root/hitoma-caddy
Watch
1
0
Fork
You've already forked hitoma-caddy
 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions
No description
10 commits 2 branches 0 tags 380 KiB
  • Shell 62.9%
  • Dockerfile 37.1%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Shawn McNaughton dd6d3e0a91
All checks were successful
Build and publish image / image-1 (push) Successful in 22s
Details
Build and publish image / image (push) Successful in 0s
Details
Describe the runner's Docker daemon accurately 
Jobs reach a docker:dind sidecar over DOCKER_HOST rather than a host
Docker socket.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 23:15:18 -04:00
.forgejo/workflows Queue overlapping builds instead of running them together 2026-10-12 22:23:26 -04:00
certs Initial Commit 2026-10-11 13:54:37 -04:00
test Describe the runner's Docker daemon accurately 2026-10-12 23:15:18 -04:00
Dockerfile Force golang.org/x/net and x/crypto to latest in the caddy build 2026-10-12 11:21:12 -04:00
README.md Describe the runner's Docker daemon accurately 2026-10-12 23:15:18 -04:00

README.md

hitoma-caddy

vulnerabilities

Caddy 2 with the route53 DNS and teapot plugins, trusting the Hitoma PKI v4 root CA.

docker pull forgejo.hitoma.com/root/hitoma-caddy:latest

Tests

Every build has to pass both of these before it's pushed:

  • test/verify-image.sh, which needs no network:
    • the binary has the route53 and teapot modules, and their Caddyfile directives parse
    • the Hitoma root CA is in the system trust store
  • test/smoke.sh, which runs Caddy with a test Caddyfile and checks it from a curl container:
    • plain HTTP, the teapot handler (418) and reverse_proxy all respond
    • HTTPS works with a certificate from Caddy's internal CA, verified against that CA's root
    • the logs show no errors

Both run locally too: test/verify-image.sh IMAGE, then test/smoke.sh IMAGE.

CI

.forgejo/workflows/build.yml builds on every push to main, weekly (Monday 06:17 UTC, without cache, to pick up base image and plugin updates), and on manual dispatch. Pull requests are built and tested but not pushed. Building, testing, scanning and pushing happen in the shared hitoma-image-ci pipeline.

If the build or a test fails, nothing is pushed, and latest stays on the last good image.

Tags: latest, YYYYMMDD, and sha-<short>.

Each build is scanned with Trivy after it passes the tests. Builds of main force-push the badge above and the full JSON report to the single-commit badges branch. The run fails when there are fixable HIGH or CRITICAL findings. The image is still pushed, but the red run shows that a base image or plugin update is needed. When a finding is in a Go dependency of Caddy or a plugin, add the module to BUMP_MODULES in the Dockerfile. It's forced to its latest version with an xcaddy --replace, and the build fails if the bump didn't make it into the binary.

Setup:

  • Repository secrets REGISTRY_USER and REGISTRY_TOKEN (a Forgejo access token with write:package scope).
  • A Forgejo runner with the docker label whose job containers can reach a Docker daemon, such as a docker:dind sidecar through DOCKER_HOST.
  • Actions enabled on the repository (Settings → Units → Actions).