tanshu
537a4f1e46
menu-admin was the odd one out: it built from the working directory with a date tag and a multi-arch manifest, deployed with `-e tag=`, and kept the Docker-era container name. The other two apps build from `git archive HEAD` and tag with the commit, so what runs on the host is exactly what git knows about; build only for the architecture emily actually runs; and use one slug for the container, its network and its data directory. The build is now their three lines: `podman build --platform linux/arm64` from `git archive HEAD`, tagged `:<commit>` and `:latest`, pushed with `podman push` rather than a manifest. `deploy.sh` pushes the commit first, then refuses a dirty tracked tree or a HEAD that is not origin/main — which is what makes the commit tag trustworthy — takes the same `--force` and `--no-push`, and ends in the same `-u tanshu ... -e image_tag=<commit>`. Its own lint/typecheck/test gate stays, but behind `--checks`, so a plain deploy behaves as theirs does. The registry credential moves into vars/default.yml and the role logs in, pulls and logs out around it, as their roles do. The image is only pulled at deploy time, so the unit keeps podman's default `Pull=missing` and a reboot never needs the registry. This is the same plaintext credential the other two repos carry. One real bug goes with it: the healthcheck gate ran before the handler that restarts a changed unit, so a run that only changed the unit checked the stale container. `meta: flush_handlers` before the gate is the fix the sibling repos already made. The container, network and data directory are all menu-<site> now. The dotted Docker-era name and the NetworkAlias it needed are gone, so `podman logs menu-<site>` and `systemctl --user status menu-<site>` are the same two commands across all three apps. The Dockerfile keeps its name for the same reason: podman reads it as readily as a Containerfile, and the siblings use that name too.
43 lines
1.6 KiB
Makefile
43 lines
1.6 KiB
Makefile
# menu-admin — container image builds.
|
|
#
|
|
# Built with Podman/Buildah, not Docker, from the committed tree
|
|
# (`git archive HEAD`) and tagged with that commit, so a deploy ships exactly
|
|
# what git knows about. deploy.sh pushes first and refuses a dirty tree.
|
|
|
|
COMMIT ?= $(shell git rev-parse --short HEAD)
|
|
|
|
# The deploy host (emily) is aarch64, so that is the default target: the image
|
|
# is built for the machine it runs on, not the one running make. Podman carries
|
|
# no built-in QEMU (unlike docker buildx), so a foreign platform needs binfmt
|
|
# handlers on this host — qemu-user-binfmt is installed here. Override with e.g.
|
|
# `make build-production PLATFORM=linux/amd64`.
|
|
PLATFORM ?= linux/arm64
|
|
|
|
IMAGE ?= registry.tanshu.com/menu-admin
|
|
|
|
.PHONY: build-production
|
|
build-production: ## Build HEAD with podman, tag :$(COMMIT) + :latest, and push
|
|
@echo "==> podman build --platform $(PLATFORM) → $(IMAGE):$(COMMIT) + :latest"
|
|
@git archive --format=tar HEAD | podman build \
|
|
--platform $(PLATFORM) \
|
|
--tag $(IMAGE):$(COMMIT) \
|
|
--tag $(IMAGE):latest \
|
|
--pull=always \
|
|
- || { \
|
|
echo "✗ podman build failed."; \
|
|
echo " Cross-platform builds need binfmt on this host (podman has no built-in QEMU):"; \
|
|
echo " sudo apt install qemu-user-binfmt # or qemu-user-static"; \
|
|
exit 1; \
|
|
}
|
|
podman push $(IMAGE):$(COMMIT)
|
|
podman push $(IMAGE):latest
|
|
|
|
.PHONY: build-check
|
|
build-check: ## Compile check from HEAD with podman, nothing pushed
|
|
@echo "==> podman build --platform $(PLATFORM) (no push)"
|
|
git archive --format=tar HEAD | podman build \
|
|
--platform $(PLATFORM) \
|
|
--tag localhost/menu-admin:check \
|
|
--pull=always \
|
|
-
|