satoshi
cb739867cc
New 'tls' union config (disabled by default) spins up an
stunnel4 process inside the container that terminates TLS on
a configurable port (3334 by default) and forwards decrypted
stratum traffic to 127.0.0.1:${STRATUM_PORT}.
Cert is self-signed, generated once on first start with a
10-year validity and persisted at /root/.kamado/tls/ so the
fingerprint stays stable across restarts. SHA-256 fingerprint
is printed to container logs on each startup so users can
pin it on their miners. Miners must connect with
verification disabled (no CA trust chain for a private pool).
Runtime image grows by ~3MB for stunnel4 + openssl. The
supervisor loop now waits on three PIDs and tears all of them
down together if any one exits.
101 lines
3.9 KiB
Docker
101 lines
3.9 KiB
Docker
# syntax=docker/dockerfile:1.6
|
|
#
|
|
# Kamado Pool StartOS package image.
|
|
#
|
|
# KamadoPool source is supplied via a named build context so the image
|
|
# is built from the local checkout (no GitHub, no pinned SHA). The
|
|
# Makefile passes `--build-context kamado=../KamadoPool` — adjust if
|
|
# your checkout lives elsewhere.
|
|
#
|
|
# After the source stage, the ckpool/ui/api build steps mirror the
|
|
# stages in KamadoPool's own ckpool/Dockerfile and api/Dockerfile.
|
|
|
|
ARG CKPOOL_REPO=https://bitbucket.org/ckolivas/ckpool.git
|
|
ARG CKPOOL_COMMIT=cfb0f83b70d7b382b85d2bd0710cf4cb2dda4007
|
|
ARG ARCH
|
|
|
|
# ---------- stage 1: materialize Kamado source ----------
|
|
# `kamado` is a named build context — the Makefile passes
|
|
# --build-context kamado=../KamadoPool so this COPY pulls directly
|
|
# from the local checkout.
|
|
FROM scratch AS source
|
|
COPY --from=kamado . /src/kamado/
|
|
|
|
# ---------- stage 2: build patched ckpool ----------
|
|
# Mirrors KamadoPool/ckpool/Dockerfile: clones upstream ckpool at the
|
|
# pinned commit, applies Kamado patches, builds with portable CFLAGS.
|
|
FROM debian:bookworm-slim AS ckpool-build
|
|
ARG CKPOOL_REPO
|
|
ARG CKPOOL_COMMIT
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential autoconf automake libtool pkg-config \
|
|
libzmq3-dev ca-certificates git \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /build
|
|
RUN git clone "${CKPOOL_REPO}" ckpool \
|
|
&& cd ckpool && git checkout "${CKPOOL_COMMIT}"
|
|
COPY --from=source /src/kamado/ckpool/patches/ /tmp/kamado-patches/
|
|
RUN set -eux; cd /build/ckpool; \
|
|
for p in /tmp/kamado-patches/*.patch; do \
|
|
[ -f "$p" ] || continue; \
|
|
echo "Applying $(basename "$p")"; \
|
|
git apply --verbose "$p"; \
|
|
done
|
|
RUN cd /build/ckpool \
|
|
&& ./autogen.sh \
|
|
&& CFLAGS="-O2 -Wall -pipe" ./configure --prefix=/usr/local \
|
|
&& make -j"$(nproc)"
|
|
RUN install -Dm755 /build/ckpool/src/ckpool /out/usr/local/bin/ckpool \
|
|
&& install -Dm755 /build/ckpool/src/ckpmsg /out/usr/local/bin/ckpmsg
|
|
|
|
# ---------- stage 3: build the Svelte UI ----------
|
|
FROM node:22-bookworm-slim AS ui-build
|
|
WORKDIR /ui
|
|
COPY --from=source /src/kamado/ui/package.json ./
|
|
RUN npm install --no-audit --no-fund
|
|
COPY --from=source /src/kamado/ui/ ./
|
|
RUN npm run build
|
|
|
|
# ---------- stage 4: build the Go api with embedded UI ----------
|
|
FROM golang:1.22-bookworm AS api-build
|
|
WORKDIR /src
|
|
COPY --from=source /src/kamado/api/go.mod ./
|
|
RUN go mod download 2>/dev/null || true
|
|
COPY --from=source /src/kamado/api/ ./
|
|
RUN rm -rf internal/webui/dist && mkdir -p internal/webui/dist
|
|
COPY --from=ui-build /ui/dist/ internal/webui/dist/
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-trimpath -ldflags="-s -w" \
|
|
-o /out/kamado-api ./cmd/kamado-api
|
|
|
|
# ---------- stage 5: runtime ----------
|
|
FROM debian:bookworm-slim AS runtime
|
|
ARG ARCH
|
|
ARG YQ_VERSION=v4.44.3
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
tini ca-certificates curl libzmq5 stunnel4 openssl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# yq for reading StartOS config.yaml in the entrypoint
|
|
RUN set -eu; \
|
|
case "${ARCH}" in \
|
|
x86_64|amd64) YQ_ARCH=amd64 ;; \
|
|
aarch64|arm64) YQ_ARCH=arm64 ;; \
|
|
*) echo "unsupported arch: ${ARCH}" >&2; exit 1 ;; \
|
|
esac; \
|
|
curl -fsSL -o /usr/local/bin/yq \
|
|
"https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_${YQ_ARCH}"; \
|
|
chmod +x /usr/local/bin/yq
|
|
|
|
COPY --from=ckpool-build /out/usr/local/bin/ckpool /usr/local/bin/ckpool
|
|
COPY --from=ckpool-build /out/usr/local/bin/ckpmsg /usr/local/bin/ckpmsg
|
|
COPY --from=api-build /out/kamado-api /usr/local/bin/kamado-api
|
|
COPY --from=source /src/kamado/ckpool/config/ckpool.conf.template /etc/ckpool/ckpool.conf.template
|
|
COPY docker_entrypoint.sh /usr/local/bin/docker_entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/docker_entrypoint.sh \
|
|
&& mkdir -p /run/ckpool /var/log/ckpool /var/lib/kamado
|
|
|
|
EXPOSE 3333 3334 8080
|
|
WORKDIR /root
|
|
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/docker_entrypoint.sh"]
|