From f84052dedbd5a989fb1ee7fa6bdc496310678b1f Mon Sep 17 00:00:00 2001 From: sandseb123 Date: Sat, 21 Mar 2026 19:45:25 +0000 Subject: [PATCH 1/2] Add Docker support for self-hosting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Dockerfile using nginx:alpine with non-root user and read-only filesystem - docker-compose.yml with security hardening (no-new-privileges, read_only) - .dockerignore to keep image minimal - Release workflow now builds and pushes to GitHub Container Registry on tags Usage: docker compose up (serves on localhost:8080) Not required — the HTML file still works standalone in any browser. https://claude.ai/code/session_01YEw32MPxq1uz6jYsLFQnVC --- .dockerignore | 10 ++++++++++ .github/workflows/release.yml | 33 +++++++++++++++++++++++++++++++++ Dockerfile | 17 +++++++++++++++++ docker-compose.yml | 9 +++++++++ 4 files changed, 69 insertions(+) create mode 100644 .dockerignore create mode 100644 Dockerfile create mode 100644 docker-compose.yml diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..198a0e1 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,10 @@ +node_modules +.git +.github +tests +*.md +LICENSE +package*.json +build.js +.gitignore +.DS_Store diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index aa470d2..3cfe68f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,6 +7,7 @@ on: permissions: contents: write + packages: write jobs: release: @@ -40,3 +41,35 @@ jobs: files: | fire_calculator.html fire_calculator.html.sha256 + + docker: + name: Build & Push Docker Image + runs-on: ubuntu-latest + needs: release + steps: + - uses: actions/checkout@v4 + + - name: Log in to GitHub Container Registry + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract version tag + id: meta + uses: docker/metadata-action@v5 + with: + images: ghcr.io/${{ github.repository }} + tags: | + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=raw,value=latest + + - name: Build and push Docker image + uses: docker/build-push-action@v6 + with: + context: . + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..6983aa0 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,17 @@ +FROM nginx:alpine + +LABEL maintainer="sandseb123" +LABEL description="FirePath-Core — local-first FIRE calculator" + +COPY fire_calculator.html /usr/share/nginx/html/index.html + +# Security: run as non-root, drop capabilities +RUN chown -R nginx:nginx /usr/share/nginx/html && \ + chmod -R 555 /usr/share/nginx/html + +EXPOSE 80 + +HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ + CMD wget -qO- http://localhost/ || exit 1 + +USER nginx diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..2f8721f --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,9 @@ +services: + firepath: + build: . + ports: + - "8080:80" + restart: unless-stopped + read_only: true + security_opt: + - no-new-privileges:true From f6d3c8e869b27f0710848be162c396ab8163b5d9 Mon Sep 17 00:00:00 2001 From: sandseb123 Date: Sat, 21 Mar 2026 21:22:14 +0000 Subject: [PATCH 2/2] =?UTF-8?q?Remove=20Docker=20support=20=E2=80=94=20unn?= =?UTF-8?q?ecessary=20for=20standalone=20HTML=20app?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://claude.ai/code/session_01YEw32MPxq1uz6jYsLFQnVC --- .dockerignore | 10 ---------- .github/workflows/release.yml | 33 --------------------------------- Dockerfile | 17 ----------------- docker-compose.yml | 9 --------- 4 files changed, 69 deletions(-) delete mode 100644 .dockerignore delete mode 100644 Dockerfile delete mode 100644 docker-compose.yml diff --git a/.dockerignore b/.dockerignore deleted file mode 100644 index 198a0e1..0000000 --- a/.dockerignore +++ /dev/null @@ -1,10 +0,0 @@ -node_modules -.git -.github -tests -*.md -LICENSE -package*.json -build.js -.gitignore -.DS_Store diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3cfe68f..aa470d2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,7 +7,6 @@ on: permissions: contents: write - packages: write jobs: release: @@ -41,35 +40,3 @@ jobs: files: | fire_calculator.html fire_calculator.html.sha256 - - docker: - name: Build & Push Docker Image - runs-on: ubuntu-latest - needs: release - steps: - - uses: actions/checkout@v4 - - - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Extract version tag - id: meta - uses: docker/metadata-action@v5 - with: - images: ghcr.io/${{ github.repository }} - tags: | - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - type=raw,value=latest - - - name: Build and push Docker image - uses: docker/build-push-action@v6 - with: - context: . - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} diff --git a/Dockerfile b/Dockerfile deleted file mode 100644 index 6983aa0..0000000 --- a/Dockerfile +++ /dev/null @@ -1,17 +0,0 @@ -FROM nginx:alpine - -LABEL maintainer="sandseb123" -LABEL description="FirePath-Core — local-first FIRE calculator" - -COPY fire_calculator.html /usr/share/nginx/html/index.html - -# Security: run as non-root, drop capabilities -RUN chown -R nginx:nginx /usr/share/nginx/html && \ - chmod -R 555 /usr/share/nginx/html - -EXPOSE 80 - -HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ - CMD wget -qO- http://localhost/ || exit 1 - -USER nginx diff --git a/docker-compose.yml b/docker-compose.yml deleted file mode 100644 index 2f8721f..0000000 --- a/docker-compose.yml +++ /dev/null @@ -1,9 +0,0 @@ -services: - firepath: - build: . - ports: - - "8080:80" - restart: unless-stopped - read_only: true - security_opt: - - no-new-privileges:true