feat(web): publish a glabs-web container image#128
Merged
Conversation
Add a multi-stage Dockerfile that builds only ./cmd/glabs-web (the repo ships two binaries from one module) into a static CGO-off binary on a minimal alpine runtime with ca-certificates + tzdata (main() sets time.Local to Europe/Berlin) and a non-root user. A .dockerignore keeps the build context lean and, notably, excludes .glabs-web.yaml so secrets never enter an image. docker.yml builds and pushes ghcr.io/obcode/glabs-web on a release. Since go-semantic-release authors the release with GITHUB_TOKEN (which does not fire the `release` event), ci.yml's release job dispatches docker.yml itself when a new tag was created — mirroring the glabs.gui pipeline. This is the first Milestone-F PR; the deploy/ stack (Caddyfile + docker-compose.yml) follows and references this image. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
obcode
added a commit
that referenced
this pull request
Jul 20, 2026
…o) (#129) deploy/ brings up glabs.cs.hm.edu: Caddy terminates TLS (HM CA via EAB) and authenticates every request against oauth2-proxy (OIDC to sso.hm.edu), injecting X-Remote-User authoritatively — including on `/`, so the GUI's cookieless SSR hop can relay it to the backend. glabs-web, gui, mongo and oauth2-proxy stay on the internal network; only Caddy publishes 80/443 (mongo binds 127.0.0.1:27017 for an SSH tunnel). - docker-compose.yml: mongo (healthcheck + volume) + glabs-web + gui + oauth2-proxy + caddy, backend/gui from ghcr.io. No gh-runner. - Caddyfile: /query* -> glabs-web:8080 (GraphQL + WS), everything else -> gui:3000 (glabs-web serves nothing but /query; the YAML download is a GUI route). No department/groups header — glabs identity is just the email. - .env.example + .glabs-web.yaml.example (secrets/EAB/OIDC placeholders, gitignored real files) + README (setup, ACME/EAB, the SSR two-URL trap, operating, Mongo SSH tunnel, backups). Second and final core Milestone-F PR; references the glabs-web image from #128. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Erster Milestone-F-PR (Deploy): das Container-Image für
glabs-web. Der Deploy-Stack (deploy/Caddyfile+docker-compose.yml) folgt als zweiter PR und referenziert dieses Image.Was drin ist
Dockerfile— multi-stage. Baut nur./cmd/glabs-web(das Repo liefert zwei Binaries aus einem Modul) als statisches CGO-off-Binary auf schlankemalpine, mitca-certificates(TLS zu GitLab/ZPA/SMTP) +tzdata(main()setzttime.Local=Europe/Berlin), non-root (uid 10001). Mail-Templates sind via//go:embedim Binary — kein Asset-Copy nötig..dockerignore— hält den Build-Context schlank und schließt.glabs-web.yamlaus, damit Secrets nie in ein Image geraten. Deaktiviert bewusst den.git-VCS-Fallback → Version kommt alsbuild-arg..github/workflows/docker.yml— baut/pushtghcr.io/obcode/glabs-webbei Release (workflow_dispatch(tag)+release: published), Tags<tag>+latest, reichtVERSIONper build-arg (ldflags →main.version).ci.yml— der Release-Job dispatchtdocker.ymlselbst, wenn go-semantic-release einen neuen Tag erzeugt hat (GITHUB_TOKEN-Release feuert keinrelease-Event). Vorher/Nachher-Tag-Diff,actions: write. Analog zur glabs.gui-Pipeline ([[glabs-gui-repo]]).Verifikation (lokal, e2e)
docker buildgrün.tzdata/Europe/Berlinvorhanden, sauberer Fehler ohne Config.serverInfo.version = v0.0.0-test(beweist die ldflags-build-arg-Injektion),me.email = local@localhost(Dev-User), Job-Runner startet.actionlintgrün.Der PR-Titel ist
feat, damit ein Release ausgelöst und direkt das erste Image gebaut wird.🤖 Generated with Claude Code