From f7f266b994a1b7d0e3b54e49e640be35b8078bf0 Mon Sep 17 00:00:00 2001 From: Astounds Date: Fri, 29 May 2026 21:28:22 -0500 Subject: Add hardened Docker support and multi-arch CI Multi-stage Dockerfile (non-root, Tor-ready), compose file, and entrypoints. Forgejo CI builds linux/amd64+arm64, scans with checksum-verified Grype, and pins all actions to commit SHA. Makefile gains venv bootstrap and docker targets; server.py gains a --bind flag. --- .dockerignore | 54 ++++++++++++++++++++++++ .forgejo/workflows/ci.yaml | 90 ++++++++++++++++++++++++++++++++++++++++ .forgejo/workflows/git-sync.yaml | 40 ++++++++++++++++++ .gitea/workflows/ci.yaml | 27 ------------ .gitea/workflows/git-sync.yaml | 40 ------------------ Dockerfile | 66 +++++++++++++++++++++++++++++ Makefile | 27 +++++++++++- docker-compose.yml | 20 +++++++++ entrypoint-tor.sh | 17 ++++++++ entrypoint.sh | 15 +++++++ server.py | 23 ++++++---- tests/test_watch_formats.py | 2 +- youtube/watch_formats.py | 2 +- 13 files changed, 346 insertions(+), 77 deletions(-) create mode 100644 .dockerignore create mode 100644 .forgejo/workflows/ci.yaml create mode 100644 .forgejo/workflows/git-sync.yaml delete mode 100644 .gitea/workflows/ci.yaml delete mode 100644 .gitea/workflows/git-sync.yaml create mode 100644 Dockerfile create mode 100644 docker-compose.yml create mode 100644 entrypoint-tor.sh create mode 100644 entrypoint.sh diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..52e3395 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,54 @@ +# Git +.git/ +.gitignore +.gitattributes +.gitea/ + +# Python artifacts +__pycache__/ +*.py[cod] +*.so +venv/ +.venv/ +*.egg-info/ + +# Release / build artifacts +yt-local/ +python/ +get-pip.py +*.7z +*.zip +build/ +dist/ + +# IDE / editors +.vscode/ +.idea/ +*.swp +*.swo +*~ + +# Testing / coverage +.pytest_cache/ +.coverage +htmlcov/ +tests/ + +# Data / user config +data/ +debug/ +settings.txt + +# Docs +docs/ +*.md +LICENSE + +# AI tools +.kiro/ +.claude/ +.cursor/ + +# Docker itself +Dockerfile +docker-compose*.yml diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml new file mode 100644 index 0000000..c19e1fc --- /dev/null +++ b/.forgejo/workflows/ci.yaml @@ -0,0 +1,90 @@ +name: CI + +on: + push: + branches: [master] + pull_request: + branches: [master] + +env: + IMAGE_NAME: rusian/yt-local + GRYPE_VERSION: "0.112.0" + PLATFORMS: linux/amd64,linux/arm64 + +jobs: + test: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Set up Python + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + with: + python-version: "3.11" + + - name: Install dependencies + run: | + pip install --upgrade pip + pip install -r requirements-dev.txt + + - name: Run tests + run: pytest -v + + docker: + needs: test + runs-on: ubuntu-latest + if: github.event_name == 'push' && github.ref == 'refs/heads/master' + steps: + - name: Checkout code + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Set up QEMU + uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 + + - name: Set up Buildx + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 + + - name: Login to Docker Hub + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + with: + username: ${{ secrets.DOCKER_REGISTRY_USER }} + password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }} + + - name: Extract metadata + id: meta + uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 + with: + images: ${{ env.IMAGE_NAME }} + tags: | + type=sha,prefix= + type=raw,value=latest + + - name: Build image for scan (amd64 only) + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 + with: + context: . + load: true + tags: ${{ env.IMAGE_NAME }}:scan + + - name: Install Grype + run: | + curl -sSfL -o grype.tar.gz \ + "https://github.com/anchore/grype/releases/download/v${GRYPE_VERSION}/grype_${GRYPE_VERSION}_linux_amd64.tar.gz" + curl -sSfL -o checksums.txt \ + "https://github.com/anchore/grype/releases/download/v${GRYPE_VERSION}/grype_${GRYPE_VERSION}_checksums.txt" + sha256sum --check --ignore-missing checksums.txt + tar -xzf grype.tar.gz -C /usr/local/bin grype + grype version + + - name: Scan image for vulnerabilities + run: grype ${{ env.IMAGE_NAME }}:scan --fail-on critical --output table + + - name: Build and push (multi-platform) + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 + with: + context: . + platforms: ${{ env.PLATFORMS }} + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} diff --git a/.forgejo/workflows/git-sync.yaml b/.forgejo/workflows/git-sync.yaml new file mode 100644 index 0000000..f1028c5 --- /dev/null +++ b/.forgejo/workflows/git-sync.yaml @@ -0,0 +1,40 @@ +name: git-sync-with-mirror + +on: + push: + branches: [ master ] + workflow_dispatch: + +jobs: + git-sync: + runs-on: ubuntu-latest + + steps: + - name: git-sync + env: + git_sync_source_repo: git@git.fridu.us:heckyel/yt-local.git + git_sync_destination_repo: ssh://git@c.fridu.us/software/yt-local.git + if: env.git_sync_source_repo && env.git_sync_destination_repo + uses: actions/git-sync@v1 + with: + source_repo: git@git.fridu.us:heckyel/yt-local.git + source_branch: "master" + destination_repo: ssh://git@c.fridu.us/software/yt-local.git + destination_branch: "master" + source_ssh_private_key: ${{ secrets.GIT_SYNC_SOURCE_SSH_PRIVATE_KEY }} + destination_ssh_private_key: ${{ secrets.GIT_SYNC_DESTINATION_SSH_PRIVATE_KEY }} + + - name: git-sync-sourcehut + env: + git_sync_source_repo: git@git.fridu.us:heckyel/yt-local.git + git_sync_destination_repo: git@git.sr.ht:~heckyel/yt-local + if: env.git_sync_source_repo && env.git_sync_destination_repo + uses: actions/git-sync@v1 + with: + source_repo: git@git.fridu.us:heckyel/yt-local.git + source_branch: "master" + destination_repo: git@git.sr.ht:~heckyel/yt-local + destination_branch: "master" + source_ssh_private_key: ${{ secrets.GIT_SYNC_SOURCE_SSH_PRIVATE_KEY }} + destination_ssh_private_key: ${{ secrets.GIT_SYNC_DESTINATION_SSH_PRIVATE_KEY }} + continue-on-error: true diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml deleted file mode 100644 index 77f89a6..0000000 --- a/.gitea/workflows/ci.yaml +++ /dev/null @@ -1,27 +0,0 @@ -name: CI - -on: - push: - branches: [master] - pull_request: - branches: [master] - -jobs: - test: - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 - with: - python-version: "3.11" - - - name: Install dependencies - run: | - pip install --upgrade pip - pip install -r requirements-dev.txt - - - name: Run tests - run: pytest -v diff --git a/.gitea/workflows/git-sync.yaml b/.gitea/workflows/git-sync.yaml deleted file mode 100644 index f1028c5..0000000 --- a/.gitea/workflows/git-sync.yaml +++ /dev/null @@ -1,40 +0,0 @@ -name: git-sync-with-mirror - -on: - push: - branches: [ master ] - workflow_dispatch: - -jobs: - git-sync: - runs-on: ubuntu-latest - - steps: - - name: git-sync - env: - git_sync_source_repo: git@git.fridu.us:heckyel/yt-local.git - git_sync_destination_repo: ssh://git@c.fridu.us/software/yt-local.git - if: env.git_sync_source_repo && env.git_sync_destination_repo - uses: actions/git-sync@v1 - with: - source_repo: git@git.fridu.us:heckyel/yt-local.git - source_branch: "master" - destination_repo: ssh://git@c.fridu.us/software/yt-local.git - destination_branch: "master" - source_ssh_private_key: ${{ secrets.GIT_SYNC_SOURCE_SSH_PRIVATE_KEY }} - destination_ssh_private_key: ${{ secrets.GIT_SYNC_DESTINATION_SSH_PRIVATE_KEY }} - - - name: git-sync-sourcehut - env: - git_sync_source_repo: git@git.fridu.us:heckyel/yt-local.git - git_sync_destination_repo: git@git.sr.ht:~heckyel/yt-local - if: env.git_sync_source_repo && env.git_sync_destination_repo - uses: actions/git-sync@v1 - with: - source_repo: git@git.fridu.us:heckyel/yt-local.git - source_branch: "master" - destination_repo: git@git.sr.ht:~heckyel/yt-local - destination_branch: "master" - source_ssh_private_key: ${{ secrets.GIT_SYNC_SOURCE_SSH_PRIVATE_KEY }} - destination_ssh_private_key: ${{ secrets.GIT_SYNC_DESTINATION_SSH_PRIVATE_KEY }} - continue-on-error: true diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..cfee5bc --- /dev/null +++ b/Dockerfile @@ -0,0 +1,66 @@ +# ============================================================================= +# yt-local — multi-stage, non-root, Tor-ready +# ============================================================================= + +# --------------- build stage --------------- +FROM python:3.11-alpine AS builder + +ENV PIP_NO_CACHE_DIR=1 \ + PIP_DISABLE_PIP_VERSION_CHECK=1 \ + PYTHONDONTWRITEBYTECODE=1 + +RUN apk add --no-cache build-base libffi-dev + +COPY requirements.txt /tmp/requirements.txt +RUN pip install --prefix=/install --no-cache-dir -r /tmp/requirements.txt + +# --------------- runtime stage --------------- +FROM python:3.11-alpine + +LABEL maintainer="heckyel@riseup.net" +LABEL org.opencontainers.image.source="https://git.sr.ht/~heckyel/yt-local" +LABEL org.opencontainers.image.licenses="AGPL-3.0" + +ENV LANG=C.UTF-8 \ + PYTHONDONTWRITEBYTECODE=1 \ + PYTHONUNBUFFERED=1 \ + HOME=/home/appuser + +# tor package creates its own tor user/group and /var/lib/tor +# su-exec for privilege drop in entrypoint +RUN apk add --no-cache tor su-exec + +# App user (non-root) +RUN addgroup -g 1000 -S appgroup \ + && adduser -u 1000 -S appuser -G appgroup -h /home/appuser + +# Python packages from builder +COPY --from=builder /install /usr/local + +# Application source (root-owned, read-only for appuser) +WORKDIR /srv/app +COPY --chown=root:root . /srv/app/ + +# Compile translations (.po → .mo) +RUN python manage_translations.py compile + +# Persistent data dir (settings.txt, data/, etc.) +RUN mkdir -p /home/appuser/.yt-local/data \ + && chown -R appuser:appgroup /home/appuser/.yt-local \ + && chmod 750 /home/appuser/.yt-local + +VOLUME /home/appuser/.yt-local + +# Tor: fix perms on dirs already created by apk +RUN chown tor:tor /var/lib/tor /var/log/tor \ + && chmod 700 /var/lib/tor /var/log/tor + +# Entrypoints (root-owned, executable) +COPY --chmod=755 entrypoint.sh entrypoint-tor.sh / + +EXPOSE 9010 + +HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ + CMD sh -c 'python -c "import urllib.request; urllib.request.urlopen(\"http://127.0.0.1:9010\")"' + +ENTRYPOINT ["/entrypoint.sh"] diff --git a/Makefile b/Makefile index de17745..9805871 100644 --- a/Makefile +++ b/Makefile @@ -4,7 +4,7 @@ .PHONY: help install dev clean test i18n-extract i18n-init i18n-update \ i18n-compile i18n-stats i18n-clean setup-dev lint format backup \ restore distclean info check-deps run test-cov i18n-workflow \ - ensure-venv + ensure-venv docker docker-run docker-stop docker-logs docker-clean # Variables SYSTEM_PYTHON := python3 @@ -197,6 +197,31 @@ restore: ## Restore translations from latest backup echo "[ERROR] No backup files found"; \ fi +## Docker --------------------------------------------------------------------- + +docker: ## Build Docker image + @echo "[INFO] Building Docker image..." + docker compose build + @echo "[SUCCESS] Image built" + +docker-run: ## Start container (use ENABLE_TOR=1 for Tor) + @echo "[INFO] Starting container..." + ENABLE_TOR=$(or $(ENABLE_TOR),0) docker compose up -d + @echo "[SUCCESS] Container running at http://localhost:9010" + +docker-stop: ## Stop container + @echo "[INFO] Stopping container..." + docker compose down + @echo "[SUCCESS] Container stopped" + +docker-logs: ## Show container logs + docker compose logs -f + +docker-clean: docker-stop ## Remove container, image, and volume + @echo "[INFO] Removing Docker artefacts..." + docker compose down -v --rmi local + @echo "[SUCCESS] Docker artefacts removed" + ## Cleanup -------------------------------------------------------------------- clean: ## Clean temporary files, caches, and release artefacts diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..6b28926 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,20 @@ +services: + yt-local: + build: . + container_name: yt-local + restart: unless-stopped + ports: + - "127.0.0.1:9010:9010" + volumes: + - yt-local-data:/home/appuser/.yt-local + environment: + - ENABLE_TOR=0 + healthcheck: + test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:9010')"] + interval: 30s + timeout: 5s + start_period: 10s + retries: 3 + +volumes: + yt-local-data: diff --git a/entrypoint-tor.sh b/entrypoint-tor.sh new file mode 100644 index 0000000..0aaa030 --- /dev/null +++ b/entrypoint-tor.sh @@ -0,0 +1,17 @@ +#!/bin/sh +set -eu + +TORRC="/var/lib/tor/torrc" + +# Generate a minimal torrc if none is mounted +if [ ! -f "$TORRC" ]; then + echo "[tor] No torrc found, generating default..." + cat > "$TORRC" <