My work thus far.

*

!conf.d/

!www/

!snippets/

COMPOSE_PROJECT_NAME=web-proxy

---

image: adarnimrod/ci-images:docker

stages:

  - test

  - build

  - run

pre-commit:

  stage: test

  image: adarnimrod/ci-images:pre-commit

  variables:

    XDG_CACHE_HOME: "$CI_PROJECT_DIR/.cache"

    # Disabled until https://github.com/pre-commit/pre-commit/issues/1387 is

    # resolved.

    SKIP: "hadolint,docker-compose"

  script:

    - pre-commit run --all-files

  cache:

    paths:

      - .cache/

build:

  stage: build

  tags: ["host01.shore.co.il"]

  variables:

    COMPOSE_DOCKER_CLI_BUILD: "1"

    DOCKER_BUILDKIT: "1"

  script:

    - docker-compose build --no-cache --pull

    - docker-compose pull --quiet

run:

  stage: run

  tags: ["host01.shore.co.il"]

  when: manual

  script:

    - docker-compose up --detach --remove-orphans

    # yamllint disable rule:line-length

    - |

        for i in $(seq 12)

        do

            docker container inspect --format '{{ .State.Health.Status }}' $(docker-compose ps -q) | grep -v '^healthy$' || break

            sleep 10

        done

        ! docker container inspect --format '{{ .State.Health.Status }}' $(docker-compose ps -q) | grep -v '^healthy$'

# vim:ff=unix ts=2 sw=2 ai expandtab

---

repos:

  - repo: https://github.com/pre-commit/pre-commit-hooks

    rev: v2.3.0

    hooks:

      - id: check-added-large-files

      - id: check-merge-conflict

      - id: detect-private-key

      - id: trailing-whitespace

  - repo: https://github.com/adrienverge/yamllint

    rev: v1.17.0

    hooks:

      - id: yamllint

  - repo: https://github.com/amperser/proselint/

    rev: 0.10.2

    hooks:

      - id: proselint

        types: [plain-text]

        exclude: LICENSE

  - repo: https://github.com/Yelp/detect-secrets

    rev: v0.13.0

    hooks:

      - id: detect-secrets

  - repo: https://git.shore.co.il/nimrod/docker-pre-commit.git/

    rev: v0.3.0

    hooks:

      - id: docker-compose

      - id: hadolint

  - repo: https://git.shore.co.il/nimrod/shell-pre-commit.git/

    rev: v0.6.0

    hooks:

      - id: shell-lint

      - id: shellcheck

FROM nginx:1.19-alpine

# hadolint ignore=DL3018

RUN rm -rf /etc/nginx/conf./* && \

    chmod 777 /run && \

    apk add --no-cache --update libcap openssl && \

    curl https://letsencrypt.org/certs/isrg-root-ocsp-x1.pem.txt > /etc/ssl/ocsp.pem && \

    mkdir /var/ssl &&\

    curl https://ssl-config.mozilla.org/ffdhe2048.txt > /var/ssl/dhparams &&\

    chmod 644 /var/ssl/dhparams && \

    install -d -m 755 -o root -g root /etc/nginx/snippets && \

    install -d -m 755 -o root -g root /var/ssl && \

    install -d -m 700 -o nginx -g nginx /var/cache/nginx && \

    openssl req -x509 \

                -newkey rsa:4096 \

                -keyout /var/ssl/site.key \

                -nodes \

                -out /var/ssl/site.crt \

                -days 2 \

                -subj "/C=US/ST=IL/L=None/O=None/OU=None/CN=localhost/" && \

    cp /var/ssl/site.crt /var/ssl/mail.crt && \

    cp /var/ssl/site.key /var/ssl/mail.key && \

    setcap CAP_NET_BIND_SERVICE=+ep "$(command -v nginx)" && \

    chown nginx /var/ssl/site.* /var/ssl/mail.*

COPY www/ /var/www/

COPY conf.d/ /etc/nginx/conf.d/

COPY snippets/ /etc/nginx/snippets/

USER nginx

RUN nginx -t

HEALTHCHECK CMD curl --fail --verbose --user-agent 'Docker health check' http://localhost/ || exit 1