Erich Blume
0d422f5234
All checks were successful
Deploy Fly.io Proxy / deploy (push) Successful in 2m51s
## Summary Monthly tooling dependency update per [[update-tooling-dependencies]]. - **Prek hooks:** trufflehog v3.93.4→v3.94.0, ruff v0.15.2→v0.15.7, shfmt v3.12.0-2→v3.13.0-1, ansible-lint floor→26.3.0, ansible-core floor→2.18 - **Fly.io proxy:** nginx 1.28.2→1.29.6, Grafana Alloy v1.13.1→v1.14.1 - **Forgejo workflows:** actions/checkout v4.3.1→v6.0.2 (SHA-pinned across all 5 workflows) - **Mise tasks:** tightened Python lower bounds — rich≥14.0.0, typer≥0.24.0, httpx≥0.28.1, pyyaml≥6.0.2 ## Test plan - [x] `prek run --all-files` passes - [ ] Verify Fly.io deploy succeeds after merge (nginx minor bump + Alloy bump) - [ ] Spot-check a workflow run with the new actions/checkout v6 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #307
33 lines
1.1 KiB
Docker
33 lines
1.1 KiB
Docker
FROM nginx:1.29.6-alpine
|
|
|
|
# Copy tailscale binaries from official image
|
|
COPY --from=docker.io/tailscale/tailscale:stable \
|
|
/usr/local/bin/tailscaled /usr/local/bin/tailscaled
|
|
COPY --from=docker.io/tailscale/tailscale:stable \
|
|
/usr/local/bin/tailscale /usr/local/bin/tailscale
|
|
|
|
RUN mkdir -p /var/run/tailscale /var/lib/tailscale \
|
|
&& apk add --no-cache iptables ip6tables \
|
|
&& apk add --no-cache libc6-compat \
|
|
&& apk add --no-cache fail2ban \
|
|
&& rm -f /etc/fail2ban/jail.d/alpine-ssh.conf
|
|
|
|
# Copy Alloy binary from official image (Ubuntu-based, needs libc6-compat)
|
|
COPY --from=docker.io/grafana/alloy:v1.14.1 \
|
|
/bin/alloy /usr/local/bin/alloy
|
|
|
|
RUN mkdir -p /var/log/nginx /etc/alloy /tmp/alloy-data
|
|
|
|
COPY fail2ban/filter.d/forge-login.conf /etc/fail2ban/filter.d/forge-login.conf
|
|
COPY fail2ban/jail.d/forge.conf /etc/fail2ban/jail.d/forge.conf
|
|
COPY fail2ban/action.d/nginx-deny.conf /etc/fail2ban/action.d/nginx-deny.conf
|
|
|
|
COPY nginx.conf /etc/nginx/nginx.conf
|
|
COPY error.html /usr/share/nginx/html/error.html
|
|
COPY alloy.river /etc/alloy/config.alloy
|
|
COPY start.sh /start.sh
|
|
RUN chmod +x /start.sh
|
|
|
|
EXPOSE 8080
|
|
|
|
CMD ["/start.sh"]
|