94 lines
3.2 KiB
Docker
94 lines
3.2 KiB
Docker
|
# Dockerfile.bastion -- PXE boot server (dnsmasq DHCP/TFTP + HTTP)
|
||
|
|
# Requires host networking and NET_ADMIN/NET_RAW capabilities.
|
||
|
|
|
||
|
|
# ── Stage 1: Build ───────────────────────────────────────────────
|
||
|
|
FROM node:22-alpine AS builder
|
||
|
|
|
||
|
|
RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
|
||
|
|
|
||
|
|
WORKDIR /app
|
||
|
|
|
||
|
|
# Copy workspace config and package manifests first (layer cache)
|
||
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json tsconfig.json ./
|
||
|
|
COPY src/shared/package.json src/shared/tsconfig.json src/shared/
|
||
|
|
COPY src/bastion/package.json src/bastion/tsconfig.json src/bastion/
|
||
|
|
COPY src/cli/package.json src/cli/tsconfig.json src/cli/
|
||
|
|
COPY src/modules/package.json src/modules/tsconfig.json src/modules/
|
||
|
|
|
||
|
|
# Install all dependencies (dev included -- needed for build)
|
||
|
|
RUN pnpm install --frozen-lockfile
|
||
|
|
|
||
|
|
# Copy source code
|
||
|
|
COPY src/shared/src/ src/shared/src/
|
||
|
|
COPY src/bastion/src/ src/bastion/src/
|
||
|
|
COPY src/cli/src/ src/cli/src/
|
||
|
|
COPY src/modules/src/ src/modules/src/
|
||
|
|
COPY src/modules/modules/ src/modules/modules/
|
||
|
|
|
||
|
|
# Build TypeScript
|
||
|
|
RUN pnpm build
|
||
|
|
|
||
|
|
# ── Stage 1b: Build iPXE snp.efi (uses UEFI SNP protocol for ISO boot) ──
|
||
|
|
FROM fedora:43 AS ipxe-builder
|
||
|
|
|
||
|
|
RUN dnf install -y git gcc make perl-interpreter xz-devel gcc-aarch64-linux-gnu && dnf clean all
|
||
|
|
RUN git clone --depth=1 https://github.com/ipxe/ipxe.git /tmp/ipxe
|
||
|
|
RUN cd /tmp/ipxe/src && make bin-x86_64-efi/snp.efi && \
|
||
|
|
make CROSS_COMPILE=aarch64-linux-gnu- bin-arm64-efi/snp.efi
|
||
|
|
|
||
|
|
# ── Stage 2: Production runtime (Fedora -- needs dnsmasq) ───────
|
||
|
|
FROM fedora:43
|
||
|
|
|
||
|
|
RUN dnf install -y \
|
||
|
|
dnsmasq \
|
||
|
|
ipxe-bootimgs-x86 \
|
||
|
|
ipxe-bootimgs-aarch64 \
|
||
|
|
iproute \
|
||
|
|
curl \
|
||
|
|
openssh-clients \
|
||
|
|
nodejs \
|
||
|
|
npm \
|
||
|
|
xorriso \
|
||
|
|
mtools \
|
||
|
|
&& dnf clean all
|
||
|
|
|
||
|
|
# iPXE snp.efi built from source (Fedora only ships snponly, which can't
|
||
|
|
# boot from CD-ROM/USB -- it requires PXE chainloading)
|
||
|
|
COPY --from=ipxe-builder /tmp/ipxe/src/bin-x86_64-efi/snp.efi /usr/share/ipxe/ipxe-snp-x86_64.efi
|
||
|
|
COPY --from=ipxe-builder /tmp/ipxe/src/bin-arm64-efi/snp.efi /usr/share/ipxe/arm64-efi/ipxe-snp.efi
|
||
|
|
|
||
|
|
# Install pnpm
|
||
|
|
RUN npm install -g pnpm@9
|
||
|
|
|
||
|
|
WORKDIR /app
|
||
|
|
|
||
|
|
# Copy workspace config and package manifests
|
||
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
|
||
|
|
COPY src/shared/package.json src/shared/
|
||
|
|
COPY src/bastion/package.json src/bastion/
|
||
|
|
COPY src/cli/package.json src/cli/
|
||
|
|
COPY src/modules/package.json src/modules/
|
||
|
|
|
||
|
|
# Install production dependencies
|
||
|
|
RUN pnpm install --frozen-lockfile --prod 2>/dev/null || pnpm install --prod
|
||
|
|
|
||
|
|
# Copy built output from builder
|
||
|
|
COPY --from=builder /app/src/shared/dist/ src/shared/dist/
|
||
|
|
COPY --from=builder /app/src/bastion/dist/ src/bastion/dist/
|
||
|
|
COPY --from=builder /app/src/cli/dist/ src/cli/dist/
|
||
|
|
COPY --from=builder /app/src/modules/dist/ src/modules/dist/
|
||
|
|
|
||
|
|
# Create data directories
|
||
|
|
RUN mkdir -p /data/state /data/tftp /data/http
|
||
|
|
|
||
|
|
ENV NODE_ENV=production
|
||
|
|
ENV BASTION_DIR=/data
|
||
|
|
ENV HTTP_PORT=8080
|
||
|
|
|
||
|
|
EXPOSE 8080/tcp
|
||
|
|
EXPOSE 67/udp
|
||
|
|
EXPOSE 69/udp
|
||
|
|
EXPOSE 4011/udp
|
||
|
|
|
||
|
|
ENTRYPOINT ["node", "src/cli/dist/index.js", "init", "bastion", "standalone", "start", "--foreground"]
|