Merge pull request #97 from MatthewL246/docker-updates

.dockerignore

@@ -1,6 +1,5 @@
-.git
-config.json
-logs
-certs
-cdn
-node_modules
+.git
+.env
+node_modules
+dist
+logs

.github/workflows/docker.yml

@@ -0,0 +1,47 @@
+name: Build and Publish Docker Image
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build-publish:
+    env:
+      SHOULD_PUSH_IMAGE: ${{ (github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/dev')) || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Set up QEMU for Docker
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log into the Docker container registry
+        if: ${{ env.SHOULD_PUSH_IMAGE == 'true' }}
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ github.repository }}
+          tags: |
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=edge,enable=${{ github.ref == 'refs/heads/dev' }}
+            type=sha
+
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@v6
+        with:
+          platforms: linux/amd64,linux/arm64
+          push: ${{ env.SHOULD_PUSH_IMAGE }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

Dockerfile

@@ -1,16 +1,47 @@
-FROM node:18-alpine
-
-RUN apk add --no-cache python3 make gcc g++ 
-WORKDIR /app
-
-COPY "docker/entrypoint.sh" ./
-
-COPY package*.json ./
-RUN npm install bcrypt && npm rebuild bcrypt --build-from-source
-RUN npm install
-
-COPY . ./
-
-VOLUME [ "/app/config.json", "/app/certs" ]
-
-CMD ["sh", "entrypoint.sh"]
+# syntax=docker/dockerfile:1
+
+ARG app_dir="/home/node/app"
+
+
+# * Base Node.js image
+FROM node:20-alpine AS base
+ARG app_dir
+WORKDIR ${app_dir}
+
+
+# * Installing production dependencies
+FROM base AS dependencies
+
+RUN --mount=type=bind,source=package.json,target=package.json \
+	--mount=type=bind,source=package-lock.json,target=package-lock.json \
+	--mount=type=cache,target=/root/.npm \
+	npm ci --omit=dev
+
+
+# * Installing development dependencies and building the application
+FROM base AS build
+
+RUN --mount=type=bind,source=package.json,target=package.json \
+	--mount=type=bind,source=package-lock.json,target=package-lock.json \
+	--mount=type=cache,target=/root/.npm \
+	npm ci
+
+COPY . .
+RUN npm run build
+
+
+# * Running the final application
+FROM base AS final
+ARG app_dir
+
+RUN mkdir -p ${app_dir}/logs && chown node:node ${app_dir}/logs
+
+ENV NODE_ENV=production
+USER node
+
+COPY package.json .
+
+COPY --from=dependencies ${app_dir}/node_modules ${app_dir}/node_modules
+COPY --from=build ${app_dir}/dist ${app_dir}/dist
+
+CMD ["node", "."]

SETUP.md

@@ -75,6 +75,7 @@ Configurations are loaded through environment variables. `.env` files are suppor
 | `PN_ACT_CONFIG_CDN_BASE_URL`                  | URL for serving CDN contents (usually the same as s3 endpoint)                                   | No       |
 | `PN_ACT_CONFIG_WEBSITE_BASE`                  | Website URL                                                                                      | Yes      |
 | `PN_ACT_CONFIG_AES_KEY`                       | AES-256 key used for encrypting tokens                                                           | No       |
+| `PN_ACT_CONFIG_DATASTORE_SIGNATURE_SECRET`    | HMAC secret key (16 bytes in hex format) used to sign uploaded DataStore files                   | No       |
 | `PN_ACT_CONFIG_GRPC_MASTER_API_KEY_ACCOUNT`   | Master API key to interact with the account gRPC service                                         | No       |
 | `PN_ACT_CONFIG_GRPC_MASTER_API_KEY_API`       | Master API key to interact with the API gRPC service                                             | No       |
 | `PN_ACT_CONFIG_GRPC_PORT`                     | gRPC server port                                                                                 | No       |