neiam /dms

:-\

7786f28 · gmorell · 2026-05-08 05:42

4 files +23 -15

modified Dockerfile

+11 −14

@@ -1,9 +1,7 @@

1		−# syntax=docker/dockerfile:1.7
2		−#
3		−# Built with `podman build` / `podman compose build`. The `docker/dockerfile`
4		−# syntax pragma is honoured by buildah (podman's builder) too — no Docker
5		−# daemon required. If you don't have the BuildKit cache mounts feature
6		−# enabled, drop the `--mount=type=cache` lines in the rust-builder stage.
	1	+# Built with `podman build` / `podman compose build` locally and Kaniko in
	2	+# CI. Stays Kaniko-clean: no `# syntax=docker/dockerfile:…` directive (Kaniko
	3	+# ignores it) and no BuildKit cache mounts (Kaniko unmounts them between
	4	+# RUN steps, so subsequent `cp` from the cached target/ would miss).
7	5
8	6	# ---------------------------------------------------------------------------
9	7	# Stage 1 — assets: compile Tailwind CSS and stage FontAwesome webfonts.

@@ -28,9 +26,10 @@ RUN cd assets \

28	26	# ---------------------------------------------------------------------------
29	27	# Stage 2 — rust-builder: build all three binaries in release mode.
30	28	#
31		−# We don't bother with cargo-chef here — first build is slow, but subsequent
32		−# rebuilds with the same Cargo.lock benefit from BuildKit's layer cache plus
33		−# the cargo registry/git cache mounts below.
	29	+# Kept Kaniko-friendly: no BuildKit cache mounts (Kaniko unmounts them
	30	+# before subsequent steps, so cp-ing from a cached target/ would silently
	31	+# miss the binaries). Layer caching from the COPY ordering below
	32	+# (Cargo.toml/Cargo.lock first, then src) still helps local rebuilds.
34	33	# ---------------------------------------------------------------------------
35	34	FROM rust:1.92-bookworm AS rust-builder
36	35	WORKDIR /app

@@ -48,17 +47,15 @@ COPY templates templates

48	47	# (which embeds templates) and ServeDir at runtime have what they need.
49	48	COPY --from=assets /app/assets/f ./assets/f
50	49
51		−RUN --mount=type=cache,target=/usr/local/cargo/registry \
52		− --mount=type=cache,target=/usr/local/cargo/git \
53		− --mount=type=cache,target=/app/target \
54		− cargo build --release \
	50	+RUN cargo build --release \
55	51	--bin webservice \
56	52	--bin queue-worker \
57	53	--bin registration-token \
58	54	&& mkdir -p /out \
59	55	&& cp target/release/webservice /out/ \
60	56	&& cp target/release/queue-worker /out/ \
61		− && cp target/release/registration-token /out/
	57	+ && cp target/release/registration-token /out/ \
	58	+ && rm -rf target
62	59
63	60	# ---------------------------------------------------------------------------
64	61	# Stage 3 — ocr-models: pre-fetch the ocrs detection + recognition .rten

modified src/bin/webservice.rs

+12 −1

@@ -60,8 +60,18 @@ async fn main() -> Result<(), anyhow::Error> {

60	60	config: config.clone(),
61	61	};
62	62
63		− let protected_routes = Router::new()
	63	+ // The landing page reads `Option<UserContext>` so it works for both
	64	+ // anonymous visitors and signed-in users — give it the optional-auth
	65	+ // middleware so the cookie populates the extension when present without
	66	+ // 302-ing anonymous visitors away.
	67	+ let public_routes = Router::new()
64	68	.route("/", get(root))
	69	+ .layer(axum::middleware::from_fn_with_state(
	70	+ app_state.db.clone(),
	71	+ middleware::optional_auth_middleware,
	72	+ ));
	73	+
	74	+ let protected_routes = Router::new()
65	75	.route("/profile", get(handlers::show_profile))
66	76	.route("/invites", get(handlers::show_invites).post(handlers::handle_create_invite))
67	77	.route("/api-tokens", get(handlers::show_api_tokens).post(handlers::create_api_token))

@@ -101,6 +111,7 @@ async fn main() -> Result<(), anyhow::Error> {

101	111	}))
102	112	.nest_service("/assets", ServeDir::new("assets/f/"))
103	113	.nest_service("/files", ServeDir::new(&config.storage_root))
	114	+ .merge(public_routes)
104	115	.merge(protected_routes)
105	116	.nest("/api", api_routes)
106	117	.with_state(app_state)

Parents: 6908c22