unkin-agent
2001204e0b
ci/woodpecker/pr/build Pipeline failed
Phase-1 SSO/app-passwords for jellyfin needs the ldapauth and sso plugins present without relying on the in-app catalog (which the plugins-baked PVC would otherwise let drift). Pin the newest release of each whose targetAbi is <= the pinned server version (10.11.6) and let the image own the version. - Add a plugins build stage that downloads, sha256-verifies (matching each release's published .sha256), and unpacks the plugin zips into versioned dirs baked at /usr/share/jellyfin/plugins-baked. - LDAP Authentication 22.0.0.0 (targetAbi 10.11.2.0; v23 needs 10.11.9). - SSO Authentication 4.0.0.4 (targetAbi 10.11.0.0). - Add docker-entrypoint.sh that syncs baked plugin dirs into /config/plugins on every start, removing any stale versioned dir of the same plugin so the image controls the version across restarts; preserves plugin configurations. - Point ENTRYPOINT at the new script.
92 lines
4.4 KiB
Docker
92 lines
4.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Runtime-only image for the jellyfin-ha fork.
|
|
#
|
|
# The .NET publish step runs on the CI host (see .woodpecker/*.yaml) and drops
|
|
# its output into ./publish-output, which is COPYed in below. This file is a
|
|
# vendored copy of upstream's Dockerfile.runtime so we control the pinned
|
|
# jellyfin-web version and base image; bump alongside UPSTREAM_REF.
|
|
|
|
# ── Web client stage ──────────────────────────────────────────────────────────
|
|
# Install jellyfin-web via the official Jellyfin apt repo (prebuilt, no npm).
|
|
# Web assets land at /usr/share/jellyfin/web/.
|
|
FROM --platform=linux/amd64 debian:bookworm-slim AS webclient
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl gnupg ca-certificates \
|
|
&& curl -fsSL https://repo.jellyfin.org/jellyfin_team.gpg.key \
|
|
| gpg --dearmor -o /usr/share/keyrings/jellyfin.gpg \
|
|
&& echo "deb [arch=amd64 signed-by=/usr/share/keyrings/jellyfin.gpg] https://repo.jellyfin.org/debian bookworm main" \
|
|
> /etc/apt/sources.list.d/jellyfin.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends "jellyfin-web=10.11.6+deb12" \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# ── Plugin stage ──────────────────────────────────────────────────────────────
|
|
# Download and verify the auth plugins, unpacked into versioned dirs baked into
|
|
# the image and synced into /config/plugins at start (docker-entrypoint.sh).
|
|
# Versions are the newest each plugin publishes whose targetAbi <= the pinned
|
|
# Jellyfin server version (10.11.6):
|
|
# LDAP Authentication 22.0.0.0 targetAbi 10.11.2.0 (v23 needs 10.11.9)
|
|
# SSO Authentication 4.0.0.4 targetAbi 10.11.0.0
|
|
# sha256 pins match each release's published .sha256 asset for reproducibility.
|
|
FROM --platform=linux/amd64 debian:bookworm-slim AS plugins
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl ca-certificates unzip \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ARG LDAP_URL=https://repo.jellyfin.org/files/plugin/ldap-authentication/ldap-authentication_22.0.0.0.zip
|
|
ARG LDAP_SHA256=c2386c001be439c9946280a02d62610f29e325d4094e83bd31221de3f7aa20ae
|
|
ARG SSO_URL=https://github.com/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip
|
|
ARG SSO_SHA256=c09f16ba31059a434ddd7f811e4f9608d4b4c4514cc80a5bf1ca33bee61e1107
|
|
|
|
WORKDIR /plugins
|
|
RUN set -eu; \
|
|
curl -fsSL "$LDAP_URL" -o ldap.zip; \
|
|
echo "$LDAP_SHA256 ldap.zip" | sha256sum -c -; \
|
|
mkdir -p "LDAP Authentication_22.0.0.0"; \
|
|
unzip -oq ldap.zip -d "LDAP Authentication_22.0.0.0"; \
|
|
curl -fsSL "$SSO_URL" -o sso.zip; \
|
|
echo "$SSO_SHA256 sso.zip" | sha256sum -c -; \
|
|
mkdir -p "SSO Authentication_4.0.0.4"; \
|
|
unzip -oq sso.zip -d "SSO Authentication_4.0.0.4"; \
|
|
rm -f ldap.zip sso.zip
|
|
|
|
# ── Runtime stage ─────────────────────────────────────────────────────────────
|
|
# .NET 9 runtime: matches the SDK 9.0 publish step (framework-dependent), so the
|
|
# app's required Microsoft.NETCore.App 9.0 is present. Keep in lockstep with the
|
|
# `mcr.microsoft.com/dotnet/sdk` major in .woodpecker/*.yaml and the Makefile.
|
|
FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:9.0
|
|
|
|
# FFmpeg and the native deps required by SkiaSharp and fontconfig.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ffmpeg \
|
|
fontconfig \
|
|
libfontconfig1 \
|
|
libfreetype6 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /jellyfin
|
|
|
|
# Pre-built publish output produced by `dotnet publish` on the CI host.
|
|
COPY publish-output/ .
|
|
# jellyfin-web client assets from the webclient stage.
|
|
COPY --from=webclient /usr/share/jellyfin/web ./jellyfin-web/
|
|
# Baked auth plugins; docker-entrypoint.sh syncs these into /config/plugins.
|
|
COPY --from=plugins /plugins /usr/share/jellyfin/plugins-baked
|
|
COPY --chmod=0755 docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
|
|
# Jellyfin default ports
|
|
EXPOSE 8096
|
|
EXPOSE 8920
|
|
|
|
# Data / config volumes
|
|
VOLUME ["/config", "/cache", "/media"]
|
|
|
|
ENV JELLYFIN_DATA_DIR=/config \
|
|
JELLYFIN_CACHE_DIR=/cache \
|
|
JELLYFIN_LOG_DIR=/config/log
|
|
|
|
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|