ConfigLMM 0.3.0 → 0.5.0

data/Plugins/Apps/GitLab/GitLab.lmm.rb

@@ -1,40 +1,46 @@
 
 module ConfigLMM
     module LMM
-        class GitLab < Framework::NginxApp
+        class GitLab < Framework::Plugin
 
             HOME_DIR = '/var/lib/gitlab'
+            IMAGE_ID = 'docker.io/gitlab/gitlab-ce:latest'
 
             def actionGitLabDeploy(id, target, activeState, context, options)
+                raise Framework::PluginProcessError.new('Domain field must be set!') unless target['Domain']
 
-                if target['Location'] && target['Location'] != '@me'
-                    uri = Addressable::URI.parse(target['Location'])
-                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
 
-                    self.class.sshStart(uri) do |ssh|
-                        self.prepareConfig(target, ssh)
-
-                        distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
-                        self.class.sshExec!(ssh, "mkdir -p #{HOME_DIR}/config")
-                        self.class.sshExec!(ssh, "mkdir -p #{HOME_DIR}/logs")
-                        self.class.sshExec!(ssh, "mkdir -p #{HOME_DIR}/data")
-                        self.class.sshExec!(ssh, "mkdir -p #{HOME_DIR}/backups")
+                        linuxConnection.createDirs(options, "#{HOME_DIR}/config", "#{HOME_DIR}/logs", "#{HOME_DIR}/data", "#{HOME_DIR}/backups")
 
                         path = '/etc/containers/systemd'
-                        ssh.scp.upload!(__dir__ + '/GitLab.container', path)
-                        self.class.sshExec!(ssh, "systemctl daemon-reload")
-                        self.class.sshExec!(ssh, "systemctl start GitLab")
+                        linuxConnection.upload(__dir__ + '/GitLab.container', path, options)
+
+                        if !target.key?('Proxy') || target['Proxy']
+                            Nginx.withConnection(linuxConnection) do |nginxConnection|
+                                nginxConnection.provisionProxy('http://127.0.0.1:18100', 'GitLab', target, activeState, context, options)
+                            end
+                        elsif target.key?('Proxy') && target['Proxy'] == false
+                            linuxConnection.fileReplace("#{path}/GitLab.container", 'PublishPort=127.0.0.1:18100:', 'PublishPort=0.0.0.0:18100:', options)
+                            linuxConnection.firewallAddPort('18100/tcp', options)
+                        end
 
-                        Framework::LinuxApp.ensureServiceAutoStartOverSSH(NGINX_PACKAGE, ssh)
-                        self.writeNginxConfig(__dir__, 'GitLab', id, target, state, context, options)
-                        self.deployNginxConfig(id, target, activeState, context, options)
-                        Framework::LinuxApp.startServiceOverSSH(NGINX_PACKAGE, ssh)
+                        linuxConnection.reloadServiceManager(options)
+                        linuxConnection.restartService('GitLab', options)
 
-                        configFile = '/var/lib/gitlab/config/gitlab.rb'
-                        while !self.class.remoteFilePresent?(configFile, ssh)
-                            sleep(2)
+                        configFile = HOME_DIR + '/config/gitlab.rb'
+                        if options['dry']
+                            linuxConnection.filePresent?(configFile, options)
+                        else
+                            counter = 200
+                            while !linuxConnection.filePresent?(configFile, options)
+                                counter -= 1
+                                raise "Timeout while waiting for #{configFile}!" if counter <= 0
+                                sleep(2)
+                            end
                         end
-                        updateRemoteFile(ssh, configFile, options, true) do |fileLines|
+                        linuxConnection.updateFile(configFile, options, true) do |fileLines|
                             fileLines << "external_url 'https://#{target['Domain']}'\n"
                             fileLines << "letsencrypt['enable'] = false\n"
                             fileLines << "nginx['listen_port'] = 80\n"
@@ -44,9 +50,9 @@ module ConfigLMM
                             fileLines << "mattermost_nginx['listen_port'] = 80\n"
                             fileLines << "mattermost_nginx['listen_https'] = false\n"
                             if target['SMTP']
-                                fileLines << "gitlab_rails['smtp_address'] = '#{target['SMTP']['HostName']}'\n"
+                                fileLines << "gitlab_rails['smtp_address'] = '#{target['SMTP']['Host']}'\n"
                                 fileLines << "gitlab_rails['smtp_port'] = '#{target['SMTP']['Port']}'\n"
-                                fileLines << "gitlab_rails['smtp_user_name'] = '#{target['SMTP']['User']}'\n"
+                                fileLines << "gitlab_rails['smtp_user_name'] = '#{target['SMTP']['Username']}'\n"
                                 if target['SMTP']['TLS']
                                     fileLines << "gitlab_rails['smtp_tls'] = true\n"
                                     fileLines << "gitlab_rails['smtp_openssl_verify_mode'] = 'peer'\n"
@@ -54,18 +60,31 @@ module ConfigLMM
                             end
                         end
 
-                        self.class.sshExec!(ssh, "systemctl restart GitLab")
+                        linuxConnection.restartService('GitLab', options)
                     end
-                else
-                    # TODO
                 end
             end
 
-            def prepareConfig(target, ssh)
-              raise Framework::PluginProcessError.new('Domain field must be set!') unless target['Domain']
-
-              Framework::LinuxApp.ensurePackages([NGINX_PACKAGE], ssh)
-              self.class.prepareNginxConfig(target, ssh)
+            def cleanup(configs, state, context, options)
+                cleanupType(:GitLab, configs, state, context, options) do |item, id, state, context, options, connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        if item['Config']['Proxy'].nil? || item['Config']['Proxy']
+                            Nginx.withConnection(linuxConnection) do |nginxConnection|
+                                nginxConnection.cleanupConfig('GitLab', context, options)
+                                nginxConnection.reload(options)
+                            end
+                        end
+                        linuxConnection.firewallRemovePort('18100/tcp', options)
+                        linuxConnection.stopService('GitLab', options)
+                        linuxConnection.rm('/etc/containers/systemd/GitLab.container', options[:dry])
+                        linuxConnection.exec("podman rmi #{IMAGE_ID}", true, options)
+                        state.item(id)['Status'] = State::STATUS_DELETED unless options[:dry]
+                        if options[:destroy]
+                            connection.rm('/var/lib/gitlab', options[:dry])
+                            state.item(id)['Status'] = State::STATUS_DESTROYED unless options[:dry]
+                        end
+                    end
+                end
             end
 
         end

data/Plugins/Apps/Homepage/Homepage.conf.erb

@@ -0,0 +1,86 @@
+
+server {
+
+    <% if config['NginxVersion'] >= 1.25 %>
+        <% if !config['TLS'] %>
+            listen       <%= config['Port'] %>;
+            listen  [::]:<%= config['Port'] %>;
+        <% else %>
+            listen       <%= config['Port'] %> ssl;
+            listen  [::]:<%= config['Port'] %> ssl;
+
+            include config-lmm/ssl.conf;
+        <% end %>
+        http2 on;
+        http3 on;
+        quic_retry on;
+        add_header Alt-Svc 'h3=":443"; ma=86400';
+    <% else %>
+        <% if !config['TLS'] %>
+            listen       <%= config['Port'] %>;
+            listen  [::]:<%= config['Port'] %>;
+        <% else %>
+            listen       <%= config['Port'] %> ssl http2;
+            listen  [::]:<%= config['Port'] %> ssl http2;
+
+            include config-lmm/ssl.conf;
+        <% end %>
+    <% end %>
+
+    server_name <%= config['Domain'] %>;
+
+    <% if config['AuthentikDomain'].nil? %>
+        include config-lmm/private.conf;
+    <% end %>
+
+    include config-lmm/errors.conf;
+
+    <% if config['CertName'] %>
+        ssl_certificate "/etc/letsencrypt/live/<%= config['CertName'] %>/fullchain.pem";
+        ssl_certificate_key "/etc/letsencrypt/live/<%= config['CertName'] %>/privkey.pem";
+        ssl_trusted_certificate "/etc/letsencrypt/live/<%= config['CertName'] %>/chain.pem";
+    <% end %>
+
+    location / {
+        proxy_pass <%= config['Server'] %>;
+
+        <% if config['AuthentikDomain'] %>
+            error_page       401 = @authenticate;
+            include config-lmm/errors.conf;
+
+            auth_request     /outpost.goauthentik.io/auth/nginx;
+
+            # translate headers from the outposts back to the actual upstream
+            auth_request_set $authentik_username $upstream_http_x_authentik_username;
+            auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
+            auth_request_set $authentik_email $upstream_http_x_authentik_email;
+            auth_request_set $authentik_name $upstream_http_x_authentik_name;
+            auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
+
+            proxy_set_header REMOTE_USER $authentik_username;
+            proxy_set_header REMOTE_GROUPS $authentik_groups;
+            proxy_set_header REMOTE_EMAIL $authentik_email;
+            proxy_set_header REMOTE_NAME $authentik_name;
+            proxy_set_header REMOTE_UID $authentik_uid;
+        <% end %>
+
+        include config-lmm/proxy.conf;
+    }
+
+    <% if config['AuthentikDomain'] %>
+        location /outpost.goauthentik.io {
+            proxy_pass              https://<%= config['AuthentikDomain'] %>/outpost.goauthentik.io;
+            proxy_ssl_protocols     TLSv1.2 TLSv1.3;
+            proxy_set_header        X-Authentik-Host $host;
+            proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
+            proxy_pass_request_body off;
+            proxy_set_header        Content-Length "";
+        }
+
+        location @authenticate {
+            internal;
+            return 302 /outpost.goauthentik.io/start?rd=$request_uri;
+        }
+    <% end %>
+}
+

data/Plugins/Apps/Homepage/Homepage.container

@@ -0,0 +1,19 @@
+
+[Unit]
+Description=Homepage container
+After=local-fs.target
+
+[Container]
+ContainerName=Homepage
+Image=ghcr.io/gethomepage/homepage:latest
+PublishPort=127.0.0.1:13400:3000
+LogDriver=journald
+AutoUpdate=registry
+Volume=/var/lib/homepage/config:/app/config
+
+[Service]
+TimeoutStartSec=3min
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/Homepage/Homepage.lmm.rb

@@ -0,0 +1,54 @@
+
+module ConfigLMM
+    module LMM
+        class Homepage < Framework::Plugin
+
+            NAME = 'Homepage'
+            USER = 'homepage'
+            HOME_DIR = '/var/lib/homepage'
+
+            def actionHomepageBuild(id, target, activeState, context, options)
+                Nginx.withConnection(local) do |nginxConnection|
+                    nginxConnection.writeConfig(__dir__, NAME, target, state, context, options)
+                end
+            end
+
+            def actionHomepageDeploy(id, target, activeState, context, options)
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        if !target.key?('Proxy') || target['Proxy'] != 'only'
+                            Podman.ensurePresent(linuxConnection, options)
+                            Podman.createUser(USER, HOME_DIR, 'Homepage', linuxConnection, options)
+                            linuxConnection.withUserShell(USER) do |shell|
+                                shell.createDirs(options, '~/config')
+                            end
+
+                            configPath = './Homepage'
+                            configPath = target['ConfigPath'] if target['ConfigPath']
+                            Dir[configPath + '/*'].each do |file|
+                                linuxConnection.upload(file, HOME_DIR + '/config/', options)
+                            end
+
+                            path = Podman.containersPath(HOME_DIR)
+                            linuxConnection.upload(__dir__ + '/Homepage.container', path, options)
+                            if target.key?('Proxy') && target['Proxy'] == false
+                                linuxConnection.exec("sed -i 's|PublishPort=127.0.0.1:13400:|PublishPort=0.0.0.0:13400:|' #{path}/Homepage.container", false, options)
+                                linuxConnection.firewallAddPort('13400/tcp', options)
+                            end
+
+                            linuxConnection.reloadUserServices(USER, options)
+                            linuxConnection.restartUserService(USER, 'Homepage', options)
+                        end
+                        if !target.key?('Proxy') || !!target['Proxy']
+                            Nginx.withConnection(linuxConnection) do |nginxConnection|
+                                target['ConfigName'] = target['Name']
+                                nginxConnection.provision(__dir__, NAME, target, activeState, context, options)
+                            end
+                        end
+                    end
+                end
+            end
+
+        end
+    end
+end

data/Plugins/Apps/IPFS/IPFS.conf.erb

@@ -20,9 +20,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/ipfs.access.log;
-    error_log   /var/log/nginx/ipfs.error.log;
-
     include config-lmm/private.conf;
     include config-lmm/errors.conf;
 

data/Plugins/Apps/IPFS/IPFS.lmm.rb

@@ -14,7 +14,6 @@ module ConfigLMM
             def actionIPFSDeploy(id, target, activeState, context, options)
                 if !target['Location'] || target['Location'] == '@me'
                     deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
             end
 

data/Plugins/Apps/InfluxDB/InfluxDB.conf.erb

@@ -16,9 +16,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/influxdb.access.log;
-    error_log   /var/log/nginx/influxdb.error.log;
-
     include config-lmm/private.conf;
     include config-lmm/errors.conf;
 

data/Plugins/Apps/InfluxDB/InfluxDB.lmm.rb

@@ -10,7 +10,6 @@ module ConfigLMM
             def actionInfluxDBDeploy(id, target, activeState, context, options)
                 if !target['Location'] || target['Location'] == '@me'
                     deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
             end
 

data/Plugins/Apps/Jackett/Jackett.conf.erb

@@ -16,9 +16,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/jackett.access.log;
-    error_log   /var/log/nginx/jackett.error.log;
-
     include config-lmm/private.conf;
     include config-lmm/errors.conf;
 

data/Plugins/Apps/Jackett/Jackett.lmm.rb

@@ -10,7 +10,6 @@ module ConfigLMM
             def actionJackettDeploy(id, target, activeState, context, options)
                 if !target['Location'] || target['Location'] == '@me'
                     deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
             end
 

data/Plugins/Apps/Jellyfin/Jellyfin.conf.erb

@@ -17,9 +17,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/jellyfin.access.log;
-    error_log   /var/log/nginx/jellyfin.error.log;
-
     include config-lmm/errors.conf;
     include config-lmm/ssl.conf;
 

data/Plugins/Apps/Jellyfin/Jellyfin.lmm.rb

@@ -14,7 +14,6 @@ module ConfigLMM
             def actionJellyfinDeploy(id, target, activeState, context, options)
                 if !target['Location'] || target['Location'] == '@me'
                     deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
             end
 

data/Plugins/Apps/LetsEncrypt/LetsEncrypt.lmm.rb

@@ -0,0 +1,78 @@
+
+module ConfigLMM
+    module LMM
+        class LetsEncrypt < Framework::LinuxApp
+
+            PACKAGE_NAME = 'CertBotNginx'
+            CONFIG_DIR = '/etc/letsencrypt/'
+
+            def actionLetsEncryptDeploy(id, target, activeState, context, options)
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        linuxConnection.ensurePackage(PACKAGE_NAME, options)
+
+                        linuxConnection.upload(__dir__ + '/rfc2136.ini', CONFIG_DIR, options)
+                        linuxConnection.upload(__dir__ + '/renew-certificates.service', '/etc/systemd/system/', options)
+                        linuxConnection.upload(__dir__ + '/renew-certificates.timer', '/etc/systemd/system/', options)
+                        linuxConnection.createDirs(options, CONFIG_DIR + "renewal-hooks/deploy")
+                        target['Hooks'].to_a.each do |hook|
+                            linuxConnection.upload(__dir__ + '/hooks/' + hook + '.sh', "#{CONFIG_DIR}renewal-hooks/deploy/", options)
+                        end
+                        linuxConnection.exec("chmod +x #{CONFIG_DIR}renewal-hooks/deploy/*.sh", false, options)
+                        linuxConnection.fileReplace(CONFIG_DIR + 'rfc2136.ini', '\$IP', target['DNS']['IP'] , options)
+
+                        secretId, secretName = target['DNS']['SecretId'].to_s.split('.')
+                        key = nil
+                        key = context.secrets.load(secretId, secretName) if secretId && secretName
+                        key = context.secrets.load('LETSENCRYPT', 'DNS_SECRET') if key.nil?
+                        raise Framework::PluginProcessError.new('LetsEncrypt missing RFC2136 TSIG key! Specify DNS.SecretId or LETSENCRYPT_DNS_SECRET env variable') unless key
+
+                        linuxConnection.fileReplace(CONFIG_DIR + 'rfc2136.ini', '\$SECRET', key, options)
+                        linuxConnection.setPrivate(CONFIG_DIR + 'rfc2136.ini', options)
+                        if target['Domain']
+                            createCertificate('Wildcard', target['Domain'], target, linuxConnection, options)
+                        end
+                        target['Certificates'].to_h.each do |name, domains|
+                            createCertificate(name, domains, target, linuxConnection, options)
+                        end
+
+                        linuxConnection.reloadServiceManager(options)
+                        linuxConnection.ensureServiceAutoStart('renew-certificates.timer', options)
+                        linuxConnection.startService('renew-certificates.timer', options)
+
+                        target['Hooks'].to_a.each do |hook|
+                            linuxConnection.exec("#{CONFIG_DIR}renewal-hooks/deploy/#{hook}.sh", false, options)
+                        end
+                    end
+                end
+            end
+
+            def createCertificate(name, domains, target, connection, options)
+                return if connection.fileLink?("#{CONFIG_DIR}live/#{name}/fullchain.pem", options)
+                connection.exec("rm -rf #{CONFIG_DIR}live/#{name}", false, options)
+
+                domainList = []
+                domains = [domains] unless domains.is_a?(Array)
+                domains.each do |domain|
+                    domainList << '--domains "' + Addressable::IDNA.to_ascii(domain) + '"'
+                    if addBaseDomain?(domain, domains)
+                        domainList << '--domains "' + Addressable::IDNA.to_ascii(domain[2..-1]) + '"'
+                    end
+                end
+                extra = ''
+                extra = '--dns-rfc2136-propagation-seconds ' + target['DNS']['Propagation'].to_s if target['DNS']['Propagation']
+
+                connection.exec("certbot certonly --dns-rfc2136 --dns-rfc2136-credentials=#{CONFIG_DIR}rfc2136.ini #{extra} --non-interactive --agree-tos --email #{target['EMail']} --cert-name '#{name}' #{domainList.join(' ')}", false, options)
+            end
+
+            def addBaseDomain?(domain, domains)
+                return false unless domain.start_with?('*.')
+                match = '*.' + domain[2..-1].split('.')[1..].join('.')
+                return false if match == '*.' || domains.any? { |d| d.casecmp?(match) }
+                true
+            end
+
+        end
+
+    end
+end

data/Plugins/Apps/LetsEncrypt/hooks/dovecot.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/sh
+systemctl reload dovecot

data/Plugins/Apps/LetsEncrypt/hooks/nginx.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/sh
+systemctl reload nginx

data/Plugins/Apps/LetsEncrypt/hooks/postfix.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/sh
+systemctl reload postfix

data/Plugins/Apps/LetsEncrypt/renew-certificates.service

@@ -0,0 +1,7 @@
+
+[Unit]
+Description=Renew certificates
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/certbot renew

data/Plugins/Apps/LetsEncrypt/renew-certificates.timer

@@ -0,0 +1,12 @@
+
+[Unit]
+Description=Renew certificates
+
+[Timer]
+OnCalendar=*-*-1/2 04:20
+AccuracySec=12h
+RandomizedDelaySec=24h
+Persistent=true
+
+[Install]
+WantedBy=timers.target

data/Plugins/Apps/LetsEncrypt/rfc2136.ini

@@ -0,0 +1,11 @@
+
+# Target DNS server
+dns_rfc2136_server = $IP
+# Target DNS port
+dns_rfc2136_port = 53
+# TSIG key name
+dns_rfc2136_name = configlmm.
+# TSIG key secret
+dns_rfc2136_secret = $SECRET
+# TSIG key algorithm
+dns_rfc2136_algorithm = HMAC-SHA512

data/Plugins/Apps/LibreTranslate/LibreTranslate.container

@@ -0,0 +1,21 @@
+
+[Unit]
+Description=LibreTranslate container
+After=local-fs.target
+
+[Container]
+ContainerName=LibreTranslate
+Image=docker.io/libretranslate/libretranslate:latest
+Exec=--host 0.0.0.0 $ARGS
+PublishPort=127.0.0.1:15100:5000
+UserNS=keep-id:uid=1032,gid=1032
+Volume=/var/lib/libretranslate/.local:/home/libretranslate/.local
+LogDriver=journald
+AutoUpdate=registry
+
+[Service]
+TimeoutStartSec=32min
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/LibreTranslate/LibreTranslate.lmm.rb

@@ -0,0 +1,34 @@
+
+module ConfigLMM
+    module LMM
+        class LibreTranslate < Framework::Plugin
+
+            USER = 'libretranslate'
+            HOME_DIR = '/var/lib/libretranslate'
+
+            def actionLibreTranslateDeploy(id, target, activeState, context, options)
+
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        Podman.ensurePresent(linuxConnection, options)
+                        Podman.createUser(USER, HOME_DIR, 'LibreTranslate', linuxConnection, options)
+
+                        path = Podman.containersPath(HOME_DIR)
+
+                        linuxConnection.upload(__dir__ + '/LibreTranslate.container', path, options)
+
+                        args = ['--metrics']
+                        linuxConnection.fileReplace("#{path}/LibreTranslate.container", '\$ARGS', args.join(' '), options)
+                        if target['Listen']
+                            linuxConnection.fileReplace("#{path}/LibreTranslate.container", '127.0.0.1', target['Listen'], options)
+                        end
+
+                        linuxConnection.reloadUserServices(USER, options)
+                        linuxConnection.restartUserService(USER, 'LibreTranslate', options)
+                    end
+                end
+            end
+
+        end
+    end
+end

data/Plugins/Apps/Lobsters/Containerfile

@@ -0,0 +1,81 @@
+# Use an official Ruby image as a base
+ARG RUBY_VERSION
+FROM ruby:${RUBY_VERSION} AS base
+
+# Install base packages
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y curl libjemalloc2 libvips sqlite3 mariadb-client sendmail vim && \
+    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+
+# Latest releases available at https://github.com/aptible/supercronic/releases
+ENV SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.33/supercronic-linux-amd64 \
+    SUPERCRONIC_SHA1SUM=71b0d58cc53f6bd72cf2f293e09e294b79c666d8 \
+    SUPERCRONIC=supercronic-linux-amd64
+
+RUN curl -fsSLO "$SUPERCRONIC_URL" \
+ && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
+ && chmod +x "$SUPERCRONIC" \
+ && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
+ && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic
+
+ENV BUNDLE_DEPLOYMENT="1" BUNDLE_PATH="/usr/local/bundle" BUNDLE_WITHOUT="development"
+
+# Throw-away build stage to reduce size of final image
+FROM base AS build
+
+# Install packages needed to build gems
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y build-essential git libyaml-dev pkg-config && \
+    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+
+# Set working directory
+WORKDIR /lobsters
+
+COPY . .
+
+# Install application gems
+RUN bundle install && \
+    rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git
+
+RUN mkdir -p /srv/lobste.rs/log && \
+    ln -sf /lobsters /srv/lobste.rs/http
+
+# Temporary generate secrets
+RUN RAILS_ENV=production ./bin/rails credentials:edit
+
+# Precompiling assets for production without requiring secret RAILS_MASTER_KEY
+RUN SECRET_KEY_BASE_DUMMY=1 RAILS_ENV=production ./bin/rails assets:precompile
+
+# Remove secrets
+RUN rm -rf ./config/credentials.yml.enc ./config/master.key ./config/database.yml ./tmp/* /srv/lobste.rs/log/*
+
+# Final stage for app image
+FROM base
+
+WORKDIR /lobsters
+
+# Copy built artifacts: gems, application
+COPY --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
+COPY --from=build /lobsters /lobsters
+COPY --from=build /srv/lobste.rs /srv/lobste.rs
+
+COPY crontab /etc/
+
+RUN ln -sf /config/master.key /lobsters/config/master.key && \
+    ln -sf /config/credentials.yml.enc /lobsters/config/credentials.yml.enc && \
+    ln -sf /config/database.yml /lobsters/config/database.yml
+
+RUN mv /lobsters/public /lobsters/public_source && ln -sf /srv/lobsters/public /lobsters/public
+
+# Run and own only the runtime files as a non-root user for security
+RUN groupadd --system --gid 1000 lobsters && \
+    useradd lobsters --uid 1000 --gid 1000 --create-home --shell /bin/bash && \
+    chown -R lobsters:lobsters /lobsters/tmp /srv/lobste.rs/log
+
+ENV LD_PRELOAD="/usr/lib/x86_64-linux-gnu/libjemalloc.so.2"
+
+# Expose port for Rails server
+EXPOSE 9292
+
+ENTRYPOINT ["/lobsters/entrypoint.sh"]
+CMD ["server"]