mirror of
https://github.com/lrnselfreliance/wrolpi.git
synced 2026-10-25 18:40:06 -04:00
4f66472492
The private keys of eight eMudhra intermediate CAs can be recovered from their certificates, so anyone can mint a trusted certificate for any host. * Require certifi>=2026.10.19; yt-dlp, requests and curl-cffi use its bundle, and 2026.10.19 removes the emSign ECC Root CA - G3 root they chain to. * Set DENO_TLS_CA_STORE=system for the API (systemd + Docker) and the archive container so Deno follows the apt-patched system store instead of roots that only change with a Deno upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
43 lines
1.8 KiB
Docker
43 lines
1.8 KiB
Docker
FROM browserless/chrome:1.61.1-chrome-stable
|
|
|
|
USER root
|
|
WORKDIR /app
|
|
|
|
# Install Python for main.py
|
|
ENV PYTHONUNBUFFERED=1
|
|
# Deno trusts the system store, which apt keeps current, instead of its bundled roots.
|
|
ENV DENO_TLS_CA_STORE=system
|
|
RUN apt update && apt install -y python3 python3-dev python3-venv curl unzip && ln -sf python3 /usr/bin/python
|
|
RUN python3 -m venv /app/venv
|
|
RUN . /app/venv/bin/activate
|
|
|
|
# Install a newer singlefile and Readability.
|
|
RUN npm install -g single-file-cli@2.0.73 readability-extractor@0.0.6
|
|
|
|
# Install Deno; single-file-cli is designed for it (under node 18 it cannot reach the browser CDP
|
|
# on IPv6-enabled hosts and never exits). Match the version pinned in scripts/upgrade.sh.
|
|
RUN DENO_VERSION="v2.8.3" \
|
|
&& ARCH=$(uname -m) \
|
|
&& if [ "$ARCH" = "aarch64" ]; then \
|
|
DENO_ARCH="aarch64-unknown-linux-gnu"; \
|
|
DENO_SHA256="d4589cc1ffcbf1995c92a0127d932aaf832ac70cfdcc6d5b7bf38043cf303575"; \
|
|
else \
|
|
DENO_ARCH="x86_64-unknown-linux-gnu"; \
|
|
DENO_SHA256="30455b845ffa6082209c3590269c910ad3b7efdf28c9879afd4006c47ae54197"; \
|
|
fi \
|
|
&& curl -fsSL "https://github.com/denoland/deno/releases/download/${DENO_VERSION}/deno-${DENO_ARCH}.zip" -o /tmp/deno.zip \
|
|
# Assert the hash to avoid malicious or invalid files.
|
|
&& echo "${DENO_SHA256} /tmp/deno.zip" | sha256sum -c - \
|
|
&& unzip -o /tmp/deno.zip -d /usr/local/bin/ \
|
|
&& chmod +x /usr/local/bin/deno \
|
|
&& rm /tmp/deno.zip \
|
|
&& deno --version
|
|
|
|
# Install the Python wrapper and it's requirements.
|
|
COPY docker/archive/requirements.txt /app/requirements.txt
|
|
RUN /app/venv/bin/pip3 install -r /app/requirements.txt
|
|
COPY docker/archive /app
|
|
COPY scripts/singlefile_browser_wrapper.sh /app/singlefile_browser_wrapper.sh
|
|
|
|
# Launch Archive app in the virtual environment.
|
|
ENTRYPOINT [ "/app/venv/bin/python3", "/app/main.py"]
|