Add secure Node image webhook service

2026-08-06 11:21:54 +00:00
parent 24073326b3
commit f04b81c606
22 changed files with 1116 additions and 0 deletions
@@ -0,0 +1,90 @@
+name: sam-image
+
+services:
+  image-hook:
+    build:
+      context: ./node-hook
+    image: sam-image-hook:1.0.0
+    restart: unless-stopped
+    user: "${IMAGE_UID:-1000}:${IMAGE_GID:-1000}"
+    read_only: true
+    init: true
+    environment:
+      PORT: "8081"
+      IMAGE_REPOSITORY_PATH: /data/image
+      IMAGE_REMOTE_URL: ${IMAGE_REMOTE_URL:-https://gitea.hided.net/devsam/image.git}
+      IMAGE_REPOSITORY_FULL_NAME: ${IMAGE_REPOSITORY_FULL_NAME:-devsam/image}
+      IMAGE_DEFAULT_BRANCH: ${IMAGE_DEFAULT_BRANCH:-master}
+      IMAGE_ALLOWED_BRANCHES: ${IMAGE_ALLOWED_BRANCHES:-master}
+      IMAGE_PUBLIC_BASES: ${IMAGE_PUBLIC_BASES:-https://sam.hided.net/image,https://sam-image.hided.net}
+      IMAGE_STATE_PATH: /var/lib/image-hook/state.json
+      GITEA_WEBHOOK_SECRET_FILE: /run/secrets/gitea_webhook_secret
+      IMAGE_ADMIN_SECRET_FILE: /run/secrets/image_admin_secret
+    volumes:
+      - type: bind
+        source: ${IMAGE_REPOSITORY_PATH:-.}
+        target: /data/image
+      - ./runtime-data:/var/lib/image-hook
+    secrets:
+      - gitea_webhook_secret
+      - image_admin_secret
+    tmpfs:
+      - /tmp:size=16m,mode=1777
+    cap_drop: [ALL]
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 64
+    mem_limit: 256m
+    cpus: 1.0
+    healthcheck:
+      test: [CMD, node, -e, "fetch('http://127.0.0.1:8081/healthz').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 10s
+      timeout: 3s
+      retries: 6
+      start_period: 10s
+    networks: [image-internal, image-egress]
+
+  image-web:
+    build:
+      context: ./deploy/nginx
+    image: sam-image-web:1.0.0
+    restart: unless-stopped
+    depends_on:
+      image-hook:
+        condition: service_healthy
+    read_only: true
+    environment:
+      CADDY_SOURCE_CIDR: ${CADDY_SOURCE_CIDR:?Set CADDY_SOURCE_CIDR to the direct Caddy source CIDR}
+    ports:
+      - "${IMAGE_BIND_ADDRESS:-0.0.0.0}:${IMAGE_PORT:-8191}:8080"
+    volumes:
+      - type: bind
+        source: ${IMAGE_REPOSITORY_PATH:-.}
+        target: /srv/image
+        read_only: true
+    tmpfs:
+      - /tmp:size=8m,mode=1777
+    cap_drop: [ALL]
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 32
+    mem_limit: 64m
+    cpus: 0.5
+    healthcheck:
+      test: [CMD, wget, -q, -O, /dev/null, http://127.0.0.1:8080/healthz]
+      interval: 10s
+      timeout: 3s
+      retries: 6
+    networks: [image-internal, image-edge]
+
+networks:
+  image-internal:
+    internal: true
+  image-egress:
+  image-edge:
+
+secrets:
+  gitea_webhook_secret:
+    file: ${GITEA_WEBHOOK_SECRET_FILE:-./secrets/gitea_webhook_secret}
+  image_admin_secret:
+    file: ${IMAGE_ADMIN_SECRET_FILE:-./secrets/image_admin_secret}