inbuxa-server/Dockerfile.build at v2026.10.6.1

0 Fork 0

Files

T

jcoffey-dev db4135e481 Merge upstream v0.16.25

Brings in the stripped v0.16.25 snapshot (72f8ddd), a bug-fix release:
DKIM rotation (keys retired before their successor is published, keys
made under manual DNS never rotating, manual DNS activating an
unpublished key), IMAP answering failed logins with an untagged NO,
DNSBL scoring only the first return code and caching "not listed" for
24 hours, Pyzor digesting empty input, queue quotas with an empty match
never enforced, RocksDB's info log growing without limit, MaskedEmail
creation with several domains, and Autodiscover answering other schemas
with the Outlook settings.

Conflicts:
- crates/main/Cargo.toml: inbuxa's name and AGPL-only license, version
  0.16.25.
- SECURITY.md and .github/PULL_REQUEST_TEMPLATE.md: inbuxa's own.
- Cargo.lock: upstream's, re-resolved against inbuxa's manifests.
- crates/common/src/network/autoconfig/autodiscover.rs: upstream now
  parses the request into a struct, so the legacy-protocol switch
  (LP-7) reads the address from request.email; ActiveSync and other
  schemas get upstream's error 601 untouched.
- resources/schema: unchanged upstream apart from two labels the rename
  pass now covers, which main already had.

AGENTS.md, new upstream, is left out: it is about contributing to
upstream, which doesn't apply to this repository.

2026-10-05 21:20:26 -07:00

196 lines

8.8 KiB

INI

Raw Permalink Blame History

 # syntax=docker/dockerfile:1
 # check=skip=FromPlatformFlagConstDisallowed,RedundantTargetPlatform
 # *****************
 # Base image for planner & builder
 # *****************
 FROM --platform=$BUILDPLATFORM rust:1.98.1-slim-trixie AS base
 ENV DEBIAN_FRONTEND="noninteractive" \
     BINSTALL_DISABLE_TELEMETRY=true \
     CARGO_TERM_COLOR=always \
     CARGO_NET_RETRY=10 \
     CARGO_NET_GIT_FETCH_WITH_CLI=true \
     LANG=C.UTF-8 \
     TZ=UTC \
     TERM=xterm-256color \
     AWS_LC_SYS_PREBUILT_NASM=1
 # With zig, we only need libclang and make. ca-certificates is required for curl
 # to verify HTTPS downloads (zig tarballs, FoundationDB debs, crates.io, etc).
 RUN \
     --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     rm -f /etc/apt/apt.conf.d/docker-clean && \
     echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' >/etc/apt/apt.conf.d/keep-cache && \
     apt-get update && \
     apt-get install -yq --no-install-recommends ca-certificates curl git jq xz-utils make libclang-19-dev
 # Zig is pinned to 0.13.0. Zig 0.14+ changed how its default target ABI is
 # resolved for `x86_64-linux-gnu`-style triples, and on Stalwart's dep tree
 # (rocksdb, jemalloc, aws-lc-sys, libfdb_c.so, rust-std 1.87+) this surfaces
 # as ld.lld undefined references to pthread_*/stat/pow@GLIBC_2.33+. An
 # explicit glibc suffix (`.2.17`) is NOT a workaround — C deps compiled via
 # zig cc against Zig 0.16 headers still emit @2.33+ symbols even when the
 # linker target is 2.17. Zig 0.13 produces binaries with a max glibc ref of
 # ~2.28 which stays compatible with Debian 11 / RHEL 8. Revisit this pin if
 # Zig upstream stabilizes a backwards-compatible default or if Stalwart drops
 # its hard C deps.
 RUN \
     ZIG_VERSION=0.13.0 && \
     curl --retry 5 -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-$(uname -m)-${ZIG_VERSION}.tar.xz" | tar -J -x -C /usr/local && \
     ln -s "/usr/local/zig-linux-$(uname -m)-${ZIG_VERSION}/zig" /usr/local/bin/zig && \
     zig version
 # Install cargo-binstall
 RUN curl --retry 5 -fL --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
 # Install cargo-chef & sccache & cargo-zigbuild
 RUN cargo binstall --no-confirm [email protected] [email protected] [email protected]
 # *****************
 # Planner
 # *****************
 FROM base AS planner
 WORKDIR /app
 COPY . .
 # Generate recipe file
 RUN cargo chef prepare --recipe-path recipe.json
 # *****************
 # Builder
 # *****************
 FROM base AS builder
 WORKDIR /app
 COPY --from=planner /app/recipe.json recipe.json
 ARG TARGET
 ARG BUILD_ENV
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 # Install toolchain and specify some env variables
 RUN \
     rustup set profile minimal && \
     rustup target add ${TARGET} && \
     mkdir -p artifact && \
     touch /env-cargo && \
     if [ ! -z "${BUILD_ENV}" ]; then \
         echo "export ${BUILD_ENV}" >> /env-cargo; \
         echo "Setting up ${BUILD_ENV}"; \
     fi && \
     if [[ "${TARGET}" == *gnu ]]; then \
         base_arch="${TARGET%%-*}"; \
         case "$base_arch" in \
             x86_64) \
                 echo "export FDB_ARCH=amd64" >> /env-cargo; \
                 ;; \
             aarch64) \
                 echo "export FDB_ARCH=aarch64" >> /env-cargo; \
                 ;; \
             *) \
                 exit 1; \
                 ;; \
         esac; \
     fi
 # Install FoundationDB (pinned to latest 7.4.x; Apple publishes 7.4 as
 # prereleases on GitHub, so the release list is fetched without the
 # prerelease filter and narrowed by tag name).
 ARG FDB_VERSION_RANGE="7.4"
 RUN \
     source /env-cargo && \
     if [ ! -z "${FDB_ARCH}" ]; then \
         curl --retry 5 -fLso fdb-client.deb "$(curl --retry 5 -fLs 'https://api.github.com/repos/apple/foundationdb/releases?per_page=100' | jq --arg FDB_ARCH "$FDB_ARCH" --arg RANGE "${FDB_VERSION_RANGE}" -r '[.[] | select(.tag_name | startswith($RANGE + "."))] | sort_by(.tag_name | split(".") | map(tonumber)) | reverse | .[0].assets[] | select(.name | test("foundationdb-clients.*" + $FDB_ARCH + ".deb$")) | .browser_download_url')" && \
         mkdir -p /fdb && \
         dpkg -x fdb-client.deb /fdb && \
         mv /fdb/usr/include/foundationdb /usr/include && \
         mv /fdb/usr/lib/libfdb_c.so /usr/lib && \
         rm -rf fdb-client.deb /fdb; \
     fi
 # Cargo-chef Cache layer
 RUN \
     --mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
     --mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
     --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git \
     source /env-cargo && \
     if [ ! -z "${FDB_ARCH}" ]; then \
         RUSTFLAGS="-L /usr/lib" cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${TARGET} -p inbuxa --no-default-features --features "foundationdb s3 redis nats"; \
     fi
 RUN \
     --mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
     --mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
     --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git \
     source /env-cargo && \
     cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${TARGET} -p inbuxa --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats"
 # Copy the source code
 COPY . .
 ENV RUSTC_WRAPPER="sccache" \
     SCCACHE_GHA_ENABLED=true
 # Build FoundationDB version
 RUN \
     --mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
     --mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
     --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git \
     source /env-cargo && \
     if [ ! -z "${FDB_ARCH}" ]; then \
         RUSTFLAGS="-L /usr/lib" cargo zigbuild --release --target ${TARGET} -p inbuxa --no-default-features --features "foundationdb s3 redis nats" && \
         mv /app/target/${TARGET}/release/inbuxa /app/artifact/inbuxa-foundationdb; \
     fi
 # Build generic version
 RUN \
     --mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
     --mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
     --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git \
     source /env-cargo && \
     cargo zigbuild --release --target ${TARGET} -p inbuxa --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats" && \
     mv /app/target/${TARGET}/release/inbuxa /app/artifact/inbuxa
 # *****************
 # Binary stage
 # *****************
 FROM scratch AS binaries
 COPY --from=builder /app/artifact /
 # *****************
 # Runtime image for GNU targets
 # *****************
 FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim AS gnu
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
     apt-get install -yq --no-install-recommends ca-certificates curl tzdata libcap2-bin && \
     rm -rf /var/lib/apt/lists/* && \
     groupadd -r -g 2000 inbuxa && \
     useradd -r -u 2000 -g 2000 -s /usr/sbin/nologin -M inbuxa && \
     mkdir -p /etc/inbuxa /var/lib/inbuxa && \
     chown inbuxa:inbuxa /etc/inbuxa /var/lib/inbuxa
 COPY --from=builder --chmod=0755 /app/artifact/inbuxa /usr/local/bin/inbuxa
 RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/inbuxa
 USER inbuxa
 WORKDIR /var/lib/inbuxa
 VOLUME ["/etc/inbuxa", "/var/lib/inbuxa"]
 EXPOSE	443 25 110 587 465 143 993 995 4190 8080
 ENV INBUXA_HEALTHCHECK_URL=https://127.0.0.1:443/healthz/live
 HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
     CMD curl -fsSk -H "X-Forwarded-For: 127.0.0.1" "$INBUXA_HEALTHCHECK_URL" || curl -fsS -H "X-Forwarded-For: 127.0.0.1" http://127.0.0.1:8080/healthz/live || exit 1
 ENTRYPOINT ["/usr/local/bin/inbuxa"]
 CMD ["--config", "/etc/inbuxa/config.json"]
 # *****************
 # Runtime image for musl targets
 # *****************
 FROM --platform=$TARGETPLATFORM alpine AS musl
 RUN apk add --update --no-cache ca-certificates curl tzdata libcap && \
     rm -rf /var/cache/apk/* && \
     addgroup -S -g 2000 inbuxa && \
     adduser -S -D -H -u 2000 -G inbuxa -s /sbin/nologin inbuxa && \
     mkdir -p /etc/inbuxa /var/lib/inbuxa && \
     chown inbuxa:inbuxa /etc/inbuxa /var/lib/inbuxa
 COPY --from=builder --chmod=0755 /app/artifact/inbuxa /usr/local/bin/inbuxa
 RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/inbuxa
 USER inbuxa
 WORKDIR /var/lib/inbuxa
 VOLUME ["/etc/inbuxa", "/var/lib/inbuxa"]
 EXPOSE	443 25 110 587 465 143 993 995 4190 8080
 ENV INBUXA_HEALTHCHECK_URL=https://127.0.0.1:443/healthz/live
 HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
     CMD curl -fsSk -H "X-Forwarded-For: 127.0.0.1" "$INBUXA_HEALTHCHECK_URL" || curl -fsS -H "X-Forwarded-For: 127.0.0.1" http://127.0.0.1:8080/healthz/live || exit 1
 ENTRYPOINT ["/usr/local/bin/inbuxa"]
 CMD ["--config", "/etc/inbuxa/config.json"]

196 lines 8.8 KiB INI Raw Permalink Blame History

196 lines

8.8 KiB

INI

Raw Permalink Blame History