overseerandClaude Opus 5.5
21a8365c6a
F17-001: commit the API box's nestquest-api-firewall.service verbatim as deploy/systemd/nestquest-api-firewall.service (DOCKER-USER RETURN for 10.60.1.33 and 10.60.1.14, then DROP tcp/8080) and make the runbook install it from the repository before exposing the API. F17-002: pin the python:3.12-slim base image by digest in both build stages, pin api/requirements.txt to the exact versions installed in the deployed image (direct deps plus transitive closure), and pin the litestream image by digest in deploy/compose.yaml. Task: e4a7b18b-5dad-4387-90ac-33588c280824 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
2.3 KiB
Docker
52 lines
2.3 KiB
Docker
# Container image for the NestQuest API service (Feature 17).
|
|
#
|
|
# Build context is the REPOSITORY ROOT (compose sets it), because the
|
|
# API loads the bundled domain layer from
|
|
# custom_components/nestquest/core/ by file location
|
|
# (api/nestquest_core.py): the image must carry both api/ and the
|
|
# bundled core at their relative positions. Everything else in the
|
|
# repository is excluded via .dockerignore.
|
|
#
|
|
# Multi-stage so no pip/build toolchain survives into the runtime:
|
|
# the builder installs the deployable's own manifest
|
|
# (api/requirements.txt) into a staging prefix and the runtime copies
|
|
# only the installed packages. The service runs as a non-root user;
|
|
# the SQLite database lives on the mounted volume at
|
|
# /var/lib/nestquest (compose supplies NESTQUEST_DB_PATH pointing
|
|
# there — configuration is environment-supplied, never baked in).
|
|
#
|
|
# Both stages use the same base image pinned by digest, and
|
|
# api/requirements.txt pins exact versions, so a rebuild reproduces
|
|
# the deployed image instead of floating to whatever is newest.
|
|
FROM python:3.12-slim@sha256:2f17fc044b579bab302c2e8054d3a686e2cb9a83de48e70534b94cd8ebbe06a9 AS builder
|
|
|
|
COPY api/requirements.txt /tmp/requirements.txt
|
|
RUN pip install --no-cache-dir --prefix=/install -r /tmp/requirements.txt
|
|
|
|
FROM python:3.12-slim@sha256:2f17fc044b579bab302c2e8054d3a686e2cb9a83de48e70534b94cd8ebbe06a9
|
|
|
|
# The staged dependency install from the builder (no pip, no wheels).
|
|
COPY --from=builder /install /usr/local
|
|
|
|
# /app is the repository-root equivalent: api/ resolves imports as
|
|
# ``api.*`` and nestquest_core.py finds the bundled core one level up.
|
|
WORKDIR /app
|
|
COPY api/ ./api/
|
|
COPY custom_components/nestquest/core/ ./custom_components/nestquest/core/
|
|
|
|
# Non-root runtime user; owns the database volume mount point.
|
|
RUN useradd --system --create-home --home-dir /home/nestquest nestquest \
|
|
&& mkdir -p /var/lib/nestquest \
|
|
&& chown nestquest:nestquest /var/lib/nestquest
|
|
USER nestquest
|
|
|
|
ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
|
|
|
|
# The database path and the service token / OIDC settings are supplied
|
|
# by the environment (compose env_file), never committed into the image.
|
|
ENV NESTQUEST_DB_PATH=/var/lib/nestquest/nestquest.db
|
|
VOLUME /var/lib/nestquest
|
|
|
|
EXPOSE 8080
|
|
CMD ["uvicorn", "--factory", "api.app:create_app", "--host", "0.0.0.0", "--port", "8080"]
|