copy Dockerfile from Mastodon repo copy: - remote_src: true - src: /usr/src/mastodon/Dockerfile +# remote_src: true + src: files/Dockerfile dest: "{{ mastodon_composer_folder }}/Dockerfile" - name: Ensure mastodon folder exists