unkin-agent
ac61265ea0
ci/woodpecker/pr/build Pipeline was successful
Replace direct repo.jellyfin.org download with artifactapi.k8s.syd1.au.unkin.net remote. SHA256 pin guarantees integrity over HTTP. Both plugins now consistent in sourcing from artifactapi infrastructure.
95 lines
4.7 KiB
Docker
95 lines
4.7 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Runtime-only image for the jellyfin-ha fork.
|
|
#
|
|
# The .NET publish step runs on the CI host (see .woodpecker/*.yaml) and drops
|
|
# its output into ./publish-output, which is COPYed in below. This file is a
|
|
# vendored copy of upstream's Dockerfile.runtime so we control the pinned
|
|
# jellyfin-web version and base image; bump alongside UPSTREAM_REF.
|
|
|
|
# ── Web client stage ──────────────────────────────────────────────────────────
|
|
# Install jellyfin-web via the official Jellyfin apt repo (prebuilt, no npm).
|
|
# Web assets land at /usr/share/jellyfin/web/.
|
|
FROM --platform=linux/amd64 debian:bookworm-slim AS webclient
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl gnupg ca-certificates \
|
|
&& curl -fsSL https://repo.jellyfin.org/jellyfin_team.gpg.key \
|
|
| gpg --dearmor -o /usr/share/keyrings/jellyfin.gpg \
|
|
&& echo "deb [arch=amd64 signed-by=/usr/share/keyrings/jellyfin.gpg] https://repo.jellyfin.org/debian bookworm main" \
|
|
> /etc/apt/sources.list.d/jellyfin.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends "jellyfin-web=10.11.6+deb12" \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# ── Plugin stage ──────────────────────────────────────────────────────────────
|
|
# Download and verify the auth plugins, unpacked into versioned dirs baked into
|
|
# the image and synced into /config/plugins at start (docker-entrypoint.sh).
|
|
# Versions are the newest each plugin publishes whose targetAbi <= the pinned
|
|
# Jellyfin server version (10.11.6):
|
|
# LDAP Authentication 22.0.0.0 targetAbi 10.11.2.0 (v23 needs 10.11.9)
|
|
# SSO Authentication 4.0.0.4 targetAbi 10.11.0.0
|
|
# sha256 pins match each release's published .sha256 asset for reproducibility.
|
|
FROM --platform=linux/amd64 debian:bookworm-slim AS plugins
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl ca-certificates unzip \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ARG LDAP_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/jellyfin/files/plugin/ldap-authentication/ldap-authentication_22.0.0.0.zip
|
|
ARG LDAP_SHA256=c2386c001be439c9946280a02d62610f29e325d4094e83bd31221de3f7aa20ae
|
|
# LDAP is served through artifactapi remote. SSO is served through the artifactapi
|
|
# github proxy, which the CI build network can reach (github is not directly reachable).
|
|
# SHA256 pins match each release's published asset for reproducibility and integrity.
|
|
ARG SSO_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip
|
|
ARG SSO_SHA256=c09f16ba31059a434ddd7f811e4f9608d4b4c4514cc80a5bf1ca33bee61e1107
|
|
|
|
WORKDIR /plugins
|
|
RUN set -eu; \
|
|
curl -fsSL "$LDAP_URL" -o ldap.zip; \
|
|
echo "$LDAP_SHA256 ldap.zip" | sha256sum -c -; \
|
|
mkdir -p "LDAP Authentication_22.0.0.0"; \
|
|
unzip -oq ldap.zip -d "LDAP Authentication_22.0.0.0"; \
|
|
curl -fsSL "$SSO_URL" -o sso.zip; \
|
|
echo "$SSO_SHA256 sso.zip" | sha256sum -c -; \
|
|
mkdir -p "SSO Authentication_4.0.0.4"; \
|
|
unzip -oq sso.zip -d "SSO Authentication_4.0.0.4"; \
|
|
rm -f ldap.zip sso.zip
|
|
|
|
# ── Runtime stage ─────────────────────────────────────────────────────────────
|
|
# .NET 9 runtime: matches the SDK 9.0 publish step (framework-dependent), so the
|
|
# app's required Microsoft.NETCore.App 9.0 is present. Keep in lockstep with the
|
|
# `mcr.microsoft.com/dotnet/sdk` major in .woodpecker/*.yaml and the Makefile.
|
|
FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:9.0
|
|
|
|
# FFmpeg and the native deps required by SkiaSharp and fontconfig.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ffmpeg \
|
|
fontconfig \
|
|
libfontconfig1 \
|
|
libfreetype6 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /jellyfin
|
|
|
|
# Pre-built publish output produced by `dotnet publish` on the CI host.
|
|
COPY publish-output/ .
|
|
# jellyfin-web client assets from the webclient stage.
|
|
COPY --from=webclient /usr/share/jellyfin/web ./jellyfin-web/
|
|
# Baked auth plugins; docker-entrypoint.sh syncs these into /config/plugins.
|
|
COPY --from=plugins /plugins /usr/share/jellyfin/plugins-baked
|
|
COPY --chmod=0755 docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
|
|
# Jellyfin default ports
|
|
EXPOSE 8096
|
|
EXPOSE 8920
|
|
|
|
# Data / config volumes
|
|
VOLUME ["/config", "/cache", "/media"]
|
|
|
|
ENV JELLYFIN_DATA_DIR=/config \
|
|
JELLYFIN_CACHE_DIR=/cache \
|
|
JELLYFIN_LOG_DIR=/config/log
|
|
|
|
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|