prod.yaml

contents:
  keyring:
    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
  repositories:
    - https://packages.wolfi.dev/os
  packages:
    - ca-certificates-bundle
    - ggbridge@local
    - wolfi-baselayout

environment:
  GGBRIDGE_SSL_CERT_DIR: /etc/ggbridge/ssl/certs
  GGBRIDGE_SSL_CERT_FILE: /etc/ggbridge/ssl/certs/ca-bundle.crt
  GGBRIDGE_SSL_PRIVATE_CERT_DIR: /etc/ggbridge/ssl/private
  GGBRIDGE_SSL_PRIVATE_CERT_FILE: /etc/ggbridge/ssl/private/ca-bundle.crt

entrypoint:
  command: /usr/bin/ggbridge

cmd: client

stop-signal: SIGQUIT

accounts:
  groups:
    - groupname: nonroot
      gid: 65532
  users:
    - username: nonroot
      uid: 65532
      gid: 65532
  run-as: nonroot

work-dir: /home/nonroot

paths:
  - path: /etc/ggbridge/ssl/certs
    type: directory
    permissions: 0o775
    uid: 65532
    gid: 0
  - path: /etc/ggbridge/ssl/private
    type: directory
    permissions: 0o775
    uid: 65532
    gid: 0
  - path: /run/nginx
    type: directory
    permissions: 0o777
    uid: 65532
    gid: 0
  - path: /var/lib/nginx
    type: directory
    permissions: 0o775
    uid: 65532
    gid: 0
  - path: /var/lib/nginx/html
    type: directory
    permissions: 0o775
    uid: 65532
    gid: 0
  - path: /var/lib/nginx/logs
    type: directory
    permissions: 0o775
    uid: 65532
    gid: 0
  - path: /var/lib/nginx/tmp
    type: directory
    permissions: 0o775
    uid: 65532
    gid: 0
  - path: /var/run
    type: directory
    permissions: 0o777
    uid: 65532
    gid: 0

archs:
  - aarch64
  - x86_64

annotations:
  org.opencontainers.image.title: 'GGBridge'
  org.opencontainers.image.description: 'Connect your on-prem VCS with the GitGuardian Platform'
  org.opencontainers.image.vendor: 'GitGuardian'
  org.opencontainers.image.licenses: 'MIT'
  org.opencontainers.image.authors: 'GitGuardian SRE Team <sre@gitguardian.com>'
  org.opencontainers.image.source	: 'https://github.com/GitGuardian/ggbridge'
  org.opencontainers.image.documentation: 'https://github.com/GitGuardian/ggbridge/blob/main/README.md'