TZGyn
4dc3d14a06
Static non-root alpine image; tunneld must own host ports 443/80 directly since visitor TLS is SNI-routed and never proxy-terminated.
31 lines
1.1 KiB
Docker
31 lines
1.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# tunneld: the single-node self-hosted OpenTunnel-compatible server.
|
|
# Deploy on Coolify (or any Docker host) with host port mappings
|
|
# 443 -> 8443 and 80 -> 8080 and a volume on /app/data; see README.md.
|
|
|
|
FROM golang:1.27-alpine AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY cmd ./cmd
|
|
COPY internal ./internal
|
|
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/tunneld ./cmd/tunneld
|
|
|
|
FROM alpine:3.21
|
|
RUN apk add --no-cache ca-certificates \
|
|
&& adduser -D -u 1000 tunneld \
|
|
&& mkdir -p /app/data && chown tunneld:tunneld /app/data
|
|
COPY --from=build /out/tunneld /usr/local/bin/tunneld
|
|
USER tunneld
|
|
# Tunnels are <id>.<OPENTUNNEL_DOMAIN>; set it per deployment.
|
|
ENV TUNNELD_DATA=/app/data/data.json \
|
|
LOCAL_CA_FILE=/app/data/ca.pem \
|
|
TLS_LISTEN=:8443 \
|
|
HTTP_LISTEN=:8080 \
|
|
HTTP_MODE=redirect
|
|
EXPOSE 8443 8080
|
|
VOLUME ["/app/data"]
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
|
|
CMD wget -qO /dev/null http://127.0.0.1:8080/health || exit 1
|
|
ENTRYPOINT ["/usr/local/bin/tunneld"]
|