diff --git a/.taskfiles/docker.yml b/.taskfiles/docker.yml index abe885a13..cba35493f 100644 --- a/.taskfiles/docker.yml +++ b/.taskfiles/docker.yml @@ -20,6 +20,11 @@ tasks: cmds: - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite . + build:backend: + desc: "Build backend-only Docker image (no embedded frontend)" + cmds: + - docker build -t stirling-pdf-backend -f docker/backend/Dockerfile . + build:frontend: desc: "Build frontend-only Docker image" cmds: diff --git a/build.gradle b/build.gradle index 14df27ee5..40714ed9b 100644 --- a/build.gradle +++ b/build.gradle @@ -185,9 +185,14 @@ subprojects { allowInsecureProtocol = true } } + // Maven Central first: it hosts the vast majority of artifacts, so Gradle + // never has to consult the slower/less-reliable mirrors below for them. + // shibboleth + jboss remain as fallbacks for the few artifacts only they + // serve (Gradle falls through on a 404). Keeping them ahead of Central + // meant a jboss outage (503) aborted resolution of common deps. + mavenCentral() maven { url = "https://build.shibboleth.net/maven/releases" } maven { url = "https://repository.jboss.org/" } - mavenCentral() } configurations.configureEach { @@ -583,8 +588,9 @@ repositories { allowInsecureProtocol = true } } - maven { url = "https://build.shibboleth.net/maven/releases" } + // Maven Central first (see note in the subprojects repositories block above). mavenCentral() + maven { url = "https://build.shibboleth.net/maven/releases" } } dependencies { diff --git a/docker/backend/Dockerfile b/docker/backend/Dockerfile new file mode 100644 index 000000000..d5bd45fb7 --- /dev/null +++ b/docker/backend/Dockerfile @@ -0,0 +1,134 @@ +# Stirling-PDF - Backend-only version (no embedded frontend) +# +# Identical to docker/embedded/Dockerfile except the JAR is built with +# -PbuildWithFrontend=false, so the React UI is NOT baked in. The gradle build +# then swaps in the lightweight API landing page (see app/core/build.gradle +# copyApiLandingPage). Use this for the split frontend/backend deployments +# (e.g. SaaS) where the UI ships as its own image (docker/frontend/Dockerfile). +# +# Because no frontend is built, the Node.js + go-task tooling that the embedded +# image installs is intentionally omitted here — the only frontend gradle tasks +# (npmInstall / npmBuild) are gated on buildWithFrontend and stay disabled. + +ARG BASE_VERSION=1.0.2 +ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION} + +# Stage 1: Build the Java application (backend only, no frontend) +FROM gradle:9.3.1-jdk25@sha256:85aec999629f4774a383cb792da4b598bdf5a7e69c4b9570bb70c0f919179183 AS app-build + +# JDK 25+: --add-exports is no longer accepted via JAVA_TOOL_OPTIONS; use JDK_JAVA_OPTIONS instead +ENV JDK_JAVA_OPTIONS="--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED \ + --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED \ + --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED \ + --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED \ + --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED" + +WORKDIR /app + +COPY build.gradle settings.gradle gradlew ./ +COPY gradle/ gradle/ +COPY app/core/build.gradle app/core/ +COPY app/common/build.gradle app/common/ +COPY app/proprietary/build.gradle app/proprietary/ + +# Use system gradle instead of gradlew to avoid SSL issues downloading gradle distribution on emulated arm64 +RUN gradle dependencies --no-daemon || true + +COPY . . + +ARG PROTOTYPES_BUILD=false +ARG STIRLING_FLAVOR=proprietary +ENV STIRLING_FLAVOR=${STIRLING_FLAVOR} + +# buildWithFrontend=false → backend-only JAR with API landing page. +RUN STIRLING_FLAVOR=${STIRLING_FLAVOR} \ + gradle clean build \ + -PbuildWithFrontend=false \ + -PprototypesMode=${PROTOTYPES_BUILD} \ + -x spotlessApply -x spotlessCheck -x test -x sonarqube \ + --no-daemon + +# Stage 2: Extract Spring Boot Layers +FROM eclipse-temurin:25-jre-noble@sha256:b27ca47660a8fa837e47a8533b9b1a3a430295cf29ca28d91af4fd121572dc29 AS jar-extract +WORKDIR /tmp +COPY --from=app-build /app/app/core/build/libs/*.jar app.jar +RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers + + +# Stage 3: Final runtime image on top of pre-built base +FROM ${BASE_IMAGE} + +ARG VERSION_TAG + +WORKDIR /app + +# Application layers +COPY --link --from=jar-extract --chown=1000:1000 /layers/dependencies/ /app/ +COPY --link --from=jar-extract --chown=1000:1000 /layers/spring-boot-loader/ /app/ +COPY --link --from=jar-extract --chown=1000:1000 /layers/snapshot-dependencies/ /app/ +COPY --link --from=jar-extract --chown=1000:1000 /layers/application/ /app/ + +COPY --link --from=app-build --chown=1000:1000 \ + /app/build/libs/restart-helper.jar /restart-helper.jar +COPY --link --chown=1000:1000 scripts/ /scripts/ + +# Fonts go to system dir, root ownership is correct (world-readable) +COPY app/core/src/main/resources/static/fonts/*.ttf /usr/share/fonts/truetype/ + +# Permissions and configuration +RUN set -eux; \ + chmod +x /scripts/*; \ + ln -s /logs /app/logs; \ + ln -s /configs /app/configs; \ + ln -s /customFiles /app/customFiles; \ + ln -s /pipeline /app/pipeline; \ + ln -s /storage /app/storage; \ + chown -h stirlingpdfuser:stirlingpdfgroup /app/logs /app/configs /app/customFiles /app/pipeline /app/storage; \ + chown stirlingpdfuser:stirlingpdfgroup /app; \ + chmod 750 /tmp/stirling-pdf; \ + chmod 750 /tmp/stirling-pdf/heap_dumps; \ + fc-cache -f + +# Write version to a file so it is readable by scripts without env-var inheritance. +# init-without-ocr.sh reads /etc/stirling_version for the AOT cache fingerprint. +RUN echo "${VERSION_TAG:-dev}" > /etc/stirling_version + +# Environment variables +ENV VERSION_TAG=$VERSION_TAG \ + STIRLING_AOT_ENABLE="false" \ + STIRLING_JVM_PROFILE="balanced" \ + _JVM_OPTS_BALANCED="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:G1HeapRegionSize=4m -XX:G1PeriodicGCInterval=60000 -XX:+UseStringDeduplication -XX:+UseCompactObjectHeaders -XX:+ExplicitGCInvokesConcurrent -Dspring.threads.virtual.enabled=true -Djava.awt.headless=true" \ + _JVM_OPTS_PERFORMANCE="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UseShenandoahGC -XX:ShenandoahGCMode=generational -XX:+UseCompactObjectHeaders -XX:+UseStringDeduplication -XX:+AlwaysPreTouch -XX:+ExplicitGCInvokesConcurrent -Dspring.threads.virtual.enabled=true -Djava.awt.headless=true" \ + JAVA_CUSTOM_OPTS="" \ + HOME=/home/stirlingpdfuser \ + PUID=1000 \ + PGID=1000 \ + UMASK=022 \ + STIRLING_TEMPFILES_DIRECTORY=/tmp/stirling-pdf \ + TMPDIR=/tmp/stirling-pdf \ + TEMP=/tmp/stirling-pdf \ + TMP=/tmp/stirling-pdf \ + DBUS_SESSION_BUS_ADDRESS=/dev/null \ + SAL_TMP=/tmp/stirling-pdf/libre + +# Metadata labels +LABEL org.opencontainers.image.title="Stirling-PDF Backend" \ + org.opencontainers.image.description="Backend-only version (no embedded UI) with Calibre, LibreOffice, Tesseract, OCRmyPDF" \ + org.opencontainers.image.source="https://github.com/Stirling-Tools/Stirling-PDF" \ + org.opencontainers.image.licenses="MIT" \ + org.opencontainers.image.vendor="Stirling-Tools" \ + org.opencontainers.image.url="https://www.stirlingpdf.com" \ + org.opencontainers.image.documentation="https://docs.stirlingpdf.com" \ + maintainer="Stirling-Tools" \ + org.opencontainers.image.authors="Stirling-Tools" \ + org.opencontainers.image.version="${VERSION_TAG}" \ + org.opencontainers.image.keywords="PDF, manipulation, backend, API, Spring Boot" + +EXPOSE 8080/tcp +STOPSIGNAL SIGTERM + +HEALTHCHECK --interval=30s --timeout=15s --start-period=120s --retries=5 \ + CMD curl -fs --max-time 10 http://localhost:8080${SYSTEM_ROOTURIPATH:-''}/api/v1/info/status || exit 1 + +ENTRYPOINT ["tini", "--", "/scripts/init.sh"] +CMD [] diff --git a/docker/frontend/Dockerfile b/docker/frontend/Dockerfile index e92f19ddc..99d449321 100644 --- a/docker/frontend/Dockerfile +++ b/docker/frontend/Dockerfile @@ -1,3 +1,8 @@ +# check=skip=SecretsUsedInArgOrEnv +# The only ARG the SecretsUsedInArgOrEnv rule flags here is the Supabase +# PUBLISHABLE key — a client-safe value embedded in the bundle by design, not a +# secret. No real secrets are passed via ARG/ENV in this image. + # Frontend Dockerfile - React/Vite application FROM node:25-alpine@sha256:e80397b81fa93888b5f855e8bef37d9b18d3c5eb38b8731fc23d6d878647340f AS build @@ -12,8 +17,39 @@ RUN npm ci # Copy source code COPY frontend . -# Build the application (vite root is editor/, output lands in editor/dist/) -RUN npx vite build editor +# Generate the material-symbols icon subset that LocalIcon.tsx imports at build +# time. Normally produced by `task frontend:build:` via its prepare:icons +# dependency; since this Dockerfile invokes vite directly, run it explicitly. +# Fully offline — reads the @iconify-json/material-symbols dev dependency. +RUN node editor/scripts/generate-icons.js + +# ---- Build configuration (backward compatible) ---- +# STIRLING_FLAVOR selects the editor tsconfig + source set (see +# frontend/editor/vite.config.ts). VITE_BUILD_MODE selects which .env. +# files vite loads and is passed to `vite build --mode`. The defaults below +# reproduce the previous behaviour exactly: proprietary flavor, production mode +# (vite's implicit default for `vite build`). +# +# VITE_SUPABASE_URL + VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY are CLIENT-SAFE +# publishable values, NOT secrets. They are intentionally empty here so the OSS +# repo ships no injected config; a downstream pipeline (e.g. SaaS) passes the +# target project's publishable values as build args. Note: .env* is excluded by +# .dockerignore, so these args are the only way Supabase config reaches the +# bundle in a Docker build. vite's loadEnv merges (and prioritises) VITE_- +# prefixed process env vars, so exporting them before `vite build` is enough. +ARG STIRLING_FLAVOR=proprietary +ARG VITE_BUILD_MODE=production +ARG VITE_SUPABASE_URL="" +# pragma: allowlist secret — Supabase publishable key (safe for client) +ARG VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY="" + +# Build the application (vite root is editor/, output lands in editor/dist/). +# Only export the Supabase overrides when provided so unset stays unset. +RUN set -eu; \ + export STIRLING_FLAVOR="${STIRLING_FLAVOR}"; \ + if [ -n "${VITE_SUPABASE_URL}" ]; then export VITE_SUPABASE_URL="${VITE_SUPABASE_URL}"; fi; \ + if [ -n "${VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY}" ]; then export VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY="${VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY}"; fi; \ + npx vite build editor --mode "${VITE_BUILD_MODE}" # Production stage FROM nginx:alpine@sha256:b0f7830b6bfaa1258f45d94c240ab668ced1b3651c8a222aefe6683447c7bf55 @@ -35,4 +71,4 @@ EXPOSE 80 ENV VITE_API_BASE_URL=http://backend:8080 # Use custom entrypoint -ENTRYPOINT ["/entrypoint.sh"] \ No newline at end of file +ENTRYPOINT ["/entrypoint.sh"] diff --git a/engine/Dockerfile b/engine/Dockerfile index c9c8d2239..2f826120b 100644 --- a/engine/Dockerfile +++ b/engine/Dockerfile @@ -10,17 +10,40 @@ RUN apt-get update \ && rm /tmp/task.deb \ && rm -rf /var/lib/apt/lists/* -WORKDIR /app +# The OSS repo's root Taskfile.yml expects engine tasks to run from ./engine/ +# (configured via `includes.engine.dir: engine`). The OSS-clone-build workflow +# copies the root Taskfile.yml + .taskfiles/ into the engine build context, then +# this Dockerfile copies them into the image. To match the Taskfile's expectations +# at runtime, engine source must live at /app/engine/ — not flattened to /app/ — +# so `task engine:run` can chdir there successfully and uv resolves +# scripts/setup_env.py to /app/engine/scripts/setup_env.py. +# +# Layout: +# /app/Taskfile.yml ← workflow-copied root Taskfile +# /app/.taskfiles/ ← workflow-copied .taskfiles +# /app/engine/pyproject.toml +# /app/engine/uv.lock +# /app/engine/.env +# /app/engine/scripts/ ← scripts/setup_env.py here +# /app/engine/src/ ← uvicorn entrypoint dir +# /app/engine/.venv/ ← uv-managed venv +WORKDIR /app/engine -COPY pyproject.toml uv.lock Taskfile.yml .env ./ -COPY .taskfiles/ ./.taskfiles/ +COPY pyproject.toml uv.lock .env ./ COPY scripts/ ./scripts/ RUN --mount=type=cache,target=/root/.cache/uv \ uv sync --frozen --no-dev COPY src/ ./src/ -ENV PATH="/app/.venv/bin:$PATH" +# Task definitions live at /app/ — root Taskfile + included .taskfiles — because +# the root Taskfile's `includes.engine.dir: engine` is resolved relative to the +# Taskfile's own location, so it must sit one level above engine/. +WORKDIR /app +COPY Taskfile.yml ./ +COPY .taskfiles/ ./.taskfiles/ + +ENV PATH="/app/engine/.venv/bin:$PATH" ENV PYTHONUNBUFFERED=1 EXPOSE 5001