mirror of
https://github.com/luxfi/kms.git
synced 2026-10-30 16:23:36 +00:00
zeekayandClaude Opus 5
a3d82a4fdc
Modules declare go 1.27.1 and the build images follow. go fix applied the modernizers; the boolp test helper had no callers left once new(expr) could say it. omitzero is not applied, since it changes what the JSON says. Co-Authored-By: Claude Opus 5 <[email protected]>
56 lines
2.4 KiB
Docker
56 lines
2.4 KiB
Docker
# luxfi/kms — MPC-backed KMS server (headless, no React UI)
|
|
# lux-kms: Go + sqlcipher + MPC/ZAP. One service, one API surface (/v1/kms/*)
|
|
# stage so emulated cross-platform builds (M-series Mac → linux/amd64) don't
|
|
# trip QEMU's esbuild crash.
|
|
|
|
FROM golang:1.27.1-bookworm AS builder
|
|
ENV GOTOOLCHAIN=auto
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libsqlcipher-dev gcc libc6-dev pkg-config git ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# No GOPRIVATE — luxfi/hanzoai Go modules are PUBLIC; resolve via public proxy +
|
|
# sumdb (immutable). GOPRIVATE would route `direct` and re-poison go.sum.
|
|
# Every module in this graph is public, so nothing is fetched from the git host
|
|
# and the build needs no credential.
|
|
|
|
WORKDIR /build
|
|
COPY go.mod go.sum ./
|
|
# GOSUMDB=off: luxfi first-party tags are periodically force-republished during the
|
|
# ongoing ecosystem re-tag (e.g. luxfi/vm), so immutable sum.golang.org lags the
|
|
# proxy and rejects the current bits. Trust the proxy/authed-git source and record
|
|
# what is really fetched — integrity is still enforced against the regenerated
|
|
# go.sum (regenerate-not-bypass). Mirrors the main Dockerfile.
|
|
ENV GOSUMDB=off
|
|
RUN rm -f go.sum && go mod download
|
|
COPY . .
|
|
|
|
# `COPY . .` just re-introduced the committed go.sum, which can be stale vs the bits
|
|
# primed above when a luxfi tag was force-republished — a -mod=mod build then aborts
|
|
# on a go.sum checksum mismatch. Drop and regenerate from the primed cache under
|
|
# GOSUMDB=off (same as the main Dockerfile). Without this, that earlier regeneration
|
|
# is silently reverted by this COPY.
|
|
RUN rm -f go.sum && go mod download
|
|
|
|
# GOFLAGS=-mod=mod builds from the module cache, not the in-tree vendor/. The
|
|
# committed vendor/ can lag go.mod during the re-tag (inconsistent vendoring) and
|
|
# also strips supranational/blst C headers. Matches the main Dockerfile.
|
|
RUN CGO_ENABLED=1 GOFLAGS=-mod=mod go build -tags "sqlite_fts5 sqlcipher" \
|
|
-ldflags="-s -w" -o /usr/local/bin/kms ./cmd/kms
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libsqlcipher0 ca-certificates curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder /usr/local/bin/kms /usr/local/bin/kms
|
|
RUN mkdir -p /data/kms
|
|
|
|
ENV BASE_SKIP_ROOT_REDIRECT=1
|
|
ENV BASE_DISABLE_ADMIN_UI=1
|
|
|
|
EXPOSE 8080
|
|
HEALTHCHECK --interval=10s --timeout=3s --retries=3 \
|
|
CMD curl -f http://localhost:8080/healthz || exit 1
|
|
ENTRYPOINT ["kms", "serve", "--http=0.0.0.0:8080"]
|