forked from MIrrors/bin
Compare commits
1 Commits
v2.0.1-1
...
dependabot
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
a0e78c6ffa |
@@ -1,33 +0,0 @@
|
||||
name: Docker Image Creation
|
||||
run-name: ${{ gitea.actor }} building Docker image
|
||||
on: [push]
|
||||
|
||||
jobs:
|
||||
build-docker:
|
||||
runs-on: ubuntu-22.04
|
||||
steps:
|
||||
- name: Checkout the repo
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Login to Gitea Docker Registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: git.bluequartz.xyz
|
||||
username: ${{ gitea.actor }}
|
||||
password: ${{ secrets.DOCKER_PASSWORD }}
|
||||
|
||||
- name: Extract metadata for Docker
|
||||
id: meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: git.bluequartz.xyz/kellen/bin
|
||||
|
||||
- name: Build and Push
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
file: ./Dockerfile
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
|
||||
1
.gitignore
vendored
1
.gitignore
vendored
@@ -7,4 +7,3 @@
|
||||
|
||||
# These are backup files generated by rustfmt
|
||||
**/*.rs.bk
|
||||
result
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
# Pushes a Docker image without needing access to the Docker daemon
|
||||
#
|
||||
# Pushing an image to a container registry authenticated:
|
||||
# DOCKER_USERNAME - Woodpecker CI Secret which is the container registry username
|
||||
# DOCKER_PASSWORD - Woodpecker CI Secret which is container registry password
|
||||
#
|
||||
# Adjust branches to test things.
|
||||
#
|
||||
pipeline:
|
||||
publish-docker-image:
|
||||
image: plugins/kaniko
|
||||
settings:
|
||||
registry: core.harbor.0.tus.us.bluequartz.xyz
|
||||
repo: core.harbor.0.tus.us.bluequartz.xyz/k8s/bin
|
||||
tags: latest,v2.0.0-${CI_COMMIT_SHA:0:8}
|
||||
dockerfile: Dockerfile
|
||||
username:
|
||||
from_secret: docker_username
|
||||
password:
|
||||
from_secret: docker_password
|
||||
branches: master
|
||||
4
Cargo.lock
generated
4
Cargo.lock
generated
@@ -1239,9 +1239,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "linked-hash-map"
|
||||
version = "0.5.4"
|
||||
version = "0.5.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7fb9b38af92608140b86b693604b9ffcc5824240a484d1ecd4795bacb2fe88f3"
|
||||
checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
|
||||
|
||||
[[package]]
|
||||
name = "local-channel"
|
||||
|
||||
@@ -12,9 +12,9 @@ argh = "0.1"
|
||||
log = "0.4"
|
||||
pretty_env_logger = "0.4"
|
||||
linked-hash-map = "0.5"
|
||||
once_cell = "1.14"
|
||||
once_cell = "1.10"
|
||||
parking_lot = "0.12"
|
||||
bytes = { version = "1.2", features = ["serde"] }
|
||||
bytes = { version = "1.1", features = ["serde"] }
|
||||
serde = { version = "1.0", features = ["derive"] }
|
||||
rand = { version = "0.8" }
|
||||
gpw = "0.1"
|
||||
@@ -24,7 +24,7 @@ htmlescape = "0.3"
|
||||
askama = "0.11"
|
||||
bat = "0.20"
|
||||
syntect = "4.6"
|
||||
tokio = { version = "1.20", features = ["sync"] }
|
||||
tokio = { version = "1.17", features = ["sync"] }
|
||||
futures = "0.3"
|
||||
|
||||
[profile.release]
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
FROM rust:1-slim-bookworm AS builder
|
||||
FROM rust:1-slim AS builder
|
||||
|
||||
RUN apt update && apt install -y libclang-dev
|
||||
|
||||
@@ -7,7 +7,8 @@ WORKDIR /sources
|
||||
RUN cargo build --release
|
||||
RUN chown nobody:nogroup /sources/target/release/bin
|
||||
|
||||
FROM gcr.io/distroless/cc-debian12
|
||||
|
||||
FROM debian:bullseye-slim
|
||||
COPY --from=builder /sources/target/release/bin /pastebin
|
||||
|
||||
USER nobody
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
version: '3'
|
||||
services:
|
||||
bin:
|
||||
build:
|
||||
context: .
|
||||
dockerfile: Dockerfile
|
||||
ports:
|
||||
- "8000:8000"
|
||||
77
flake.lock
generated
77
flake.lock
generated
@@ -1,77 +0,0 @@
|
||||
{
|
||||
"nodes": {
|
||||
"naersk": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1662220400,
|
||||
"narHash": "sha256-9o2OGQqu4xyLZP9K6kNe1pTHnyPz0Wr3raGYnr9AIgY=",
|
||||
"owner": "nix-community",
|
||||
"repo": "naersk",
|
||||
"rev": "6944160c19cb591eb85bbf9b2f2768a935623ed3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "master",
|
||||
"repo": "naersk",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1670118144,
|
||||
"narHash": "sha256-tdh9H4oomljZaKpCkZox8jmwt8p78oGLpK9cjFBy3Qk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "95f1ec721652d91a2993311d6cf537d3724690be",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"id": "nixpkgs",
|
||||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1670118144,
|
||||
"narHash": "sha256-tdh9H4oomljZaKpCkZox8jmwt8p78oGLpK9cjFBy3Qk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "95f1ec721652d91a2993311d6cf537d3724690be",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"naersk": "naersk",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"utils": "utils"
|
||||
}
|
||||
},
|
||||
"utils": {
|
||||
"locked": {
|
||||
"lastModified": 1667395993,
|
||||
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
83
flake.nix
83
flake.nix
@@ -1,83 +0,0 @@
|
||||
{
|
||||
inputs = {
|
||||
naersk.url = "github:nix-community/naersk/master";
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
|
||||
utils.url = "github:numtide/flake-utils";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, utils, naersk }:
|
||||
utils.lib.eachDefaultSystem (system:
|
||||
let
|
||||
pkgs = import nixpkgs { inherit system; };
|
||||
naersk-lib = pkgs.callPackage naersk { };
|
||||
in
|
||||
{
|
||||
defaultPackage = naersk-lib.buildPackage ./.;
|
||||
devShell = with pkgs; mkShell {
|
||||
buildInputs = [ cargo rustc rustfmt pre-commit rustPackages.clippy ];
|
||||
RUST_SRC_PATH = rustPlatform.rustLibSrc;
|
||||
};
|
||||
|
||||
nixosModules.default = { config, lib, pkgs, ... }:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.services.paste-bin;
|
||||
in
|
||||
{
|
||||
options.services.paste-bin = {
|
||||
enable = mkEnableOption "paste-bin";
|
||||
bindAddress = mkOption {
|
||||
default = "[::]:8000";
|
||||
description = "Address and port to listen on";
|
||||
type = types.str;
|
||||
};
|
||||
maxPasteSize = mkOption {
|
||||
default = 32768;
|
||||
description = "Max allowed size of an individual paste";
|
||||
type = types.int;
|
||||
};
|
||||
bufferSize = mkOption {
|
||||
default = 1000;
|
||||
description = "Maximum amount of pastes to store at a time";
|
||||
type = types.int;
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.bin = {
|
||||
enable = true;
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
ExecStart = "${self.defaultPackage."${system}"}/bin/bin --buffer-size ${toString cfg.bufferSize} --max-paste-size ${toString cfg.maxPasteSize} ${cfg.bindAddress}";
|
||||
Restart = "on-failure";
|
||||
|
||||
CapabilityBoundingSet = "";
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
PrivateMounts = true;
|
||||
ProtectHome = true;
|
||||
ProtectClock = true;
|
||||
ProtectProc = "noaccess";
|
||||
ProcSubset = "pid";
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
RestrictSUIDSGID = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictNamespaces = true;
|
||||
LockPersonality = true;
|
||||
RemoveIPC = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||
SystemCallFilter = [ "@system-service" "~@privileged" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
});
|
||||
}
|
||||
Reference in New Issue
Block a user