mathias/tapir
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(deploy): add Dockerfile and vendor htmx for deployable image

Browse Source 
Stage-0 web UI needs a self-contained container image. Two changes:

- Dockerfile: multi-stage build (golang:1.25 builder, CGO off + static
  link, -trimpath -s -w) into distroless static nonroot. The committed
  templ output and vendored asset mean a plain `go build` suffices — no
  codegen or CDN at build/run time. Existing .gitea CI already builds and
  pushes localhost:5000/tapir:<sha> + mirrors to GitHub (deploy patch
  intentionally omitted — cutover is held), so it only needed this file.

- Vendor htmx 1.9.12 locally (internal/web/static/, embed.FS, served at
  /static/ outside the auth guard) and point Layout at /static/htmx.min.js
  instead of unpkg. The deployed UI must not depend on an external CDN
  being reachable from the cluster.

task check green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
mathias
2026-06-03 00:08:35 +02:00
co-authored by Claude Opus 4.8
parent ae239c02c2
commit fa9f101abe
6 changed files with 57 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+29
View File
@@ -0,0 +1,29 @@
# syntax=docker/dockerfile:1
# ── build ───────────────────────────────────────────────────────────────────
# templ output (*_templ.go) and the vendored htmx asset are committed, so a
# plain `go build` produces a self-contained binary — no codegen, no CDN.
FROM golang:1.25 AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
# CGO off + static linking so the binary runs in a distroless/scratch image with
# no libc. Trim symbols/DWARF to shrink the layer.
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' -o /out/tapir ./cmd/tapir
# ── runtime ─────────────────────────────────────────────────────────────────
# distroless static + nonroot: no shell, no package manager, runs as uid 65532.
# ca-certificates are bundled, which the OIDC/HTTPS clients need.
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/tapir /tapir
EXPOSE 8080
USER nonroot:nonroot
ENTRYPOINT ["/tapir"]
CMD ["serve"]
internal/web/handlers.go
+1
View File
@@ -47,6 +47,7 @@ func (a *App) logger() *slog.Logger {
func (a *App) Router() http.Handler { func (a *App) Router() http.Handler {
root := http.NewServeMux() root := http.NewServeMux()
root.HandleFunc("GET /healthz", a.handleHealthz) root.HandleFunc("GET /healthz", a.handleHealthz)
root.Handle("GET /static/", staticHandler())
root.Handle("/auth/", a.Auth.Routes()) root.Handle("/auth/", a.Auth.Routes())
app := http.NewServeMux() app := http.NewServeMux()
internal/web/static.go
+24
View File
@@ -0,0 +1,24 @@
package web
import (
"embed"
"net/http"
)
// staticFS holds the vendored client assets (htmx) served under /static/. They
// are embedded into the binary so a deployed image works without any external
// CDN — the UI must not depend on unpkg being reachable from the cluster.
//
//go:embed static/*
var staticFS embed.FS
// staticHandler serves the embedded assets with a long cache lifetime. The
// files are content-stable (versioned by filename, e.g. htmx.min.js pinned to a
// release), so aggressive caching is safe.
func staticHandler() http.Handler {
fs := http.FileServer(http.FS(staticFS))
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
fs.ServeHTTP(w, r)
})
}
internal/web/static/htmx.min.js
Vendored
+1
View File
File diff suppressed because one or more lines are too long
internal/web/views.templ
+1 -1
View File
@@ -16,7 +16,7 @@ templ Layout(title string) {
<meta charset="utf-8"/> <meta charset="utf-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/> <meta name="viewport" content="width=device-width, initial-scale=1"/>
<title>{ title }</title> <title>{ title }</title>
<script src="https://unpkg.com/htmx.org@1.9.12" defer></script> <script src="/static/htmx.min.js" defer></script>
@templ.Raw(styleTag) @templ.Raw(styleTag)
</head> </head>
<body> <body>
internal/web/views_templ.go
+1 -1
View File
@@ -51,7 +51,7 @@ func Layout(title string) templ.Component {
if templ_7745c5c3_Err != nil { if templ_7745c5c3_Err != nil {
return templ_7745c5c3_Err return templ_7745c5c3_Err
} }
templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</title><script src=\"https://unpkg.com/htmx.org@1.9.12\" defer></script>") templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</title><script src=\"/static/htmx.min.js\" defer></script>")
if templ_7745c5c3_Err != nil { if templ_7745c5c3_Err != nil {
return templ_7745c5c3_Err return templ_7745c5c3_Err
} }