Ultradesu
e99cacae8b
- Add JWT Bearer token validation to Rust API via OIDC provider JWKS with automatic key rotation and 1-hour cache - Remove x-api-key auth support and built-in web UI from furumi-web-player, leaving it as a pure API server - Add /auth/token endpoint to Node player server to expose OIDC access tokens to the frontend - Move Node player auth endpoints from /api/* to /auth/* to avoid path conflicts with Rust API - Add static file serving to Node Express server for production single-container deployment - Fix SameSite=Strict cookie issue breaking OIDC redirect flow (use Lax) - Add Dockerfile.node-player with multi-stage Node.js build - Add CI workflows for node-player Docker image (dev + release) - Optimize Rust Dockerfiles with dependency caching layer - Update docker-compose with OIDC env vars and OLLAMA_MODEL support - Cherry-pick agent LLM client fixes from DEV branch Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
60 lines
2.2 KiB
Docker
60 lines
2.2 KiB
Docker
FROM rust:1.88.0-bookworm AS builder
|
|
|
|
RUN apt-get update && apt-get install -y \
|
|
pkg-config \
|
|
libssl-dev \
|
|
protobuf-compiler \
|
|
cmake \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /usr/src/app
|
|
|
|
# 1. Copy workspace manifests and lock file (changes rarely → cached layer)
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY furumi-common/Cargo.toml furumi-common/Cargo.toml
|
|
COPY furumi-server/Cargo.toml furumi-server/Cargo.toml
|
|
COPY furumi-client-core/Cargo.toml furumi-client-core/Cargo.toml
|
|
COPY furumi-mount-linux/Cargo.toml furumi-mount-linux/Cargo.toml
|
|
COPY furumi-mount-macos/Cargo.toml furumi-mount-macos/Cargo.toml
|
|
COPY furumi-agent/Cargo.toml furumi-agent/Cargo.toml
|
|
COPY furumi-web-player/Cargo.toml furumi-web-player/Cargo.toml
|
|
|
|
# 2. Create dummy sources so cargo can resolve and build dependencies
|
|
RUN mkdir -p furumi-common/src && echo "pub fn _dummy(){}" > furumi-common/src/lib.rs \
|
|
&& mkdir -p furumi-server/src && echo "fn main(){}" > furumi-server/src/main.rs \
|
|
&& mkdir -p furumi-client-core/src && echo "pub fn _dummy(){}" > furumi-client-core/src/lib.rs \
|
|
&& mkdir -p furumi-mount-linux/src && echo "fn main(){}" > furumi-mount-linux/src/main.rs \
|
|
&& mkdir -p furumi-mount-macos/src && echo "fn main(){}" > furumi-mount-macos/src/main.rs \
|
|
&& mkdir -p furumi-agent/src && echo "fn main(){}" > furumi-agent/src/main.rs \
|
|
&& mkdir -p furumi-web-player/src && echo "fn main(){}" > furumi-web-player/src/main.rs
|
|
|
|
# 3. Build dependencies only (this layer is cached until Cargo.toml/lock change)
|
|
RUN cargo build --release --bin furumi-agent 2>/dev/null || true
|
|
|
|
# 4. Copy real source code
|
|
COPY . .
|
|
|
|
# 5. Touch sources to invalidate cargo's fingerprint for our crates (not deps)
|
|
RUN touch furumi-common/src/lib.rs furumi-agent/src/main.rs
|
|
|
|
ARG FURUMI_VERSION=dev
|
|
RUN FURUMI_VERSION=${FURUMI_VERSION} cargo build --release --bin furumi-agent
|
|
|
|
FROM debian:bookworm-slim
|
|
|
|
RUN apt-get update && apt-get install -y \
|
|
ca-certificates \
|
|
libssl-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN useradd -ms /bin/bash appuser
|
|
WORKDIR /home/appuser
|
|
|
|
COPY --from=builder /usr/src/app/target/release/furumi-agent /usr/local/bin/furumi-agent
|
|
|
|
USER appuser
|
|
|
|
EXPOSE 8090
|
|
|
|
ENTRYPOINT ["furumi-agent"]
|