Containerfile

# --------------------------------------------------------------------------
# THIS FILE IS AUTOGENERATED - DO NOT EDIT MANUALLY
#
# Source: Containerfile.j2
# --------------------------------------------------------------------------

# reverse-proxy: daemonless appliance, one container on base-rcd. Two units:
# custom Caddy (DNS modules compiled in) runs as root to bind 80/443; the
# admin (Go, embedded UI) runs as bsd and drives Caddy over unix sockets in
# /var/run/reverse-proxy.
ARG BASE_VERSION=15.1
ARG FREEBSD_ARCH=amd64

FROM ghcr.io/daemonless/base:${BASE_VERSION} AS caddy-build
# Empty: the latest Caddy release, read from GitHub's releases/latest
# redirect (the API rate-limits shared CI runners). Set it to pin one.
ARG CADDY_VERSION=
RUN pkg update && pkg install -y go xcaddy git ca_root_nss && pkg clean -ay && rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
# Stock Caddy has no DNS-challenge modules. duckdns is pinned to a release;
# it has no license file (asked upstream), but it is in Caddy's own caddy-dns
# org and caddyserver.com ships it in custom builds.
RUN v="${CADDY_VERSION:-$(fetch -v -o /dev/null https://github.com/caddyserver/caddy/releases/latest 2>&1 | grep -o 'releases/tag/v[^ ]*' | head -1 | cut -d/ -f3)}" && \
    test -n "$v" && \
    GOFLAGS=-buildvcs=false xcaddy build "$v" \
      --with github.com/caddy-dns/cloudflare \
      --with github.com/caddy-dns/route53 \
      --with github.com/caddy-dns/desec \
      --with github.com/caddy-dns/porkbun \
      --with github.com/caddy-dns/hetzner \
      --with github.com/caddy-dns/ovh \
      --with github.com/caddy-dns/gandi \
      --with github.com/caddy-dns/rfc2136 \
      --with github.com/caddy-dns/acmedns \
      --with github.com/caddy-dns/duckdns@v0.5.0 \
      --output /out/caddy && \
    /out/caddy version

FROM ghcr.io/daemonless/base:${BASE_VERSION} AS ui-amd64
RUN pkg update && pkg install -y node24 npm-node24 && pkg clean -ay && rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
COPY admin/ui/package.json admin/ui/package-lock.json /src/ui/
RUN cd /src/ui && npm ci --no-fund --no-audit
COPY admin/ui/ /src/ui/
RUN cd /src/ui && npm run build && /src/ui/source-hash > /src/ui/source.sha256

# The UI's build tools (rolldown, tailwind, lightningcss) have no FreeBSD
# arm64 binaries, and the UI is the same on every arch: take it from the
# amd64 image, which CI publishes before the arm64 build starts. The source
# hash stops an older amd64 image's UI from shipping here.
FROM ghcr.io/daemonless/base:${BASE_VERSION} AS ui-aarch64
COPY admin/ui/ /src/ui/
COPY --from=ghcr.io/daemonless/reverse-proxy:latest-amd64 /usr/local/share/reverse-proxy/ui/ /src/ui/dist/
COPY --from=ghcr.io/daemonless/reverse-proxy:latest-amd64 /usr/local/share/reverse-proxy/ui-source.sha256 /src/ui/amd64.sha256
RUN h="$(/src/ui/source-hash)" && \
    { [ "$h" = "$(cat /src/ui/amd64.sha256)" ] || { echo "latest-amd64 has a different UI than this commit: build amd64 first" >&2; exit 1; }; } && \
    cp /src/ui/amd64.sha256 /src/ui/source.sha256

FROM ui-${FREEBSD_ARCH} AS ui-build

FROM ghcr.io/daemonless/base:${BASE_VERSION} AS admin-build
ARG APP_VER=0.2.0
RUN pkg update && pkg install -y go && pkg clean -ay && rm -rf /var/cache/pkg/* /var/db/pkg/repos/*
COPY admin/ /src/
COPY --from=ui-build /src/ui/dist/ /src/ui/dist/
RUN cd /src && CGO_ENABLED=0 go build -trimpath \
      -ldflags "-s -w -X main.version=${APP_VER}" \
      -o /out/reverse-proxy ./cmd/reverse-proxy

FROM ghcr.io/daemonless/base-rcd:${BASE_VERSION}
ARG APP_VER=0.2.0
ARG FREEBSD_ARCH=amd64
ARG PACKAGES="ca_root_nss"

LABEL org.opencontainers.image.title="Daemonless Reverse Proxy" \
      org.opencontainers.image.description="Friendly HTTPS names for the services on your network: a managed Caddy reverse proxy with a web UI, secure by default." \
      org.opencontainers.image.source="https://github.com/daemonless/reverse-proxy" \
      org.opencontainers.image.url="https://daemonless.io/images/reverse-proxy/" \
      org.opencontainers.image.licenses="BSD-2-Clause" \
      org.opencontainers.image.vendor="daemonless" \
      org.opencontainers.image.authors="daemonless" \
      io.daemonless.category="Network" \
      io.daemonless.port="8443" \
      io.daemonless.volumes="/config,/data" \
      io.daemonless.healthcheck-url="https://localhost:8443/healthz" \
      io.daemonless.arch="${FREEBSD_ARCH}" \
      io.daemonless.packages="${PACKAGES}"

RUN pkg update && \
    pkg install -y ${PACKAGES} && \
    pkg clean -ay && \
    rm -rf /var/cache/pkg/* /var/db/pkg/repos/*

COPY --from=caddy-build /out/caddy /usr/local/bin/caddy
COPY --from=admin-build /out/reverse-proxy /usr/local/bin/reverse-proxy
# Embedded in the binary; kept as files for the arm64 build (above).
COPY --from=ui-build /src/ui/dist/ /usr/local/share/reverse-proxy/ui/
COPY --from=ui-build /src/ui/source.sha256 /usr/local/share/reverse-proxy/ui-source.sha256
RUN mkdir -p /app /config /data && echo "${APP_VER}" > /app/version

COPY root/ /

RUN chmod +x /healthz /daemonless/init.d/* /daemonless/libexec/*

EXPOSE 80 443 8443

VOLUME ["/config", "/data"]