Skip to content

Commit 14cdf93

Browse files
MrScarySpaceCatMrScarySpaceCat
committed
W shit
1 parent db9eef0 commit 14cdf93

9 files changed

Lines changed: 659 additions & 0 deletions

File tree

‎.dockerignore‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
# Byte-compiled / optimized / DLL files
2+
__pycache__/
3+
*.py[cod]
4+
*$py.class
5+
6+
# C extensions
7+
*.so
8+
9+
# Distribution / packaging
10+
.Python
11+
build/
12+
develop-eggs/
13+
dist/
14+
downloads/
15+
eggs/
16+
.eggs/
17+
lib/
18+
lib64/
19+
parts/
20+
sdist/
21+
var/
22+
wheels/
23+
share/python-wheels/
24+
*.egg-info/
25+
.installed.cfg
26+
*.egg
27+
MANIFEST
28+
29+
# PyInstaller
30+
# Usually these files are written by a python script from a template
31+
# before PyInstaller builds the exe, so as to inject date/other infos into it.
32+
*.manifest
33+
*.spec
34+
35+
# Installer logs
36+
pip-log.txt
37+
pip-delete-this-directory.txt
38+
39+
# Unit test / coverage reports
40+
htmlcov/
41+
.tox/
42+
.nox/
43+
.coverage
44+
.coverage.*
45+
.cache
46+
nosetests.xml
47+
coverage.xml
48+
*.cover
49+
*.py,cover
50+
.hypothesis/
51+
.pytest_cache/
52+
cover/
53+
54+
# Translations
55+
*.mo
56+
*.pot
57+
58+
# Django stuff:
59+
*.log
60+
local_settings.py
61+
db.sqlite3
62+
db.sqlite3-journal
63+
64+
# Flask stuff:
65+
instance/
66+
.webassets-cache
67+
68+
# Scrapy stuff:
69+
.scrapy
70+
71+
# Sphinx documentation
72+
docs/_build/
73+
74+
# PyBuilder
75+
.pybuilder/
76+
target/
77+
78+
# Jupyter Notebook
79+
.ipynb_checkpoints
80+
81+
# IPython
82+
profile_default/
83+
ipython_config.py
84+
85+
# pyenv
86+
# For a library or package, you might want to ignore these files since the code is
87+
# intended to run in multiple environments; otherwise, check them in:
88+
# .python-version
89+
90+
# pipenv
91+
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
92+
# However, in case of collaboration, if having platform-specific dependencies or dependencies
93+
# having no cross-platform support, pipenv may install dependencies that don't work, or not
94+
# install all needed dependencies.
95+
#Pipfile.lock
96+
97+
# UV
98+
# Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
99+
# This is especially recommended for binary packages to ensure reproducibility, and is more
100+
# commonly ignored for libraries.
101+
#uv.lock
102+
103+
# poetry
104+
# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
105+
# This is especially recommended for binary packages to ensure reproducibility, and is more
106+
# commonly ignored for libraries.
107+
# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
108+
#poetry.lock
109+
110+
# pdm
111+
# Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
112+
#pdm.lock
113+
# pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
114+
# in version control.
115+
# https://pdm.fming.dev/latest/usage/project/#working-with-version-control
116+
.pdm.toml
117+
.pdm-python
118+
.pdm-build/
119+
120+
# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
121+
__pypackages__/
122+
123+
# Celery stuff
124+
celerybeat-schedule
125+
celerybeat.pid
126+
127+
# SageMath parsed files
128+
*.sage.py
129+
130+
# Environments
131+
.env
132+
.venv
133+
env/
134+
venv/
135+
ENV/
136+
env.bak/
137+
venv.bak/
138+
139+
# Spyder project settings
140+
.spyderproject
141+
.spyproject
142+
143+
# Rope project settings
144+
.ropeproject
145+
146+
# mkdocs documentation
147+
/site
148+
149+
# mypy
150+
.mypy_cache/
151+
.dmypy.json
152+
dmypy.json
153+
154+
# Pyre type checker
155+
.pyre/
156+
157+
# pytype static type analyzer
158+
.pytype/
159+
160+
# Cython debug symbols
161+
cython_debug/
162+
163+
# PyCharm
164+
# JetBrains specific template is maintained in a separate JetBrains.gitignore that can
165+
# be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
166+
# and can be added to the global gitignore or merged into this file. For a more nuclear
167+
# option (not recommended) you can uncomment the following to ignore the entire idea folder.
168+
#.idea/
169+
170+
# PyPI configuration file
171+
.pypirc

‎.github/workflows/docker-publish.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Docker
2+
3+
# This workflow uses actions that are not certified by GitHub.
4+
# They are provided by a third-party and are governed by
5+
# separate terms of service, privacy policy, and support
6+
# documentation.
7+
8+
on:
9+
push:
10+
branches: ["master"]
11+
# Publish semver tags as releases.
12+
tags: ["v*.*.*"]
13+
pull_request:
14+
branches: ["master"]
15+
16+
env:
17+
# Use docker.io for Docker Hub if empty
18+
REGISTRY: ghcr.io
19+
# github.repository as <account>/<repo>
20+
IMAGE_NAME: ${{ github.repository }}
21+
22+
jobs:
23+
build:
24+
runs-on: ubuntu-latest
25+
permissions:
26+
contents: read
27+
packages: write
28+
# This is used to complete the identity challenge
29+
# with sigstore/fulcio when running outside of PRs.
30+
id-token: write
31+
32+
steps:
33+
- name: Checkout repository
34+
uses: actions/checkout@v4
35+
36+
# Install the cosign tool except on PR
37+
# https://github.com/sigstore/cosign-installer
38+
- name: Install cosign
39+
if: github.event_name != 'pull_request'
40+
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
41+
with:
42+
cosign-release: "v2.2.4"
43+
44+
# Set up BuildKit Docker container builder to be able to build
45+
# multi-platform images and export cache
46+
# https://github.com/docker/setup-buildx-action
47+
- name: Set up Docker Buildx
48+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
49+
50+
# Login against a Docker registry except on PR
51+
# https://github.com/docker/login-action
52+
- name: Log into registry ${{ env.REGISTRY }}
53+
if: github.event_name != 'pull_request'
54+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
55+
with:
56+
registry: ${{ env.REGISTRY }}
57+
username: ${{ github.actor }}
58+
password: ${{ secrets.GITHUB_TOKEN }}
59+
60+
# Extract metadata (tags, labels) for Docker
61+
# https://github.com/docker/metadata-action
62+
- name: Extract Docker metadata
63+
id: meta
64+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
65+
with:
66+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
67+
68+
# Build and push Docker image with Buildx (don't push on PR)
69+
# https://github.com/docker/build-push-action
70+
- name: Build and push Docker image
71+
id: build-and-push
72+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
73+
with:
74+
context: .
75+
push: ${{ github.event_name != 'pull_request' }}
76+
tags: ${{ steps.meta.outputs.tags }}
77+
labels: ${{ steps.meta.outputs.labels }}
78+
cache-from: type=gha
79+
cache-to: type=gha,mode=max
80+
81+
# Sign the resulting Docker image digest except on PRs.
82+
# This will only write to the public Rekor transparency log when the Docker
83+
# repository is public to avoid leaking data. If you would like to publish
84+
# transparency data even for private images, pass --force to cosign below.
85+
# https://github.com/sigstore/cosign
86+
- name: Sign the published Docker image
87+
if: ${{ github.event_name != 'pull_request' }}
88+
env:
89+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
90+
TAGS: ${{ steps.meta.outputs.tags }}
91+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
92+
# This step uses the identity token to provision an ephemeral certificate
93+
# against the sigstore community Fulcio instance.
94+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎Dockerfile‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Use the official Python image as a base
2+
FROM python:slim
3+
4+
# Set the working directory in the container
5+
WORKDIR /app
6+
7+
# Copy requirements file and install dependencies
8+
COPY requirements.txt ./
9+
RUN pip install --no-cache-dir -r requirements.txt
10+
11+
# Add user so we don't need --no-sandbox.
12+
RUN groupadd clowdertech && useradd -g clowdertech clowdertech \
13+
&& mkdir -p /home/clowdertech/Downloads /app \
14+
&& chown -R clowdertech:clowdertech /home/clowdertech \
15+
&& chown -R clowdertech:clowdertech /app
16+
17+
# Run everything after as non-privileged user.
18+
USER clowdertech
19+
20+
# Copy the entire application (including templates and other necessary files)
21+
COPY . .
22+
23+
# Expose the port the app runs on
24+
EXPOSE 8000
25+
26+
# Run the Flask application using Gunicorn
27+
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8000"]

0 commit comments

Comments
 (0)