feat: docker image + compose#2
Merged
Merged
Conversation
Builds the IRCd straight from this repository so every native module shipped with the fork (account-registration, persistence, metadata, filehost, authtoken, smtp, obbyscript, ...) is compiled into the image. * docker/Dockerfile -- alpine 3.19, pre-seeded config.settings drives ./Config -quick && make && make install non-interactively. Builds as the obbyircd user; installs to /home/obbyircd/obby/. * docker/docker-entrypoint.sh -- on first run populates the conf volume from /etc/obbyircd/conf-defaults/, renders obbyircd.conf from the template via envsubst, issues a 1-day self-signed cert, generates random cloak keys. Compiles any .c file dropped into the custom-modules volume against the in-image source tree. Validates with `obbyircd -c` before exec. * docker/obbyircd.conf.template -- minimal but complete: TLS listen, WebSocket listen, cloak keys, account-registration block, oper admin/admin123 default (change before use), and the optional filehost / RPC blocks injected by the entrypoint. * compose.yaml -- one service, named volumes for conf/data/logs/tls/ custom-modules with optional CONF_BIND/etc overrides. Loads .env if present. Healthcheck on the TLS port. * .env.example -- documents every supported variable. * docker/README.md -- usage, volume layout, env var reference, custom module workflow, cert replacement. * .dockerignore -- keeps build artifacts, ObsidianIRC client checkout, packaged .deb/.rpm/.AppImage and CI noise out of the build context. Adapted from obbyworld/UnrealIRCd-Modules#10; refactored to drop the upstream tarball download and the third-party module copy steps since the equivalents are already native modules in this tree.
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughAdds Docker-based packaging and orchestration for ObbyIRCd: build-stage Dockerfile, container entrypoint that initializes configuration/TLS and compiles optional modules, a conf template rendered from environment, Docker Compose and .env example for service/volumes/ports, and accompanying docs and ignore rules. ChangesDocker Containerization Support
Sequence Diagram(s)sequenceDiagram
participant User
participant DockerCompose
participant Container
participant VolumeFS
participant ObbyIRCdBin
User->>DockerCompose: docker compose up -d
DockerCompose->>Container: create & start container (mount volumes, env)
Container->>VolumeFS: check conf/.docker_initialized, conf and data dirs
alt first run
Container->>VolumeFS: copy /etc/obbyircd/conf-defaults -> conf
Container->>Container: render template via envsubst
Container->>Container: generate cloak keys & self-signed certs
end
Container->>VolumeFS: persist OPER_PASSWORD if generated
Container->>Container: compile custom-modules/*.c -> modules/third/*.so
Container->>ObbyIRCdBin: run ./bin/obbyircd -c (validate)
alt validation success
Container->>ObbyIRCdBin: exec su-exec obbyircd ./bin/obbyircd -F
else validation failure
Container-->>DockerCompose: exit 1 (fail start)
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~40 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: Turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. 👉 Get your free trial and get 200 agent minutes per Slack user (a $50 value). Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 54 minutes and 40 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docker/docker-entrypoint.sh`:
- Around line 90-99: The TLS bootstrap (the if that checks
"$TLS_DIR/server.cert.pem" and "$TLS_DIR/server.key.pem") must be moved out of
the initial "conf/.docker_initialized" first-run gating so cert creation runs on
every start when the TLS volume lacks keys; update docker-entrypoint.sh to run
the existing openssl-generation block unconditionally (or in its own conditional
only checking for the cert/key files) rather than inside the conf-init block,
keep the same file checks, permissions (chmod 600/644) and subject
("/CN=$SERVER_NAME"), and ensure the logic is idempotent so a replaced/empty TLS
volume self-heals by generating new cert/key.
- Around line 101-104: Delay creating and chown'ing the marker file until after
the generated config is validated: generate the config into a temp file, run the
validator ./bin/obbyircd -c against that temp file, and only if that command
exits successfully promote the temp file into place and then run chown -R
obbyircd:obbyircd "$CONF_DIR" "$TLS_DIR" "$DATA_DIR" "$LOGS_DIR", touch
"$FIRST_RUN_MARKER" and chown "$FIRST_RUN_MARKER" (apply the same change to the
other marker creation block referenced around the later 136-140 region); ensure
failures abort without creating the marker so a fixed environment will re-render
on next start.
In `@docker/obbyircd.conf.template`:
- Around line 46-53: The shipped oper block defines a default admin credential
(oper admin { mask *; password "admin123"; ... }) which is insecure; replace the
hardcoded password by reading it from an environment variable or a first-run
generated secret (e.g., use ${OPER_PASSWORD} or generate/store a random secret
at container startup) and remove the literal "admin123" from the oper
definition, keep the oper name/class/rights (oper admin, class clients,
operclass netadmin, swhois, vhost) intact; additionally update .env.example and
docker/README.md to document the new OPER_PASSWORD variable and describe
first-run generation/where the secret is persisted.
In `@docker/README.md`:
- Around line 78-84: Replace the hard-coded host-side volume copy in the README
by showing a portable container-targeted copy or referencing the
CUSTOM_MODULES_BIND variable: instruct readers to run "docker compose cp
my-extra-module.c obbyircd:/home/obbyircd/obby/custom-modules/" (targeting the
obbyircd container) or alternatively call out using the CUSTOM_MODULES_BIND
configuration to mount custom modules, then tell them to restart or rehash
obbyircd and add `loadmodule "third/my-extra-module";` to obbyircd.conf; update
the example text around the cp/rehash steps and mention CUSTOM_MODULES_BIND as
the preferred portable approach.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b572106f-b120-4ef1-a863-e0f0270bad46
📒 Files selected for processing (7)
.dockerignore.env.examplecompose.yamldocker/Dockerfiledocker/README.mddocker/docker-entrypoint.shdocker/obbyircd.conf.template
* Move TLS cert bootstrap out of the conf-init block so a fresh-but-empty tls volume self-heals on every start (was previously gated by conf/.docker_initialized -- replacing only the tls volume would leave the server with no cert and configtest would fail). * Defer writing .docker_initialized until after `obbyircd -c` succeeds. An invalid first render now leaves the marker absent so fixing the offending env var and restarting re-renders. * Drop the shipped `admin123` oper password. OPER_NAME / OPER_PASSWORD / OPER_MASK are env-driven; if OPER_PASSWORD is unset on first run, a random secret is generated, persisted to data/.oper_password, and printed once to the container log. * Replace the host-path volume copy example in docker/README.md with `docker compose cp` (which works on rootful, rootless and podman), and document the CUSTOM_MODULES_BIND alternative for direct host edits.
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docker/docker-entrypoint.sh (1)
187-191: ⚡ Quick winRemove redundant conditional.
Both branches execute identical code (
exec su-exec obbyircd "$@"), making the condition at lines 188-190 dead logic.♻️ Proposed fix
echo "Starting ObbyIRCd..." -if [ "$#" -ge 2 ] && [ "$1" = "./bin/obbyircd" ] && [ "$2" = "-F" ]; then - exec su-exec obbyircd "$@" -fi exec su-exec obbyircd "$@"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docker/docker-entrypoint.sh` around lines 187 - 191, In docker-entrypoint.sh remove the redundant if block that checks '[ "$#" -ge 2 ] && [ "$1" = "./bin/obbyircd" ] && [ "$2" = "-F" ]' since both branches call the same exec (exec su-exec obbyircd "$@"); replace the whole conditional with a single unconditional exec su-exec obbyircd "$@" to simplify the script and eliminate dead logic.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@docker/docker-entrypoint.sh`:
- Around line 187-191: In docker-entrypoint.sh remove the redundant if block
that checks '[ "$#" -ge 2 ] && [ "$1" = "./bin/obbyircd" ] && [ "$2" = "-F" ]'
since both branches call the same exec (exec su-exec obbyircd "$@"); replace the
whole conditional with a single unconditional exec su-exec obbyircd "$@" to
simplify the script and eliminate dead logic.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 85e4d812-c593-4db8-a033-f5f98d6eb6b5
📒 Files selected for processing (4)
.env.exampledocker/README.mddocker/docker-entrypoint.shdocker/obbyircd.conf.template
✅ Files skipped from review due to trivial changes (2)
- docker/README.md
- docker/obbyircd.conf.template
`make install` doesn't copy doc/conf/scripts/, so the obbyscript module logged a JS_SCRIPTS_DIR_NOT_FOUND warning on every start in the docker image. * Dockerfile: copy doc/conf/scripts/*.js into the conf-defaults snapshot so first-run pre-populates conf/scripts/example.js. * Entrypoint: mkdir -p $CONF_DIR/scripts on every start, chown to obbyircd, so the directory self-heals if an operator wipes it. * README: document where JS scripts go and how to add/replace them via `docker compose cp`. No new volume or env var; scripts continue to live alongside the config inside the obbyircd_conf volume.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings up a Docker deployment that builds straight from this fork's
source -- every native module (account-registration, persistence,
metadata, filehost, authtoken, smtp, obbyscript, ...) is compiled into
the image and ready to load.
Adapted from obbyworld/UnrealIRCd-Modules#10, refactored to drop the
upstream tarball download and the third-party module copy steps since
the equivalents already live in this tree.
Files
drives `./Config -quick && make && make install`
non-interactively. Builds as the `obbyircd` user; installs to
`/home/obbyircd/obby/`.
self-signed TLS cert, random cloak keys, optional filehost / RPC
blocks driven by env, custom-module compilation against the
in-image source tree, `obbyircd -c` validation before exec.
listen, WebSocket listen, account-registration block, default
`admin/admin123` oper (change before exposing).
for conf/data/logs/tls/custom-modules with optional `*_BIND`
overrides for bind mounts. Healthcheck on the TLS port.
custom module workflow.
checkout, and packaged `.deb`/`.rpm`/`.AppImage` outputs out of
the build context.
Test plan
restart, confirm it compiled to `modules/third/`.
Summary by CodeRabbit
New Features
Documentation