From f7f266b994a1b7d0e3b54e49e640be35b8078bf0 Mon Sep 17 00:00:00 2001 From: Astounds Date: Fri, 29 May 2026 21:28:22 -0500 Subject: Add hardened Docker support and multi-arch CI Multi-stage Dockerfile (non-root, Tor-ready), compose file, and entrypoints. Forgejo CI builds linux/amd64+arm64, scans with checksum-verified Grype, and pins all actions to commit SHA. Makefile gains venv bootstrap and docker targets; server.py gains a --bind flag. --- entrypoint.sh | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 entrypoint.sh (limited to 'entrypoint.sh') diff --git a/entrypoint.sh b/entrypoint.sh new file mode 100644 index 0000000..a63a188 --- /dev/null +++ b/entrypoint.sh @@ -0,0 +1,15 @@ +#!/bin/sh +set -eu + +echo "[entrypoint] Starting yt-local..." + +# Optionally start Tor in the background as the tor user +if [ "${ENABLE_TOR:-0}" = "1" ]; then + echo "[entrypoint] Launching Tor daemon..." + su-exec tor /entrypoint-tor.sh & + sleep 3 +fi + +# Drop to appuser. Bind to all interfaces — container networking +# requires 0.0.0.0; actual access is controlled by Docker (-p flag). +exec su-exec appuser python server.py --bind 0.0.0.0 -- cgit v1.2.3