Merge pull request 'Repin upstream source to jellyfin-ha-src main' (#15) from benvin/repin-ha-fixes into main

Reviewed-on: #15

.woodpecker/build.yaml

@@ -9,7 +9,7 @@ steps:
     commands:
       - |
         REF=$$(cat UPSTREAM_REF)
-        git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+        git clone https://git.unkin.net/unkin/jellyfin-ha-src.git src
         git -C src checkout "$$REF"
         dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
           -c Release -r linux-x64 --self-contained false -o ./publish-output
@@ -26,7 +26,7 @@ steps:
 
   # Validate the runtime image builds (no push on PRs).
   - name: docker-build
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
     settings:
       repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha
       dockerfile: Dockerfile.runtime

.woodpecker/docker.yaml

@@ -9,7 +9,7 @@ steps:
     commands:
       - |
         REF=$$(cat UPSTREAM_REF)
-        git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+        git clone https://git.unkin.net/unkin/jellyfin-ha-src.git src
         git -C src checkout "$$REF"
         dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
           -c Release -r linux-x64 --self-contained false -o ./publish-output
@@ -25,12 +25,20 @@ steps:
             cpu: 4
 
   # Build the runtime image and push it to the artifactapi local docker registry.
+  # The plugin image bakes artifactapi's internal (Vault) CA at
+  # /etc/docker/certs.d/<registry>/ca.crt; buildkit_config points the buildx
+  # docker-container builder at that in-image CA. buildkitd runs in its own
+  # container and performs the push, so it needs the CA via --config even though
+  # the plugin image already trusts it — buildx copies the referenced file in.
   - name: docker
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
     settings:
       registry: artifactapi.k8s.syd1.au.unkin.net
       repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha
       dockerfile: Dockerfile.runtime
+      buildkit_config: |
+        [registry."artifactapi.k8s.syd1.au.unkin.net"]
+          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
       tags:
         - ${CI_COMMIT_TAG}
         - latest

Dockerfile.runtime

@@ -18,10 +18,48 @@ RUN apt-get update \
  && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/jellyfin.gpg] https://repo.jellyfin.org/debian bookworm main" \
     > /etc/apt/sources.list.d/jellyfin.list \
  && apt-get update \
- && apt-get install -y --no-install-recommends "jellyfin-web=10.11.6+deb12" \
+ && apt-get install -y --no-install-recommends "jellyfin-web=12.0+deb12" \
  && rm -rf /var/lib/apt/lists/*
 
+# ── Plugin stage ──────────────────────────────────────────────────────────────
+# Download and verify the auth plugins, unpacked into versioned dirs baked into
+# the image and synced into /config/plugins at start (docker-entrypoint.sh).
+# Versions are the newest each plugin publishes whose targetAbi <= the pinned
+# Jellyfin server version (12.0.0):
+#   LDAP Authentication 24.0.0.0  targetAbi 12.0.0.0
+#   SSO Authentication  5.0.0.0   targetAbi 12.0.0.0
+# sha256 pins make each fetch reproducible.
+FROM --platform=linux/amd64 debian:bookworm-slim AS plugins
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl ca-certificates unzip \
+ && rm -rf /var/lib/apt/lists/*
+
+ARG LDAP_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/jellyfin/files/plugin/ldap-authentication/ldap-authentication_24.0.0.0.zip
+ARG LDAP_SHA256=3be1f9d6a6ce9ea375e556dd30136d178a8dbe35cbe866d30d3451dc3ff7e804
+# Both are served through artifactapi remotes over http: this stage's base image
+# trusts only public CAs and artifactapi presents an internal-CA certificate, so
+# https here fails to verify. The sha256 pins below supply the integrity guarantee.
+# SSO is the in-house unkin fork (valkey-backed OAuth state, shared across replicas).
+ARG SSO_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/jellyfin-plugins/files/unkin/jellyfin-plugin-sso/5.0.0.0/sso-authentication_5.0.0.0.zip
+ARG SSO_SHA256=7e5f09cc4c81dce35edca650d74ed0680f425ca65c6221bb75456de9b8557e14
+
+WORKDIR /plugins
+RUN set -eu; \
+    curl -fsSL "$LDAP_URL" -o ldap.zip; \
+    echo "$LDAP_SHA256  ldap.zip" | sha256sum -c -; \
+    mkdir -p "LDAP Authentication_24.0.0.0"; \
+    unzip -oq ldap.zip -d "LDAP Authentication_24.0.0.0"; \
+    curl -fsSL "$SSO_URL" -o sso.zip; \
+    echo "$SSO_SHA256  sso.zip" | sha256sum -c -; \
+    mkdir -p "SSO Authentication_5.0.0.0"; \
+    unzip -oq sso.zip -d "SSO Authentication_5.0.0.0"; \
+    rm -f ldap.zip sso.zip
+
 # ── Runtime stage ─────────────────────────────────────────────────────────────
+# .NET 10 runtime: matches the SDK 10.0 publish step (framework-dependent) and the
+# fork's net10.0 TFM, so the app's required Microsoft.NETCore.App 10.0 is present.
+# Keep in lockstep with the `mcr.microsoft.com/dotnet/sdk` major in .woodpecker/*.yaml.
 FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:10.0
 
 # FFmpeg and the native deps required by SkiaSharp and fontconfig.
@@ -39,6 +77,9 @@ WORKDIR /jellyfin
 COPY publish-output/ .
 # jellyfin-web client assets from the webclient stage.
 COPY --from=webclient /usr/share/jellyfin/web ./jellyfin-web/
+# Baked auth plugins; docker-entrypoint.sh syncs these into /config/plugins.
+COPY --from=plugins /plugins /usr/share/jellyfin/plugins-baked
+COPY --chmod=0755 docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 
 # Jellyfin default ports
 EXPOSE 8096
@@ -51,7 +92,4 @@ ENV JELLYFIN_DATA_DIR=/config \
     JELLYFIN_CACHE_DIR=/cache \
     JELLYFIN_LOG_DIR=/config/log
 
-ENTRYPOINT ["./jellyfin", \
-            "--datadir", "/config", \
-            "--cachedir", "/cache", \
-            "--webdir", "/jellyfin/jellyfin-web"]
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]

Makefile

@@ -8,7 +8,7 @@ REF     := $(shell cat UPSTREAM_REF)
 # ./publish-output (consumed by Dockerfile.runtime). Mirrors CI.
 publish:
 	rm -rf src publish-output
-	git clone https://github.com/ZoltyMat/jellyfin-ha.git src
+	git clone https://git.unkin.net/unkin/jellyfin-ha-src.git src
 	git -C src checkout $(REF)
 	dotnet publish src/Jellyfin.Server/Jellyfin.Server.csproj \
 		-c Release -r linux-x64 --self-contained false -o ./publish-output

UPSTREAM_REF

@@ -1 +1 @@
-d4f9c12c22d3a640f3b0a3622b23b8cd01d044ad
+6691b785c30715ec4561b00b7bd0fd112478d3e3

docker-entrypoint.sh

@@ -0,0 +1,68 @@
+#!/bin/sh
+# Sync image-baked plugins into the /config (datadir) plugins directory on
+# start. /config is an RWX volume shared across replicas, so plugins baked
+# into the image are invisible until copied in here -- and this must be safe
+# when several replicas start (or restart) at the same instant:
+#   - skip entirely once the correct version is already in place, so the
+#     steady state (almost every start) never touches the shared volume;
+#   - install a new/changed version via copy-to-staging + atomic rename, so
+#     no reader (another replica, or this container's own jellyfin process)
+#     ever observes a partially-written plugin directory. A replica that
+#     loses the rename race just discards its own copy -- that's success,
+#     not an error;
+#   - drop stale, differently-versioned copies of the same plugin afterwards
+#     so they don't shadow the current one. Best-effort: another replica may
+#     already be doing, or have finished, the same cleanup.
+# Deliberately no locking: a lock held by a replica that dies mid-sync would
+# wedge every future start on this volume, which is worse than the race it
+# would prevent.
+set -eu
+
+BAKED_DIR=/usr/share/jellyfin/plugins-baked
+PLUGIN_DIR=/config/plugins
+STAGING_DIR="$PLUGIN_DIR/.sync-tmp"
+REPLICA=$(hostname)
+
+if [ -d "$BAKED_DIR" ]; then
+  mkdir -p "$PLUGIN_DIR" "$STAGING_DIR"
+  for src in "$BAKED_DIR"/*; do
+    [ -d "$src" ] || continue
+    name=$(basename "$src")   # e.g. "LDAP Authentication_24.0.0.0"
+    base=${name%_*}           # plugin name without the trailing _<version>
+    target="$PLUGIN_DIR/$name"
+
+    if [ ! -d "$target" ]; then
+      # Build the new version privately (keyed by this replica's own
+      # hostname, so concurrent replicas never share a staging path), then
+      # move it into place in one atomic rename. mv -T fails with
+      # "Directory not empty" if another replica's rename already won --
+      # that's fine, our copy just becomes garbage we discard.
+      staging="$STAGING_DIR/$REPLICA.$name"
+      rm -rf "$staging"
+      cp -a "$src" "$staging"
+      if mv_err=$(mv -T "$staging" "$target" 2>&1); then
+        :
+      elif [ -d "$target" ]; then
+        rm -rf "$staging"
+      else
+        echo "docker-entrypoint: failed to install plugin $name: $mv_err" >&2
+        exit 1
+      fi
+    fi
+
+    # Remove any other version of this plugin so it can't shadow the one
+    # above. Another replica may be racing the same cleanup, or have already
+    # finished it -- an entry that's already gone is success, not an error.
+    for existing in "$PLUGIN_DIR/$base"_*; do
+      [ -e "$existing" ] || continue
+      [ "$existing" = "$target" ] && continue
+      rm -rf "$existing" 2>/dev/null || true
+    done
+  done
+fi
+
+exec ./jellyfin \
+  --datadir /config \
+  --cachedir /cache \
+  --webdir /jellyfin/jellyfin-web \
+  "$@"