unkin-agent
72290bbacd
ci/woodpecker/pr/build Pipeline failed
The PR build failed at the plugins stage: the CI build network can reach artifactapi and package mirrors (repo.jellyfin.org) but not github.com directly, so the SSO plugin download from github failed (curl exit 7). Route the SSO fetch through the artifactapi github remote proxy instead; SSO_SHA256 still pins the exact bytes. LDAP is unchanged.
94 lines
4.6 KiB
Docker
94 lines
4.6 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Runtime-only image for the jellyfin-ha fork.
|
|
#
|
|
# The .NET publish step runs on the CI host (see .woodpecker/*.yaml) and drops
|
|
# its output into ./publish-output, which is COPYed in below. This file is a
|
|
# vendored copy of upstream's Dockerfile.runtime so we control the pinned
|
|
# jellyfin-web version and base image; bump alongside UPSTREAM_REF.
|
|
|
|
# ── Web client stage ──────────────────────────────────────────────────────────
|
|
# Install jellyfin-web via the official Jellyfin apt repo (prebuilt, no npm).
|
|
# Web assets land at /usr/share/jellyfin/web/.
|
|
FROM --platform=linux/amd64 debian:bookworm-slim AS webclient
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl gnupg ca-certificates \
|
|
&& curl -fsSL https://repo.jellyfin.org/jellyfin_team.gpg.key \
|
|
| gpg --dearmor -o /usr/share/keyrings/jellyfin.gpg \
|
|
&& echo "deb [arch=amd64 signed-by=/usr/share/keyrings/jellyfin.gpg] https://repo.jellyfin.org/debian bookworm main" \
|
|
> /etc/apt/sources.list.d/jellyfin.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends "jellyfin-web=10.11.6+deb12" \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# ── Plugin stage ──────────────────────────────────────────────────────────────
|
|
# Download and verify the auth plugins, unpacked into versioned dirs baked into
|
|
# the image and synced into /config/plugins at start (docker-entrypoint.sh).
|
|
# Versions are the newest each plugin publishes whose targetAbi <= the pinned
|
|
# Jellyfin server version (10.11.6):
|
|
# LDAP Authentication 22.0.0.0 targetAbi 10.11.2.0 (v23 needs 10.11.9)
|
|
# SSO Authentication 4.0.0.4 targetAbi 10.11.0.0
|
|
# sha256 pins match each release's published .sha256 asset for reproducibility.
|
|
FROM --platform=linux/amd64 debian:bookworm-slim AS plugins
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl ca-certificates unzip \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ARG LDAP_URL=https://repo.jellyfin.org/files/plugin/ldap-authentication/ldap-authentication_22.0.0.0.zip
|
|
ARG LDAP_SHA256=c2386c001be439c9946280a02d62610f29e325d4094e83bd31221de3f7aa20ae
|
|
# SSO is served through the artifactapi github proxy, which the CI build network
|
|
# can reach (github is not directly reachable). SSO_SHA256 pins the exact bytes.
|
|
ARG SSO_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip
|
|
ARG SSO_SHA256=c09f16ba31059a434ddd7f811e4f9608d4b4c4514cc80a5bf1ca33bee61e1107
|
|
|
|
WORKDIR /plugins
|
|
RUN set -eu; \
|
|
curl -fsSL "$LDAP_URL" -o ldap.zip; \
|
|
echo "$LDAP_SHA256 ldap.zip" | sha256sum -c -; \
|
|
mkdir -p "LDAP Authentication_22.0.0.0"; \
|
|
unzip -oq ldap.zip -d "LDAP Authentication_22.0.0.0"; \
|
|
curl -fsSL "$SSO_URL" -o sso.zip; \
|
|
echo "$SSO_SHA256 sso.zip" | sha256sum -c -; \
|
|
mkdir -p "SSO Authentication_4.0.0.4"; \
|
|
unzip -oq sso.zip -d "SSO Authentication_4.0.0.4"; \
|
|
rm -f ldap.zip sso.zip
|
|
|
|
# ── Runtime stage ─────────────────────────────────────────────────────────────
|
|
# .NET 9 runtime: matches the SDK 9.0 publish step (framework-dependent), so the
|
|
# app's required Microsoft.NETCore.App 9.0 is present. Keep in lockstep with the
|
|
# `mcr.microsoft.com/dotnet/sdk` major in .woodpecker/*.yaml and the Makefile.
|
|
FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:9.0
|
|
|
|
# FFmpeg and the native deps required by SkiaSharp and fontconfig.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ffmpeg \
|
|
fontconfig \
|
|
libfontconfig1 \
|
|
libfreetype6 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /jellyfin
|
|
|
|
# Pre-built publish output produced by `dotnet publish` on the CI host.
|
|
COPY publish-output/ .
|
|
# jellyfin-web client assets from the webclient stage.
|
|
COPY --from=webclient /usr/share/jellyfin/web ./jellyfin-web/
|
|
# Baked auth plugins; docker-entrypoint.sh syncs these into /config/plugins.
|
|
COPY --from=plugins /plugins /usr/share/jellyfin/plugins-baked
|
|
COPY --chmod=0755 docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
|
|
# Jellyfin default ports
|
|
EXPOSE 8096
|
|
EXPOSE 8920
|
|
|
|
# Data / config volumes
|
|
VOLUME ["/config", "/cache", "/media"]
|
|
|
|
ENV JELLYFIN_DATA_DIR=/config \
|
|
JELLYFIN_CACHE_DIR=/cache \
|
|
JELLYFIN_LOG_DIR=/config/log
|
|
|
|
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|