From 2001204e0bf194ebc47f4cb72e625aca698d7bfd Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Wed, 26 Aug 2026 22:13:40 +1000 Subject: [PATCH 1/3] Bake LDAP + SSO auth plugins into the image Phase-1 SSO/app-passwords for jellyfin needs the ldapauth and sso plugins present without relying on the in-app catalog (which the plugins-baked PVC would otherwise let drift). Pin the newest release of each whose targetAbi is <= the pinned server version (10.11.6) and let the image own the version. - Add a plugins build stage that downloads, sha256-verifies (matching each release's published .sha256), and unpacks the plugin zips into versioned dirs baked at /usr/share/jellyfin/plugins-baked. - LDAP Authentication 22.0.0.0 (targetAbi 10.11.2.0; v23 needs 10.11.9). - SSO Authentication 4.0.0.4 (targetAbi 10.11.0.0). - Add docker-entrypoint.sh that syncs baked plugin dirs into /config/plugins on every start, removing any stale versioned dir of the same plugin so the image controls the version across restarts; preserves plugin configurations. - Point ENTRYPOINT at the new script. --- Dockerfile.runtime | 39 +++++++++++++++++++++++++++++++++++---- docker-entrypoint.sh | 29 +++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+), 4 deletions(-) create mode 100644 docker-entrypoint.sh diff --git a/Dockerfile.runtime b/Dockerfile.runtime index c6eeb48..46e108c 100644 --- a/Dockerfile.runtime +++ b/Dockerfile.runtime @@ -21,6 +21,37 @@ RUN apt-get update \ && apt-get install -y --no-install-recommends "jellyfin-web=10.11.6+deb12" \ && rm -rf /var/lib/apt/lists/* +# ── Plugin stage ────────────────────────────────────────────────────────────── +# Download and verify the auth plugins, unpacked into versioned dirs baked into +# the image and synced into /config/plugins at start (docker-entrypoint.sh). +# Versions are the newest each plugin publishes whose targetAbi <= the pinned +# Jellyfin server version (10.11.6): +# LDAP Authentication 22.0.0.0 targetAbi 10.11.2.0 (v23 needs 10.11.9) +# SSO Authentication 4.0.0.4 targetAbi 10.11.0.0 +# sha256 pins match each release's published .sha256 asset for reproducibility. +FROM --platform=linux/amd64 debian:bookworm-slim AS plugins + +RUN apt-get update \ + && apt-get install -y --no-install-recommends curl ca-certificates unzip \ + && rm -rf /var/lib/apt/lists/* + +ARG LDAP_URL=https://repo.jellyfin.org/files/plugin/ldap-authentication/ldap-authentication_22.0.0.0.zip +ARG LDAP_SHA256=c2386c001be439c9946280a02d62610f29e325d4094e83bd31221de3f7aa20ae +ARG SSO_URL=https://github.com/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip +ARG SSO_SHA256=c09f16ba31059a434ddd7f811e4f9608d4b4c4514cc80a5bf1ca33bee61e1107 + +WORKDIR /plugins +RUN set -eu; \ + curl -fsSL "$LDAP_URL" -o ldap.zip; \ + echo "$LDAP_SHA256 ldap.zip" | sha256sum -c -; \ + mkdir -p "LDAP Authentication_22.0.0.0"; \ + unzip -oq ldap.zip -d "LDAP Authentication_22.0.0.0"; \ + curl -fsSL "$SSO_URL" -o sso.zip; \ + echo "$SSO_SHA256 sso.zip" | sha256sum -c -; \ + mkdir -p "SSO Authentication_4.0.0.4"; \ + unzip -oq sso.zip -d "SSO Authentication_4.0.0.4"; \ + rm -f ldap.zip sso.zip + # ── Runtime stage ───────────────────────────────────────────────────────────── # .NET 9 runtime: matches the SDK 9.0 publish step (framework-dependent), so the # app's required Microsoft.NETCore.App 9.0 is present. Keep in lockstep with the @@ -42,6 +73,9 @@ WORKDIR /jellyfin COPY publish-output/ . # jellyfin-web client assets from the webclient stage. COPY --from=webclient /usr/share/jellyfin/web ./jellyfin-web/ +# Baked auth plugins; docker-entrypoint.sh syncs these into /config/plugins. +COPY --from=plugins /plugins /usr/share/jellyfin/plugins-baked +COPY --chmod=0755 docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh # Jellyfin default ports EXPOSE 8096 @@ -54,7 +88,4 @@ ENV JELLYFIN_DATA_DIR=/config \ JELLYFIN_CACHE_DIR=/cache \ JELLYFIN_LOG_DIR=/config/log -ENTRYPOINT ["./jellyfin", \ - "--datadir", "/config", \ - "--cachedir", "/cache", \ - "--webdir", "/jellyfin/jellyfin-web"] +ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"] diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh new file mode 100644 index 0000000..8c7e85b --- /dev/null +++ b/docker-entrypoint.sh @@ -0,0 +1,29 @@ +#!/bin/sh +# Sync image-baked plugins into the /config (datadir) plugins directory on every +# start. /config is a PVC that overlays the image, so plugins baked into the +# image are invisible until copied in here. Removing any existing versioned dir +# of the same plugin first lets the image version win across restarts/downgrades. +set -eu + +BAKED_DIR=/usr/share/jellyfin/plugins-baked +PLUGIN_DIR=/config/plugins + +if [ -d "$BAKED_DIR" ]; then + mkdir -p "$PLUGIN_DIR" + for src in "$BAKED_DIR"/*; do + [ -d "$src" ] || continue + name=$(basename "$src") # e.g. "LDAP Authentication_22.0.0.0" + base=${name%_*} # plugin name without the trailing _ + for existing in "$PLUGIN_DIR/$base"_*; do + [ -e "$existing" ] && rm -rf "$existing" + done + rm -rf "$PLUGIN_DIR/$name" + cp -a "$src" "$PLUGIN_DIR/$name" + done +fi + +exec ./jellyfin \ + --datadir /config \ + --cachedir /cache \ + --webdir /jellyfin/jellyfin-web \ + "$@" From 72290bbacd71cd9be6cff9ed679fa0ee00a41d29 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Wed, 26 Aug 2026 23:28:56 +1000 Subject: [PATCH 2/3] fix(ci): pull SSO plugin via artifactapi github proxy The PR build failed at the plugins stage: the CI build network can reach artifactapi and package mirrors (repo.jellyfin.org) but not github.com directly, so the SSO plugin download from github failed (curl exit 7). Route the SSO fetch through the artifactapi github remote proxy instead; SSO_SHA256 still pins the exact bytes. LDAP is unchanged. --- Dockerfile.runtime | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Dockerfile.runtime b/Dockerfile.runtime index 46e108c..61b009c 100644 --- a/Dockerfile.runtime +++ b/Dockerfile.runtime @@ -37,7 +37,9 @@ RUN apt-get update \ ARG LDAP_URL=https://repo.jellyfin.org/files/plugin/ldap-authentication/ldap-authentication_22.0.0.0.zip ARG LDAP_SHA256=c2386c001be439c9946280a02d62610f29e325d4094e83bd31221de3f7aa20ae -ARG SSO_URL=https://github.com/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip +# SSO is served through the artifactapi github proxy, which the CI build network +# can reach (github is not directly reachable). SSO_SHA256 pins the exact bytes. +ARG SSO_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip ARG SSO_SHA256=c09f16ba31059a434ddd7f811e4f9608d4b4c4514cc80a5bf1ca33bee61e1107 WORKDIR /plugins From ac61265ea0420380b7b8eaebc5c65d7ac7f75176 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 29 Aug 2026 12:00:03 +1000 Subject: [PATCH 3/3] Route LDAP plugin through artifactapi remote for secure image builds. Replace direct repo.jellyfin.org download with artifactapi.k8s.syd1.au.unkin.net remote. SHA256 pin guarantees integrity over HTTP. Both plugins now consistent in sourcing from artifactapi infrastructure. --- Dockerfile.runtime | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Dockerfile.runtime b/Dockerfile.runtime index 61b009c..9abef84 100644 --- a/Dockerfile.runtime +++ b/Dockerfile.runtime @@ -35,10 +35,11 @@ RUN apt-get update \ && apt-get install -y --no-install-recommends curl ca-certificates unzip \ && rm -rf /var/lib/apt/lists/* -ARG LDAP_URL=https://repo.jellyfin.org/files/plugin/ldap-authentication/ldap-authentication_22.0.0.0.zip +ARG LDAP_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/jellyfin/files/plugin/ldap-authentication/ldap-authentication_22.0.0.0.zip ARG LDAP_SHA256=c2386c001be439c9946280a02d62610f29e325d4094e83bd31221de3f7aa20ae -# SSO is served through the artifactapi github proxy, which the CI build network -# can reach (github is not directly reachable). SSO_SHA256 pins the exact bytes. +# LDAP is served through artifactapi remote. SSO is served through the artifactapi +# github proxy, which the CI build network can reach (github is not directly reachable). +# SHA256 pins match each release's published asset for reproducibility and integrity. ARG SSO_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip ARG SSO_SHA256=c09f16ba31059a434ddd7f811e4f9608d4b4c4514cc80a5bf1ca33bee61e1107