103 lines
3.7 KiB
Bash
Executable File
103 lines
3.7 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ $# -lt 1 || $# -gt 3 ]]; then
|
|
echo "Usage: $0 SERVER_FEATURE [OUTPUT_DIRECTORY] [OUTPUT_FILENAME]" >&2
|
|
echo "SERVER_FEATURE must be full-embed or full" >&2
|
|
exit 2
|
|
fi
|
|
|
|
script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
repo_root="$(cd -- "$script_dir/../.." && pwd)"
|
|
server_feature="$1"
|
|
output_directory="${2:-$repo_root/debian-dist}"
|
|
|
|
case "$server_feature" in
|
|
full-embed)
|
|
server_db_mode=embedded
|
|
default_output_name=KompAC-embedded-debian12-amd64.AppImage
|
|
;;
|
|
full)
|
|
server_db_mode=external
|
|
default_output_name=KompAC-external-debian12-amd64.AppImage
|
|
;;
|
|
*)
|
|
echo "SERVER_FEATURE must be full-embed or full, got: $server_feature" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
|
|
output_name="${3:-$default_output_name}"
|
|
|
|
if [[ "$output_name" == */* || "$output_name" != *.AppImage ]]; then
|
|
echo "OUTPUT_FILENAME must be a portable filename ending in .AppImage" >&2
|
|
exit 2
|
|
fi
|
|
if ! command -v podman >/dev/null 2>&1; then
|
|
echo "podman is required to build the Debian production AppImage" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Podman normally reads a vendor configuration from /usr/share before the
|
|
# NixOS-generated configuration in /etc. Some NixOS installations have no
|
|
# traversable /usr/share, so point Podman directly at the generated file.
|
|
if [[ -z "${CONTAINERS_CONF:-}" ]] \
|
|
&& [[ ! -r /usr/share/containers/containers.conf ]] \
|
|
&& [[ -r /etc/containers/containers.conf ]]; then
|
|
export CONTAINERS_CONF=/etc/containers/containers.conf
|
|
echo "Using NixOS Podman configuration: $CONTAINERS_CONF"
|
|
fi
|
|
|
|
podman_security_options=()
|
|
if [[ ! -r /usr/share/containers/seccomp.json ]]; then
|
|
podman_security_options=(--security-opt seccomp=unconfined)
|
|
echo "Warning: Podman's seccomp profile is unreadable; build-container seccomp is disabled"
|
|
echo "Host fix: sudo chmod 755 /usr/share"
|
|
fi
|
|
|
|
if [[ ! -r /usr/share/containers/oci/hooks.d ]]; then
|
|
if [[ -n "${CONTAINERS_CONF_OVERRIDE:-}" ]]; then
|
|
echo "Podman's OCI hooks directory is unreadable and CONTAINERS_CONF_OVERRIDE is already set" >&2
|
|
echo "Fix the host with: sudo chmod 755 /usr/share" >&2
|
|
exit 1
|
|
fi
|
|
export CONTAINERS_CONF_OVERRIDE="$script_dir/containers-nix-unreadable-usr-share.conf"
|
|
echo "Disabling unreadable vendor OCI hooks with: $CONTAINERS_CONF_OVERRIDE"
|
|
fi
|
|
|
|
mkdir -p "$output_directory"
|
|
output_directory="$(cd -- "$output_directory" && pwd)"
|
|
image=localhost/komp-ac-debian-builder:bookworm
|
|
|
|
echo "Building Debian 12 production artifacts"
|
|
echo " server feature: $server_feature"
|
|
echo " database mode: $server_db_mode"
|
|
echo " output: $output_directory/$output_name"
|
|
echo
|
|
echo "+ podman build ${podman_security_options[*]} --platform linux/amd64 --file $script_dir/Containerfile.debian --tag $image $script_dir"
|
|
podman build \
|
|
"${podman_security_options[@]}" \
|
|
--platform linux/amd64 \
|
|
--file "$script_dir/Containerfile.debian" \
|
|
--tag "$image" \
|
|
"$script_dir"
|
|
|
|
echo
|
|
echo "+ podman run ${podman_security_options[*]} ... SERVER_FEATURE=$server_feature SERVER_DB_MODE=$server_db_mode ... $image"
|
|
podman run --rm \
|
|
"${podman_security_options[@]}" \
|
|
--platform linux/amd64 \
|
|
--env "OUTPUT_NAME=$output_name" \
|
|
--env "SERVER_FEATURE=$server_feature" \
|
|
--env "SERVER_DB_MODE=$server_db_mode" \
|
|
--volume "$repo_root:/source:ro" \
|
|
--volume "$output_directory:/out" \
|
|
--volume komp-ac-debian-cargo-target:/cargo-target \
|
|
--volume komp-ac-debian-cargo-registry:/opt/rust/cargo/registry \
|
|
--volume komp-ac-debian-cargo-git:/opt/rust/cargo/git \
|
|
--volume komp-ac-debian-yarn-cache:/var/cache/yarn \
|
|
"$image"
|
|
|
|
echo "Created $output_directory/$output_name"
|