Build Caddy v2.11.7 from source like tailcat, rclone and litestream, instead of Debian's 2.6.2, and drop the scenarios' 2.6 workarounds.
| 1/3 | Build a pinned Caddy 2.11 for the container | +24 | -6 | ✓ |
| 2/3 | Drop the scenarios' workarounds for Caddy 2.6 | +3 | -9 | ✓ |
| 3/3 | Keep no autosaved Caddy config in the container | +3 | -2 | ✓ |
revisions2
| r2 | cat | f1af132 | what changed since r1 | |
| r1 | cat | 7f7d40e |
No comments yet: forge comment 7 adds one.
1/3 Build a pinned Caddy 2.11 for the container
The container installed Debian trixie's Caddy, 2.6.2, from 2022, while the edge runs Alpine's 2.11. A Go stage now builds Caddy v2.11.7, the latest patch of the edge's line (the edge's Alpine 3.24 has 2.11.4), the way tailcat, rclone and litestream are built: CGO_ENABLED=0, go install at a pinned version, the source checked by the Go checksum database. It is built as Caddy builds its releases (-trimpath, -s -w), which keeps the binary at 53M instead of 76M, and with CustomVersion, since a build of Caddy's own module reports "unknown" otherwise. Without Debian's package, the Dockerfile makes what it made: the caddy system user (home /var/lib/caddy, no login shell), added to the git group as before, and /etc/caddy, where start.sh writes the Caddyfile. media-types stays, for /etc/mime.types: Go only knows a few content types itself. libnss3-tools, which the package pulled in for caddy trust, goes. start.sh, fcgiwrap and the generated Caddyfile are unchanged; caddy adapt takes the forge's Caddyfile without a warning. The image is about the same size: 447M of content, from 446M. README.md says which tools the Dockerfile builds and which Caddy, and test/container.sh no longer calls the container's Caddy Debian's.
| M | Dockerfile | 18 | +++++++++++++++++- |
| M | README.md | 4 | +++- |
| M | test/ | 8 | ++++---- |
@@ -17,21 +17,37 @@ RUN CGO_ENABLED=0 GOBIN=/out go install github.com/rclone/rclone@v1.75.2
1717 FROM golang:1.27.2 AS litestream1818 RUN CGO_ENABLED=0 GOBIN=/out go install github.com/benbjohnson/litestream/cmd/litestream@v0.5.171919 20+# Caddy serves pages, sites and HTTPS clones. Debian's is 2.6, from 2022, and21+# the edge runs 2.11 (Alpine's, deploy/edge), so build a pinned release of22+# the same line, checked the same way. Built as Caddy's own releases are23+# (trimmed paths, no symbol table: a third smaller); a build of Caddy's own24+# module can't read its version, so caddy version is told it (CustomVersion).25+FROM golang:1.27.2 AS caddy26+RUN v=v2.11.7 && CGO_ENABLED=0 GOBIN=/out go install -trimpath \27+ -ldflags "-s -w -X github.com/caddyserver/caddy/v2.CustomVersion=$v" \28+ github.com/caddyserver/caddy/v2/cmd/caddy@$v29+2030 # Node runs the TypeScript sources directly (type stripping). 24 is the LTS2131 # whose WebCrypto has ML-DSA (24.7 and later), so passkeys can be2232 # post-quantum; the forge itself needs 22.18 or later.2333 FROM node:24-trixie-slim2434 35+# Caddy gets the system user Debian's package would make, in the git group36+# to read pages and repos. media-types is /etc/mime.types, the content37+# types Caddy sends for files beyond the few Go knows itself.2538 RUN apt-get update \26- && apt-get install -y --no-install-recommends git openssh-server caddy ca-certificates tini fcgiwrap restic \39+ && apt-get install -y --no-install-recommends git openssh-server ca-certificates tini fcgiwrap restic media-types \2740 && rm -rf /var/lib/apt/lists/* \2841 && adduser --system --group --shell /bin/sh --home /srv/git git \42+ && adduser --system --group --shell /usr/sbin/nologin --home /var/lib/caddy --gecos 'Caddy web server' caddy \2943 && usermod -aG git caddy \44+ && mkdir -p /etc/caddy \3045 && rm -f /etc/ssh/ssh_host_*3146 3247 COPY --from=tailcat /out/tailcat /usr/local/bin/tailcat3348 COPY --from=rclone /out/rclone /usr/local/bin/rclone3449 COPY --from=litestream /out/litestream /usr/local/bin/litestream50+COPY --from=caddy /out/caddy /usr/local/bin/caddy3551 COPY server/container/sshd.conf /etc/ssh/sshd_config.d/forge.conf3652 3753 WORKDIR /opt/forge@@ -775,7 +775,9 @@ The forge is one container (`Dockerfile`, on Node 24 LTS): sshd for git,
775775 Caddy for pages, sites, and HTTPS clones (with fcgiwrap for `git776776 http-backend`), the events, private and pages servers, litestream, and777777 tailcat. `server/container/start.sh` starts them all. All state is in778-`/srv/git`, a volume.778+`/srv/git`, a volume. Caddy, rclone, litestream and tailcat are pinned779+releases the Dockerfile builds from source; the rest comes from Debian.780+Caddy is on the edge's line, 2.11, where Debian has 2.6.779781 780782 ### Home machine behind a public edge (how src.rest runs)781783 @@ -1,9 +1,9 @@
11 22 # Run the scenarios in the forge's container, as root, the way the forge3-# runs there: Debian's sh (dash), its git, Caddy, restic and litestream, a4-# git user to hand restores to, and no curl. This checkout's code runs with5-# the image's node_modules and DuckDB extensions, so only a change to the6-# Dockerfile or the packages needs a new image.3+# runs there: Debian's sh (dash) and git, the image's Caddy, restic and4+# litestream, a git user to hand restores to, and no curl. This checkout's5+# code runs with the image's node_modules and DuckDB extensions, so only a6+# change to the Dockerfile or the packages needs a new image.77 #88 # docker build -t forge:test . the image, once99 # sh test/container.sh every scenario2/3 Drop the scenarios' workarounds for Caddy 2.6
The container's Caddy is 2.11 now, like the edge's, so the workarounds 2f1c626 added for Debian's 2.6 go: private-web-caddy and private-web-clone run their Caddy with persist_config off again, so it saves no config anywhere, and release-caddy adapts deploy/edge/Caddyfile with whatever Caddy there is instead of skipping it below 2.7. All three are as they were before that commit.
| M | test/ | 2 | +- |
| M | test/ | 2 | +- |
| M | test/ | 8 | +------- |
@@ -29,7 +29,7 @@ ok caddy adapt --config "$T/Caddyfile" --adapter caddyfile
2929 cport=$(free_port)3030 private_server3131 {32- printf '{\n\tadmin off\n\tauto_https off\n}\n\n'32+ printf '{\n\tadmin off\n\tauto_https off\n\tpersist_config off\n}\n\n'3333 FORGE_PRIVATE_PORT=$PRIV_PORT "$FORGE" server caddyfile "http://127.0.0.1:$cport"3434 } >"$T/Caddyfile.run"3535 XDG_DATA_HOME=$T/xdg XDG_CONFIG_HOME=$T/xdg caddy run --config "$T/Caddyfile.run" --adapter caddyfile >"$T/caddy.log" 2>&1 &@@ -36,7 +36,7 @@ private_server
3636 node "$T_HOME/test/git-cgi.ts" "$gport" >"$T/cgi.log" 2>&1 &3737 T_PIDS="$T_PIDS $!"3838 {39- printf '{\n\tadmin off\n\tauto_https off\n}\n\n'39+ printf '{\n\tadmin off\n\tauto_https off\n\tpersist_config off\n}\n\n'4040 PATH="$T/bin:$PATH" FORGE_PRIVATE_PORT=$PRIV_PORT "$FORGE" server caddyfile "http://127.0.0.1:$cport"4141 } | awk -v up="127.0.0.1:$gport" '4242 /reverse_proxy unix\/\/run\/fcgiwrap\.socket/ { sub(/unix\/\/run\/fcgiwrap\.socket/, up); print; next }@@ -14,11 +14,5 @@ has "$e" 'not path_regexp \^/\[\^/\]\+/\[\^/\]\+/releases/download/\.$'
1414 has "$e" 'header @download Content-Disposition attachment'1515 if command -v caddy >/dev/null 2>&1; then1616 ok caddy adapt --config "$T/Caddyfile" --adapter caddyfile17- # The edge's Caddy is Alpine's (deploy/edge/Dockerfile), and newer than18- # Debian's 2.6 in the forge's container, which doesn't know the edge's19- # persist_config.20- case $(caddy version) in21- v2.[0-6].* | 2.[0-6].*) note "caddy $(caddy version | cut -d' ' -f1) is older than the edge's: skipped adapting deploy/edge/Caddyfile" ;;22- *) FORGE_DOMAIN=src.test FORGE_MIRROR_URL=https://mirror.test ok caddy adapt --config "$e" --adapter caddyfile ;;23- esac17+ FORGE_DOMAIN=src.test FORGE_MIRROR_URL=https://mirror.test ok caddy adapt --config "$e" --adapter caddyfile2418 fi3/3 Keep no autosaved Caddy config in the container
start.sh writes /etc/caddy/Caddyfile anew on every boot, and Caddy saved a copy of the adapted config each time (autosave.json under /var/lib/caddy/.config, in the container's layer), which nothing loads: admin is off and Caddy never runs with --resume. persist_config off, which Caddy 2.6 didn't have and the edge already sets, stops that.
| M | server/ | 5 | +++-- |
@@ -101,9 +101,10 @@ if [ -n "${FORGE_OWNER:-}" ] && [ -n "${FORGE_OWNER_KEY:-}" ] && ! grep -q "^$FO
101101 fi102102 as_git $forge keys sync103103 104-# TLS is terminated in front of us; Caddy serves plain HTTP on 8080.104+# TLS is terminated in front of us; Caddy serves plain HTTP on 8080. The105+# config is written anew on every boot, so Caddy keeps no copy of it.105106 {106- printf '{\n\tauto_https off\n\thttp_port 8080\n\tadmin off\n}\n\n'107+ printf '{\n\tauto_https off\n\thttp_port 8080\n\tadmin off\n\tpersist_config off\n}\n\n'107108 as_git $forge server caddyfile :8080 "$pages" "${pages:+http://$pages}"108109 } >/etc/caddy/Caddyfile109110