Skip to content

Commit a4af469

Browse files
kradalbykradalby
committed
Initial work on nfpm
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
1 parent 681c86c commit a4af469

File tree

8 files changed

+334
-130
lines changed

8 files changed

+334
-130
lines changed

‎.github/workflows/release-docker.yml

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
---
2+
name: Release Docker
3+
4+
on:
5+
push:
6+
tags:
7+
- "*" # triggers only if push new tag version
8+
workflow_dispatch:
9+
10+
jobs:
11+
docker-release:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Checkout
15+
uses: actions/checkout@v3
16+
with:
17+
fetch-depth: 0
18+
- name: Set up Docker Buildx
19+
uses: docker/setup-buildx-action@v1
20+
- name: Set up QEMU for multiple platforms
21+
uses: docker/setup-qemu-action@master
22+
with:
23+
platforms: arm64,amd64
24+
- name: Cache Docker layers
25+
uses: actions/cache@v2
26+
with:
27+
path: /tmp/.buildx-cache
28+
key: ${{ runner.os }}-buildx-${{ github.sha }}
29+
restore-keys: |
30+
${{ runner.os }}-buildx-
31+
- name: Docker meta
32+
id: meta
33+
uses: docker/metadata-action@v3
34+
with:
35+
# list of Docker images to use as base name for tags
36+
images: |
37+
${{ secrets.DOCKERHUB_USERNAME }}/headscale
38+
ghcr.io/${{ github.repository_owner }}/headscale
39+
tags: |
40+
type=semver,pattern={{version}}
41+
type=semver,pattern={{major}}.{{minor}}
42+
type=semver,pattern={{major}}
43+
type=sha
44+
type=raw,value=develop
45+
- name: Login to DockerHub
46+
uses: docker/login-action@v1
47+
with:
48+
username: ${{ secrets.DOCKERHUB_USERNAME }}
49+
password: ${{ secrets.DOCKERHUB_TOKEN }}
50+
- name: Login to GHCR
51+
uses: docker/login-action@v1
52+
with:
53+
registry: ghcr.io
54+
username: ${{ github.repository_owner }}
55+
password: ${{ secrets.GITHUB_TOKEN }}
56+
- name: Build and push
57+
id: docker_build
58+
uses: docker/build-push-action@v2
59+
with:
60+
push: true
61+
context: .
62+
tags: ${{ steps.meta.outputs.tags }}
63+
labels: ${{ steps.meta.outputs.labels }}
64+
platforms: linux/amd64,linux/arm64
65+
cache-from: type=local,src=/tmp/.buildx-cache
66+
cache-to: type=local,dest=/tmp/.buildx-cache-new
67+
build-args: |
68+
VERSION=${{ steps.meta.outputs.version }}
69+
- name: Prepare cache for next build
70+
run: |
71+
rm -rf /tmp/.buildx-cache
72+
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
73+
74+
docker-debug-release:
75+
runs-on: ubuntu-latest
76+
steps:
77+
- name: Checkout
78+
uses: actions/checkout@v3
79+
with:
80+
fetch-depth: 0
81+
- name: Set up Docker Buildx
82+
uses: docker/setup-buildx-action@v1
83+
- name: Set up QEMU for multiple platforms
84+
uses: docker/setup-qemu-action@master
85+
with:
86+
platforms: arm64,amd64
87+
- name: Cache Docker layers
88+
uses: actions/cache@v2
89+
with:
90+
path: /tmp/.buildx-cache-debug
91+
key: ${{ runner.os }}-buildx-debug-${{ github.sha }}
92+
restore-keys: |
93+
${{ runner.os }}-buildx-debug-
94+
- name: Docker meta
95+
id: meta-debug
96+
uses: docker/metadata-action@v3
97+
with:
98+
# list of Docker images to use as base name for tags
99+
images: |
100+
${{ secrets.DOCKERHUB_USERNAME }}/headscale
101+
ghcr.io/${{ github.repository_owner }}/headscale
102+
flavor: |
103+
suffix=-debug,onlatest=true
104+
tags: |
105+
type=semver,pattern={{version}}
106+
type=semver,pattern={{major}}.{{minor}}
107+
type=semver,pattern={{major}}
108+
type=sha
109+
type=raw,value=develop
110+
- name: Login to DockerHub
111+
uses: docker/login-action@v1
112+
with:
113+
username: ${{ secrets.DOCKERHUB_USERNAME }}
114+
password: ${{ secrets.DOCKERHUB_TOKEN }}
115+
- name: Login to GHCR
116+
uses: docker/login-action@v1
117+
with:
118+
registry: ghcr.io
119+
username: ${{ github.repository_owner }}
120+
password: ${{ secrets.GITHUB_TOKEN }}
121+
- name: Build and push
122+
id: docker_build
123+
uses: docker/build-push-action@v2
124+
with:
125+
push: true
126+
context: .
127+
file: Dockerfile.debug
128+
tags: ${{ steps.meta-debug.outputs.tags }}
129+
labels: ${{ steps.meta-debug.outputs.labels }}
130+
platforms: linux/amd64,linux/arm64
131+
cache-from: type=local,src=/tmp/.buildx-cache-debug
132+
cache-to: type=local,dest=/tmp/.buildx-cache-debug-new
133+
build-args: |
134+
VERSION=${{ steps.meta-debug.outputs.version }}
135+
- name: Prepare cache for next build
136+
run: |
137+
rm -rf /tmp/.buildx-cache-debug
138+
mv /tmp/.buildx-cache-debug-new /tmp/.buildx-cache-debug

‎.github/workflows/release.yml

+1-130
Original file line numberDiff line numberDiff line change
@@ -19,135 +19,6 @@ jobs:
1919
- uses: cachix/install-nix-action@v16
2020

2121
- name: Run goreleaser
22-
run: nix develop --command -- goreleaser release --rm-dist
22+
run: nix develop --command -- goreleaser release
2323
env:
2424
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
25-
26-
docker-release:
27-
runs-on: ubuntu-latest
28-
steps:
29-
- name: Checkout
30-
uses: actions/checkout@v3
31-
with:
32-
fetch-depth: 0
33-
- name: Set up Docker Buildx
34-
uses: docker/setup-buildx-action@v1
35-
- name: Set up QEMU for multiple platforms
36-
uses: docker/setup-qemu-action@master
37-
with:
38-
platforms: arm64,amd64
39-
- name: Cache Docker layers
40-
uses: actions/cache@v2
41-
with:
42-
path: /tmp/.buildx-cache
43-
key: ${{ runner.os }}-buildx-${{ github.sha }}
44-
restore-keys: |
45-
${{ runner.os }}-buildx-
46-
- name: Docker meta
47-
id: meta
48-
uses: docker/metadata-action@v3
49-
with:
50-
# list of Docker images to use as base name for tags
51-
images: |
52-
${{ secrets.DOCKERHUB_USERNAME }}/headscale
53-
ghcr.io/${{ github.repository_owner }}/headscale
54-
tags: |
55-
type=semver,pattern={{version}}
56-
type=semver,pattern={{major}}.{{minor}}
57-
type=semver,pattern={{major}}
58-
type=sha
59-
type=raw,value=develop
60-
- name: Login to DockerHub
61-
uses: docker/login-action@v1
62-
with:
63-
username: ${{ secrets.DOCKERHUB_USERNAME }}
64-
password: ${{ secrets.DOCKERHUB_TOKEN }}
65-
- name: Login to GHCR
66-
uses: docker/login-action@v1
67-
with:
68-
registry: ghcr.io
69-
username: ${{ github.repository_owner }}
70-
password: ${{ secrets.GITHUB_TOKEN }}
71-
- name: Build and push
72-
id: docker_build
73-
uses: docker/build-push-action@v2
74-
with:
75-
push: true
76-
context: .
77-
tags: ${{ steps.meta.outputs.tags }}
78-
labels: ${{ steps.meta.outputs.labels }}
79-
platforms: linux/amd64,linux/arm64
80-
cache-from: type=local,src=/tmp/.buildx-cache
81-
cache-to: type=local,dest=/tmp/.buildx-cache-new
82-
build-args: |
83-
VERSION=${{ steps.meta.outputs.version }}
84-
- name: Prepare cache for next build
85-
run: |
86-
rm -rf /tmp/.buildx-cache
87-
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
88-
89-
docker-debug-release:
90-
runs-on: ubuntu-latest
91-
steps:
92-
- name: Checkout
93-
uses: actions/checkout@v3
94-
with:
95-
fetch-depth: 0
96-
- name: Set up Docker Buildx
97-
uses: docker/setup-buildx-action@v1
98-
- name: Set up QEMU for multiple platforms
99-
uses: docker/setup-qemu-action@master
100-
with:
101-
platforms: arm64,amd64
102-
- name: Cache Docker layers
103-
uses: actions/cache@v2
104-
with:
105-
path: /tmp/.buildx-cache-debug
106-
key: ${{ runner.os }}-buildx-debug-${{ github.sha }}
107-
restore-keys: |
108-
${{ runner.os }}-buildx-debug-
109-
- name: Docker meta
110-
id: meta-debug
111-
uses: docker/metadata-action@v3
112-
with:
113-
# list of Docker images to use as base name for tags
114-
images: |
115-
${{ secrets.DOCKERHUB_USERNAME }}/headscale
116-
ghcr.io/${{ github.repository_owner }}/headscale
117-
flavor: |
118-
suffix=-debug,onlatest=true
119-
tags: |
120-
type=semver,pattern={{version}}
121-
type=semver,pattern={{major}}.{{minor}}
122-
type=semver,pattern={{major}}
123-
type=sha
124-
type=raw,value=develop
125-
- name: Login to DockerHub
126-
uses: docker/login-action@v1
127-
with:
128-
username: ${{ secrets.DOCKERHUB_USERNAME }}
129-
password: ${{ secrets.DOCKERHUB_TOKEN }}
130-
- name: Login to GHCR
131-
uses: docker/login-action@v1
132-
with:
133-
registry: ghcr.io
134-
username: ${{ github.repository_owner }}
135-
password: ${{ secrets.GITHUB_TOKEN }}
136-
- name: Build and push
137-
id: docker_build
138-
uses: docker/build-push-action@v2
139-
with:
140-
push: true
141-
context: .
142-
file: Dockerfile.debug
143-
tags: ${{ steps.meta-debug.outputs.tags }}
144-
labels: ${{ steps.meta-debug.outputs.labels }}
145-
platforms: linux/amd64,linux/arm64
146-
cache-from: type=local,src=/tmp/.buildx-cache-debug
147-
cache-to: type=local,dest=/tmp/.buildx-cache-debug-new
148-
build-args: |
149-
VERSION=${{ steps.meta-debug.outputs.version }}
150-
- name: Prepare cache for next build
151-
run: |
152-
rm -rf /tmp/.buildx-cache-debug
153-
mv /tmp/.buildx-cache-debug-new /tmp/.buildx-cache-debug

‎.nfpm.yaml

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# this is the base "template" for the package
2+
name: headscale
3+
description: headscale coordination server for Tailscale
4+
arch: ${ARCH}
5+
version: ${VERSION}
6+
priority: optional
7+
vendor: Juan Font
8+
maintainer: Kristoffer Dalby <kristoffer@dalby.cc>
9+
homepage: https://github.com/juanfont/headscale
10+
license: BSD
11+
contents:
12+
- src: ./build/headscale
13+
dst: /usr/bin/headscale
14+
- src: ./config-example.yaml
15+
dst: /etc/headscale/config.yaml
16+
type: config|noreplace
17+
file_info:
18+
mode: 0640
19+
- src: ./docs/packaging/headscale.systemd.service
20+
dst: /etc/systemd/system/headscale.service
21+
- dst: /var/lib/headscale
22+
type: dir
23+
- dst: /var/run/headscale
24+
type: dir
25+
# deb:
26+
# signature:
27+
# method: dpkg-sig
28+
# key_file: ".key.asc"
29+
# rpm:
30+
# signature:
31+
# key_file: ".key.asc"
32+
# apk:
33+
# signature:
34+
# key_file: ".key.rsa"
35+
scripts:
36+
postinstall: ./docs/packaging/postinstall.sh
37+
postremove: ./docs/packaging/postremove.sh

‎docs/packaging/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Packaging
2+
3+
We use [nFPM](https://nfpm.goreleaser.com/) for making `.deb`, `.rpm` and `.apk`.
4+
5+
This folder contains files we need to package with these releases.

‎docs/packaging/headscale.systemd.service

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
[Unit]
2+
After=syslog.target
3+
After=network.target
4+
Description=headscale coordination server for Tailscale
5+
X-Restart-Triggers=/etc/headscale/config.yaml
6+
7+
[Service]
8+
Type=simple
9+
User=headscale
10+
Group=headscale
11+
ExecStart=/usr/bin/headscale serve
12+
Restart=always
13+
RestartSec=5
14+
15+
WorkingDirectory=/var/lib/headscale
16+
ReadWritePaths=/var/lib/headscale /var/run
17+
18+
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_CHOWN
19+
CapabilityBoundingSet=CAP_CHOWN
20+
LockPersonality=true
21+
NoNewPrivileges=true
22+
PrivateDevices=true
23+
PrivateMounts=true
24+
PrivateTmp=true
25+
ProcSubset=pid
26+
ProtectClock=true
27+
ProtectControlGroups=true
28+
ProtectHome=true
29+
ProtectHome=yes
30+
ProtectHostname=true
31+
ProtectKernelLogs=true
32+
ProtectKernelModules=true
33+
ProtectKernelTunables=true
34+
ProtectProc=invisible
35+
ProtectSystem=strict
36+
RemoveIPC=true
37+
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
38+
RestrictNamespaces=true
39+
RestrictRealtime=true
40+
RestrictSUIDSGID=true
41+
RuntimeDirectory=headscale
42+
RuntimeDirectoryMode=0750
43+
StateDirectory=headscale
44+
StateDirectoryMode=0750
45+
SystemCallArchitectures=native
46+
SystemCallFilter=@chown
47+
SystemCallFilter=@system-service
48+
SystemCallFilter=~@privileged
49+
UMask=0077
50+
51+
[Install]
52+
WantedBy=multi-user.target

0 commit comments

Comments
 (0)