Merge pull request 'Bake LDAP + SSO auth plugins into the image' (#8) from benvin/auth-plugins into main

Reviewed-on: #8

.woodpecker/build.yaml

@@ -5,11 +5,11 @@ steps:
   # Clone the pinned upstream jellyfin-ha source and publish the .NET server
   # into ./publish-output (consumed by Dockerfile.runtime).
   - name: publish
-    image: mcr.microsoft.com/dotnet/sdk:10.0
+    image: mcr.microsoft.com/dotnet/sdk:9.0
     commands:
       - |
         REF=$$(cat UPSTREAM_REF)
-        git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+        git clone https://git.unkin.net/unkin/jellyfin-ha-src.git src
         git -C src checkout "$$REF"
         dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
           -c Release -r linux-x64 --self-contained false -o ./publish-output
@@ -28,7 +28,7 @@ steps:
   - name: docker-build
     image: woodpeckerci/plugin-docker-buildx
     settings:
-      repo: git.unkin.net/unkin/jellyfin-ha
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha
       dockerfile: Dockerfile.runtime
       dry_run: true
     depends_on: [publish]

.woodpecker/docker.yaml

@@ -5,11 +5,11 @@ when:
 steps:
   # Same publish step as the PR pipeline: clone pinned upstream + dotnet publish.
   - name: publish
-    image: mcr.microsoft.com/dotnet/sdk:10.0
+    image: mcr.microsoft.com/dotnet/sdk:9.0
     commands:
       - |
         REF=$$(cat UPSTREAM_REF)
-        git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+        git clone https://git.unkin.net/unkin/jellyfin-ha-src.git src
         git -C src checkout "$$REF"
         dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
           -c Release -r linux-x64 --self-contained false -o ./publish-output
@@ -24,16 +24,21 @@ steps:
             memory: 6Gi
             cpu: 4
 
-  # Build the runtime image and push it to the Gitea registry.
+  # Build the runtime image and push it to the artifactapi local docker registry.
+  # The plugin image bakes artifactapi's internal (Vault) CA at
+  # /etc/docker/certs.d/<registry>/ca.crt; buildkit_config points the buildx
+  # docker-container builder at that in-image CA. buildkitd runs in its own
+  # container and performs the push, so it needs the CA via --config even though
+  # the plugin image already trusts it — buildx copies the referenced file in.
   - name: docker
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
     settings:
-      registry: git.unkin.net
-      repo: git.unkin.net/unkin/jellyfin-ha
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha
       dockerfile: Dockerfile.runtime
-      username: droneci
-      password:
-        from_secret: DRONECI_PASSWORD
+      buildkit_config: |
+        [registry."artifactapi.k8s.syd1.au.unkin.net"]
+          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
       tags:
         - ${CI_COMMIT_TAG}
         - latest

Dockerfile.runtime

@@ -21,8 +21,45 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends "jellyfin-web=10.11.6+deb12" \
  && rm -rf /var/lib/apt/lists/*
 
+# ── Plugin stage ──────────────────────────────────────────────────────────────
+# Download and verify the auth plugins, unpacked into versioned dirs baked into
+# the image and synced into /config/plugins at start (docker-entrypoint.sh).
+# Versions are the newest each plugin publishes whose targetAbi <= the pinned
+# Jellyfin server version (10.11.6):
+#   LDAP Authentication 22.0.0.0  targetAbi 10.11.2.0  (v23 needs 10.11.9)
+#   SSO Authentication  4.0.0.4   targetAbi 10.11.0.0
+# sha256 pins match each release's published .sha256 asset for reproducibility.
+FROM --platform=linux/amd64 debian:bookworm-slim AS plugins
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl ca-certificates unzip \
+ && rm -rf /var/lib/apt/lists/*
+
+ARG LDAP_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/jellyfin/files/plugin/ldap-authentication/ldap-authentication_22.0.0.0.zip
+ARG LDAP_SHA256=c2386c001be439c9946280a02d62610f29e325d4094e83bd31221de3f7aa20ae
+# LDAP is served through artifactapi remote. SSO is served through the artifactapi
+# github proxy, which the CI build network can reach (github is not directly reachable).
+# SHA256 pins match each release's published asset for reproducibility and integrity.
+ARG SSO_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip
+ARG SSO_SHA256=c09f16ba31059a434ddd7f811e4f9608d4b4c4514cc80a5bf1ca33bee61e1107
+
+WORKDIR /plugins
+RUN set -eu; \
+    curl -fsSL "$LDAP_URL" -o ldap.zip; \
+    echo "$LDAP_SHA256  ldap.zip" | sha256sum -c -; \
+    mkdir -p "LDAP Authentication_22.0.0.0"; \
+    unzip -oq ldap.zip -d "LDAP Authentication_22.0.0.0"; \
+    curl -fsSL "$SSO_URL" -o sso.zip; \
+    echo "$SSO_SHA256  sso.zip" | sha256sum -c -; \
+    mkdir -p "SSO Authentication_4.0.0.4"; \
+    unzip -oq sso.zip -d "SSO Authentication_4.0.0.4"; \
+    rm -f ldap.zip sso.zip
+
 # ── Runtime stage ─────────────────────────────────────────────────────────────
-FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:10.0
+# .NET 9 runtime: matches the SDK 9.0 publish step (framework-dependent), so the
+# app's required Microsoft.NETCore.App 9.0 is present. Keep in lockstep with the
+# `mcr.microsoft.com/dotnet/sdk` major in .woodpecker/*.yaml and the Makefile.
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:9.0
 
 # FFmpeg and the native deps required by SkiaSharp and fontconfig.
 RUN apt-get update \
@@ -39,6 +76,9 @@ WORKDIR /jellyfin
 COPY publish-output/ .
 # jellyfin-web client assets from the webclient stage.
 COPY --from=webclient /usr/share/jellyfin/web ./jellyfin-web/
+# Baked auth plugins; docker-entrypoint.sh syncs these into /config/plugins.
+COPY --from=plugins /plugins /usr/share/jellyfin/plugins-baked
+COPY --chmod=0755 docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 
 # Jellyfin default ports
 EXPOSE 8096
@@ -51,7 +91,4 @@ ENV JELLYFIN_DATA_DIR=/config \
     JELLYFIN_CACHE_DIR=/cache \
     JELLYFIN_LOG_DIR=/config/log
 
-ENTRYPOINT ["./jellyfin", \
-            "--datadir", "/config", \
-            "--cachedir", "/cache", \
-            "--webdir", "/jellyfin/jellyfin-web"]
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]

Makefile

@@ -1,6 +1,6 @@
 .PHONY: publish build clean patch minor major
 
-IMAGE   ?= git.unkin.net/unkin/jellyfin-ha
+IMAGE   ?= artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "0.0.0-dev")
 REF     := $(shell cat UPSTREAM_REF)
 
@@ -8,7 +8,7 @@ REF     := $(shell cat UPSTREAM_REF)
 # ./publish-output (consumed by Dockerfile.runtime). Mirrors CI.
 publish:
 	rm -rf src publish-output
-	git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+	git clone https://git.unkin.net/unkin/jellyfin-ha-src.git src
 	git -C src checkout $(REF)
 	dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
 		-c Release -r linux-x64 --self-contained false -o ./publish-output

README.md

@@ -4,12 +4,12 @@ Build-orchestration repo for [ZoltyMat/jellyfin-ha](https://github.com/ZoltyMat/
 that adds distributed, Redis-backed transcoding for multi-pod Kubernetes (lease-aware cleanup, HA session
 takeover, optional PostgreSQL).
 
-This repo does **not** vendor the fork's source. It pins an upstream commit, builds the .NET 10 server, and
+This repo does **not** vendor the fork's source. It pins an upstream commit, builds the .NET 9 server, and
 produces a runtime container image pushed to the Gitea registry.
 
 ## What it produces
 
-`git.unkin.net/unkin/jellyfin-ha:<tag>` — an `mcr.microsoft.com/dotnet/aspnet:10.0` based image with ffmpeg and
+`artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:<tag>` — an `mcr.microsoft.com/dotnet/aspnet:9.0` based image with ffmpeg and
 the prebuilt `jellyfin-web` client, running the published `jellyfin-ha` server.
 
 ## Layout
@@ -26,7 +26,7 @@ the prebuilt `jellyfin-web` client, running the published `jellyfin-ha` server.
 
 1. To track a newer upstream, update `UPSTREAM_REF` to the desired commit SHA and merge via PR.
 2. Cut a release: `make patch` (or `minor` / `major`) tags `vX.Y.Z` and pushes it, which triggers
-   `.woodpecker/docker.yaml` to build and push `git.unkin.net/unkin/jellyfin-ha:vX.Y.Z` + `:latest`.
+   `.woodpecker/docker.yaml` to build and push `artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:vX.Y.Z` + `:latest`.
 
 ## Local build
 
@@ -34,7 +34,7 @@ the prebuilt `jellyfin-web` client, running the published `jellyfin-ha` server.
 make build            # clones pinned upstream, dotnet publish, docker build
 ```
 
-Requires the .NET 10 SDK and Docker. `make publish` runs just the clone + publish into `./publish-output`.
+Requires the .NET 9 SDK and Docker. `make publish` runs just the clone + publish into `./publish-output`.
 
 ## Deployment
 

UPSTREAM_REF

@@ -1 +1 @@
-d4f9c12c22d3a640f3b0a3622b23b8cd01d044ad
+2e1e445e470c2f2c1520f66678a73faa226c2058

docker-entrypoint.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+# Sync image-baked plugins into the /config (datadir) plugins directory on every
+# start. /config is a PVC that overlays the image, so plugins baked into the
+# image are invisible until copied in here. Removing any existing versioned dir
+# of the same plugin first lets the image version win across restarts/downgrades.
+set -eu
+
+BAKED_DIR=/usr/share/jellyfin/plugins-baked
+PLUGIN_DIR=/config/plugins
+
+if [ -d "$BAKED_DIR" ]; then
+  mkdir -p "$PLUGIN_DIR"
+  for src in "$BAKED_DIR"/*; do
+    [ -d "$src" ] || continue
+    name=$(basename "$src")   # e.g. "LDAP Authentication_22.0.0.0"
+    base=${name%_*}           # plugin name without the trailing _<version>
+    for existing in "$PLUGIN_DIR/$base"_*; do
+      [ -e "$existing" ] && rm -rf "$existing"
+    done
+    rm -rf "$PLUGIN_DIR/$name"
+    cp -a "$src" "$PLUGIN_DIR/$name"
+  done
+fi
+
+exec ./jellyfin \
+  --datadir /config \
+  --cachedir /cache \
+  --webdir /jellyfin/jellyfin-web \
+  "$@"