cloud-node-container/Dockerfile

# Base image. CI passes BASE_IMAGE=almalinux/10-base@sha256:<digest>, resolved
# DIRECTLY from Docker Hub in the same run (.gitea/scripts/resolve-base-image.sh),
# so the pkg-cache registry mirror can only serve content-addressed blobs.
# Local builds use the tag. cloud-apache-container docs/pkg-cache.md.
ARG BASE_IMAGE=almalinux/10-base
FROM ${BASE_IMAGE}
ARG NODEVER=20

# OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=https://192.168.1.40
# (CT130 pkg-cache, https only). Unset = upstream repositories. epel-release is
# GPG-verified against keys/pkg-cache/ either way. Repo files are restored at
# the end of the RUN, so no layer keeps the cache address. Same script as
# cloud-apache-container (scripts/pkg-cache-repos.sh, docs/pkg-cache.md there).
ARG PKG_CACHE=
COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
COPY ./keys/pkg-cache/ /usr/local/share/pkg-cache/
# Install repos, update, install only needed packages, clean up in one layer
RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
    /usr/local/sbin/pkg-cache-repos.sh release-install epel && \
    /usr/local/sbin/pkg-cache-repos.sh rpm && \
    printf 'retries=10\ntimeout=60\n' >> /etc/dnf/dnf.conf && \
    dnf update -y && \
    dnf install -y wget procps cronie iproute nginx openssl git microdnf make gcc gcc-c++ dumb-init && \
    dnf group install -y 'Development Tools' && \
    /usr/local/sbin/pkg-cache-repos.sh restore && \
    dnf clean all && \
    rm -rf /var/cache/dnf /usr/share/doc /usr/share/man /usr/share/locale/* \
           /var/cache/yum /tmp/* /var/tmp/*

# Copy scripts into the image and set permissions
COPY ./scripts/ /scripts/
RUN chmod +x /scripts/*

# Generate self-signed cert, create needed dirs, install Node.js, clean up
RUN openssl req -newkey rsa:2048 -nodes -keyout /etc/pki/tls/private/localhost.key -x509 -days 3650 -subj "/CN=localhost" -out /etc/pki/tls/certs/localhost.crt && \
    mkdir -p /var/log/nodejs && \
    /usr/local/sbin/pkg-cache-repos.sh rpm && \
    /scripts/install-node.sh "$NODEVER" && \
    /usr/local/sbin/pkg-cache-repos.sh restore && \
    dnf clean all && \
    rm -rf /var/cache/dnf /tmp/*

# Install PM2 globally for process management with minimal footprint
RUN npm install -g pm2@latest --production && \
    npm cache clean --force && \
    rm -rf /tmp/*

# Copy nginx config
COPY ./configs/nginx.conf /etc/nginx/nginx.conf

# Copy examples directory for default app fallback
COPY ./examples/ /examples/

# Set up cron job for log rotation
RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab

HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
  CMD bash -c ': </dev/tcp/127.0.0.1/3000 && : </dev/tcp/127.0.0.1/80' \
      || exit 1

ENTRYPOINT [ "/scripts/entrypoint.sh" ]