talexander/homepage
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Add support for building the site via nix.

Browse Source
This commit is contained in:
Tom Alexander
2026-07-11 18:32:38 -04:00
parent feb4b2c082
commit 49966f46fd
10 changed files with 401 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files

98
docker/server/Dockerfile
View File

@@ -1,69 +1,65 @@
# syntax=docker/dockerfile:1
ARG ALPINE_VERSION="3.20"
#
# Builder
#
ARG NIX_SUBSTITUTERS=https://cache.nixos.org
FROM nixos/nix:2.31.3 AS builder
ARG NIX_SUBSTITUTERS
RUN tee -a /etc/nix/nix.conf <<EOF
extra-experimental-features = nix-command flakes
filter-syscalls = false
substituters = $NIX_SUBSTITUTERS
EOF
FROM scratch AS private
ADD git@code.fizz.buzz:talexander/homepage_private.git /homepage_private
RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
COPY . /tmp/build
WORKDIR /tmp/build
RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
FROM scratch AS explorer
ADD https://code.fizz.buzz/talexander/organic_ast_explorer.git /organic_ast_explorer
# Export the built closure to a folder
RUN mkdir /tmp/nix-store-closure
RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
# RUN ln -s $(readlink -f /tmp/build/result/bin/toybox) /tmp/sh
# Create a folder which will be copied to /tmp in the final image
RUN install -d -o root -g root -m 0777 will_be_tmp
# Create a folder which will be copied to /nginx in the final image
RUN install -d -o 1000 -g 1000 -m 0755 will_be_slash_nginx
FROM scratch AS organic
ADD git@code.fizz.buzz:talexander/organic.git /organic
#
# Runner
#
FROM scratch
WORKDIR /app
FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS organic-build
RUN apk add --no-cache musl-dev make bash
RUN rustup target add wasm32-unknown-unknown
RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked cargo install wasm-bindgen-cli
COPY --link --from=organic /organic /organic
WORKDIR /organic
RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked make wasm
ENV PATH="$PATH:/app/bin"
COPY --chmod=0644 --chown=0:0 <<EOF /etc/group
root:x:0:root
web:x:1000:web
EOF
COPY --chmod=0644 --chown=0:0 <<EOF /etc/passwd
root:x:0:0:root:/root:/bin/sh
web:x:1000:1000::/home/web:/bin/sh
EOF
FROM node:lts-alpine$ALPINE_VERSION AS explorer-build
COPY --link --from=explorer /organic_ast_explorer /organic_ast_explorer
COPY --link --from=organic-build /organic /organic
WORKDIR /organic_ast_explorer
RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/npmcache,sharing=locked npm set cache /npmcache && npm install
RUN npm run release
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
COPY --from=builder /tmp/nix-store-closure /nix/store
COPY --from=builder /tmp/build/result /app
# COPY --from=builder /tmp/sh /bin/sh
COPY --from=builder /tmp/build/will_be_tmp /tmp
COPY --from=builder /tmp/build/will_be_slash_nginx /nginx
FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS natter-build
RUN apk add --no-cache musl-dev
ADD git@code.fizz.buzz:talexander/natter.git /natter
WORKDIR /natter
RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked CARGO_TARGET_DIR=/target cargo build --profile release-lto
FROM alpine:$ALPINE_VERSION AS natter
COPY --link --from=natter-build /target/release-lto/natter /usr/bin/
COPY --link . /source
COPY --link --from=private /homepage_private/static /source/static/
COPY --link --from=explorer-build /organic_ast_explorer/dist /source/static/organic/ast_explorer/
RUN --network=none --mount=type=tmpfs,target=/tmp natter build --config /source/natter.toml
FROM alpine:$ALPINE_VERSION AS server
RUN apk add --no-cache bash nginx
RUN addgroup web && adduser -D -G web web && install -d -D -o web -g web -m 700 /srv/http/public
RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log
COPY --chown=web:web docker/server/nginx.conf /srv/http
COPY --chown=web:web docker/server/headers.include /srv/http
COPY --from=natter --chown=web:web /source/output/ /srv/http/public/
ENTRYPOINT ["/usr/sbin/nginx", "-c", "/srv/http/nginx.conf", "-e", "stderr", "-g", "daemon off;"]
EXPOSE 8080
CMD ["/app/bin/launch_nginx"]

19
docker/server/nginx.conf
View File

@@ -4,7 +4,8 @@ worker_processes 4;
# Speed up regular expressions.
pcre_jit on;
error_log stderr debug;
error_log /dev/stderr debug;
pid /nginx/nginx.pid;
events {
# Connections per worker process.
@@ -12,7 +13,9 @@ events {
}
http {
include /etc/nginx/mime.types;
access_log /dev/stdout;
include @mime_types@;
default_type application/octet-stream;
types {
@@ -24,11 +27,11 @@ http {
sendfile on;
tcp_nopush on;
include headers.include;
include @headers_include@;
server {
listen 8080;
root /srv/http/public;
root @web_root@;
location / {
try_files $uri $uri/ =404;
@@ -47,24 +50,24 @@ http {
}
location /.well-known/ {
alias /srv/http/public/well-known/;
alias @web_root@/well-known/;
default_type text/plain;
}
location /.well-known/openpgpkey/hu/ {
alias /srv/http/public/well-known/openpgpkey/fizz.buzz/hu/;
alias @web_root@/well-known/openpgpkey/fizz.buzz/hu/;
default_type "application/octet-stream";
add_header Access-Control-Allow-Origin * always;
}
location /.well-known/openpgpkey/policy {
alias /srv/http/public/well-known/openpgpkey/fizz.buzz/policy;
alias @web_root@/well-known/openpgpkey/fizz.buzz/policy;
default_type "application/octet-stream";
add_header Access-Control-Allow-Origin * always;
}
location ~ /\.well-known/(?<path>openpgpkey/[^/]+/hu/.*) {
alias /srv/http/public/well-known/$path;
alias @web_root@/well-known/$path;
default_type "application/octet-stream";
add_header Access-Control-Allow-Origin * always;
}