hitoma-wg-easy

wg-easy rebuilt from its latest release, following upstream's Dockerfile, so CVE fixes land without waiting for an upstream image. Runtime behaviour, environment variables, volumes and capabilities match upstream. Differences:

• Current node:krypton-alpine (upstream pins a digest) with apk upgrade.
• npm, npx, corepack and yarn removed from the runtime image; the app and its cli only need node. npm's bundled dependencies were most of upstream's Node findings.
• pnpm overrides for flagged packages in the app's dependency tree (PNPM_OVERRIDES in the Dockerfile).
• amneziawg-go built with the current stable Go (golang:alpine) and the latest golang.org/x/crypto, x/net and x/sys (BUMP_MODULES). The amneziawg-go and amneziawg-tools versions are the ones upstream's Dockerfile pins at the same tag.

docker pull forgejo.hitoma.com/root/hitoma-wg-easy:15

Tests

Every build has to pass both of these before it's pushed:

• test/verify-image.sh, which needs no network:
  • the WireGuard and AmneziaWG tools are there (wg, wg-quick, wireguard-go, awg, awg-quick, amneziawg-go), and iptables uses the legacy backend
  • awg-quick has the src_valid_mark patch, and the libsql native driver loads
  • npm, npx, corepack and yarn are left out
• test/smoke.sh, which starts wg-easy with unattended setup (INIT_*):
  • the wg0 interface comes up (the image's healthcheck)
  • the web API logs in and creates a client, and the app reports the release matching the image's version label
  • a second container brings that client's tunnel up and pings the server through it
  • the logs show no errors

Both run locally too: test/verify-image.sh IMAGE, then test/smoke.sh IMAGE.

CI

.forgejo/workflows/build.yml builds on every push to main, weekly (Monday 06:57 UTC, without cache, to pick up Node, Alpine, Go and module updates), and on manual dispatch. Dispatch takes an optional version input to build a specific upstream tag; otherwise the latest GitHub release is used. Pull requests are built and tested but not pushed. The workflow only resolves the upstream tag. Building, testing, scanning and pushing happen in the shared hitoma-image-ci pipeline.

Tags: latest, the upstream release (e.g. v15.4.0), its major (e.g. 15), YYYYMMDD, and sha-<short>.

Each build is scanned with Trivy after it passes the tests. Builds of main force-push the badge above and the full JSON report to the single-commit badges branch. The run fails when there are fixable HIGH or CRITICAL findings. The image is still pushed, but the red run shows that an override or bump is needed.

Go isn't pinned to amneziawg-go's go.mod minimum because the latest golang.org/x modules only support the two newest Go releases. When a scan flags another npm package or Go module, add it to PNPM_OVERRIDES or BUMP_MODULES. If an override or bump breaks the build, the job fails and the tags stay on the last good image.

Setup:

• Repository secrets REGISTRY_USER and REGISTRY_TOKEN (a Forgejo access token with write:package scope).
• A Forgejo runner with the docker label whose job containers can reach a Docker daemon, such as a docker:dind sidecar through DOCKER_HOST.
• Actions enabled on the repository (Settings → Units → Actions).