mirror of
https://github.com/luxfi/kms.git
synced 2026-07-27 05:54:18 +00:00
hanzo-dev
a20bc707f1
The Docker builds set GOPRIVATE=luxfi/*,hanzoai/* which routes module fetches 'direct' (git) and bypasses sum.golang.org. After luxfi/keys@v1.1.0 was force-republished, the git tag content diverged from the immutable proxy/sumdb hash — so 'go mod download' fetched bits that no longer matched the (correct, sumdb-canonical) go.sum, failing every image build with SECURITY ERROR checksum mismatch. These modules are public; resolving them through the default public proxy + sumdb yields the canonical immutable hash that matches go.sum and a re-publish can no longer break. GITHUB_TOKEN insteadOf stays for the direct fallback.
20 lines
1.0 KiB
Docker
20 lines
1.0 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
# Unified lux-kms: prebuilt frontend (go:embed cmd/kms/web) + CGO sqlcipher server.
|
|
FROM golang:1.26.4-bookworm AS build
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libsqlcipher-dev gcc libc6-dev pkg-config git ca-certificates && rm -rf /var/lib/apt/lists/*
|
|
ARG GITHUB_TOKEN
|
|
RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
|
|
# No GOPRIVATE — public modules resolve via the immutable public proxy + sumdb.
|
|
ENV GOFLAGS=-mod=mod
|
|
WORKDIR /build
|
|
COPY . .
|
|
RUN CGO_ENABLED=1 go build -tags "sqlite_fts5 sqlcipher" -ldflags="-s -w" -o /usr/local/bin/kms ./cmd/kms
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update && apt-get install -y --no-install-recommends libsqlcipher0 ca-certificates curl && rm -rf /var/lib/apt/lists/*
|
|
COPY --from=build /usr/local/bin/kms /usr/local/bin/kms
|
|
RUN mkdir -p /data/kms
|
|
EXPOSE 8080
|
|
HEALTHCHECK --interval=10s --timeout=3s --retries=5 CMD curl -f http://localhost:8080/healthz || exit 1
|
|
ENTRYPOINT ["kms","serve","--http=0.0.0.0:8080"]
|