fix(traefik): use tls acme challenge #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: mirror-hardened-images | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "23 4 * * 1" | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - ".github/scripts/mirror-dhi-image.sh" | |
| - ".github/workflows/mirror-hardened-images.yml" | |
| - "ansible/site.yml" | |
| - "ansible/roles/idp_zitadel/defaults/main.yml" | |
| - "ansible/roles/oauth2_proxy/defaults/main.yml" | |
| permissions: | |
| contents: read | |
| packages: write | |
| jobs: | |
| mirror: | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: oauth2-proxy | |
| source: dhi.io/oauth2-proxy@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e | |
| target: ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13 | |
| package: terrarium-dhi-oauth2-proxy | |
| source_digest: sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e | |
| target_digest: sha256:c5ec2ff7b486e72e7e6868efdc4c058f6280dba2ea472751c639d7b0e2bd43de | |
| arches: amd64,arm64 | |
| - name: postgres | |
| source: dhi.io/postgres@sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed | |
| target: ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22 | |
| package: terrarium-dhi-postgres | |
| source_digest: sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed | |
| target_digest: sha256:de305976d6a81c4c1ad260861ec5028faafbb1be0bca68ab379eb2fb621abe34 | |
| arches: amd64,arm64 | |
| env: | |
| REGISTRY_AUTH_FILE: /tmp/terrarium-containers-auth.json | |
| HAS_DOCKERHUB_CREDS: ${{ secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install mirror tooling | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y jq skopeo | |
| - name: Report missing Docker Hardened Images credentials | |
| if: env.HAS_DOCKERHUB_CREDS != 'true' | |
| run: | | |
| echo "::warning::DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets are required to mirror Docker Hardened Images." | |
| if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then | |
| exit 1 | |
| fi | |
| - name: Assert Docker Hardened Images credentials are configured | |
| if: env.HAS_DOCKERHUB_CREDS == 'true' | |
| env: | |
| DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} | |
| DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} | |
| run: | | |
| test -n "${DOCKERHUB_USERNAME}" || { echo "DOCKERHUB_USERNAME secret is required" >&2; exit 1; } | |
| test -n "${DOCKERHUB_TOKEN}" || { echo "DOCKERHUB_TOKEN secret is required" >&2; exit 1; } | |
| - name: Login to Docker Hardened Images | |
| if: env.HAS_DOCKERHUB_CREDS == 'true' | |
| env: | |
| DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} | |
| DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} | |
| run: skopeo login dhi.io --username "${DOCKERHUB_USERNAME}" --password-stdin <<<"${DOCKERHUB_TOKEN}" | |
| - name: Login to GHCR | |
| if: env.HAS_DOCKERHUB_CREDS == 'true' | |
| run: skopeo login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin <<<"${{ secrets.GITHUB_TOKEN }}" | |
| - name: Mirror pinned image index | |
| if: env.HAS_DOCKERHUB_CREDS == 'true' | |
| run: >- | |
| .github/scripts/mirror-dhi-image.sh | |
| "${{ matrix.name }}" | |
| "${{ matrix.source }}" | |
| "${{ matrix.target }}" | |
| "${{ matrix.source_digest }}" | |
| "${{ matrix.target_digest }}" | |
| "${{ matrix.arches }}" | |
| - name: Make GHCR package public when permitted | |
| if: env.HAS_DOCKERHUB_CREDS == 'true' | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PACKAGE_NAME: ${{ matrix.package }} | |
| run: | | |
| gh api --method PATCH "/user/packages/container/${PACKAGE_NAME}/visibility" -f visibility=public || | |
| gh api --method PATCH "/orgs/${GITHUB_REPOSITORY_OWNER}/packages/container/${PACKAGE_NAME}/visibility" -f visibility=public || | |
| echo "::warning::Unable to make ${PACKAGE_NAME} public automatically; set package visibility in GHCR if this is the first publish." |