Archived
austin
91219efbaa
You built a self-service catalogue admin on feature/admin-and-ui-wins while I built a
competing one that had already merged and deployed. Both forked from 27821cd. Per your
call, your implementation is the one that stays.
Kept from main (files your branch didn't touch, so no conflict):
- the CI test gate (tests now run and block the image)
- motion 12.42.2
- the platform contract test
Took from your branch:
- split AdminProductController / AdminCategoryController + ProductPhotoService (server-side
webp via cwebp)
- a real category table (Category, V3__categories.sql) behind the product filters
- pages/Admin.tsx, with server-side /admin protection that redirects a browser to Authentik
and returns it to /admin afterward — cleaner than my client-side gate, and it avoids the
post-login-to-home issue my version had
Deleted my competing admin (AdminController, MeController, pages/admin/*, auth.tsx, and my
admin tests).
Grafted onto your gallery: swipe + arrow keys, which the deployed version had and yours
didn't. Added an AdminSecurityTest for your endpoints (admin closed, shop public, contact
CSRF) — the admin was otherwise untested, and CI now gates on tests.
Verified against a running container: /admin redirects a browser to Authentik (a bare 401
only for */* fetches, which is correct). 25 tests green.
41 lines
2.0 KiB
Docker
41 lines
2.0 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# ---------- build ----------
|
|
FROM maven:3.9-eclipse-temurin-25 AS build
|
|
WORKDIR /src
|
|
COPY . .
|
|
# Resolve the platform from the Gitea Maven registry (creds via BuildKit secrets); the Maven build also
|
|
# runs the Vite/React SPA build (frontend-maven-plugin) and folds it into the jar. Tests are skipped here
|
|
# because Testcontainers needs a Docker daemon — they run via `mvn verify`, not in the image build.
|
|
RUN --mount=type=secret,id=maven_user --mount=type=secret,id=maven_token \
|
|
MAVEN_USER="$(cat /run/secrets/maven_user)" MAVEN_TOKEN="$(cat /run/secrets/maven_token)" \
|
|
mvn -B -ntp -s .gitea/ci-settings.xml -DskipTests package \
|
|
&& cp "$(ls target/itsthevine-*.jar | grep -v original | head -1)" app.jar \
|
|
&& java -Djarmode=tools -jar app.jar extract --layers --destination extracted
|
|
|
|
# ---------- runtime ----------
|
|
FROM eclipse-temurin:25-jre-alpine AS runtime
|
|
# libwebp-tools supplies cwebp, which ProductPhotoService shells out to when an editor uploads a
|
|
# photo. Alpine's build is musl-native — the Java webp writers on Maven Central bundle glibc natives
|
|
# that will not load here, and no pure-Java webp encoder exists.
|
|
RUN apk -U upgrade --no-cache && apk add --no-cache curl libwebp-tools
|
|
RUN addgroup -S spring && adduser -S -D -H -h /app -s /sbin/nologin -G spring spring
|
|
WORKDIR /app
|
|
|
|
COPY --from=build --chown=spring:spring /src/extracted/dependencies/ ./
|
|
COPY --from=build --chown=spring:spring /src/extracted/snapshot-dependencies/ ./
|
|
COPY --from=build --chown=spring:spring /src/extracted/application/ ./
|
|
|
|
USER spring
|
|
EXPOSE 8080
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
|
|
CMD curl -fsS http://localhost:8080/actuator/health || exit 1
|
|
|
|
ARG GIT_SHA=unknown
|
|
LABEL org.opencontainers.image.title="itsthevine" \
|
|
org.opencontainers.image.source="https://git.thebennett.net/thevine/itsthevine" \
|
|
org.opencontainers.image.revision="${GIT_SHA}"
|
|
|
|
ENTRYPOINT ["java", "-XX:MaxRAMPercentage=75.0", "-jar", "app.jar"]
|