1539c7a67b
The server container mounts the platform's certs volume at /certs but the CA bundle was never imported into the JVM truststore. OIDC discovery failed with PKIX path building errors when a self-signed or custom CA was in use. The new entrypoint script splits the PEM bundle and imports each cert via keytool before starting the app. This makes the conditional CAMELEER_OIDC_TLS_SKIP_VERIFY logic in the SaaS provisioner work correctly: when ca.pem exists, the JVM now actually trusts it. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
26 lines
913 B
Docker
26 lines
913 B
Docker
FROM --platform=$BUILDPLATFORM maven:3.9-eclipse-temurin-17 AS build
|
|
WORKDIR /build
|
|
|
|
# Configure Gitea Maven Registry for cameleer3-common dependency
|
|
ARG REGISTRY_TOKEN
|
|
RUN mkdir -p ~/.m2 && \
|
|
echo '<settings><servers><server><id>gitea</id><username>cameleer</username><password>'${REGISTRY_TOKEN}'</password></server></servers></settings>' > ~/.m2/settings.xml
|
|
|
|
COPY pom.xml .
|
|
COPY cameleer3-server-core/pom.xml cameleer3-server-core/
|
|
COPY cameleer3-server-app/pom.xml cameleer3-server-app/
|
|
# Cache deps — only re-downloaded when POMs change
|
|
RUN mvn dependency:go-offline -B || true
|
|
COPY . .
|
|
RUN mvn clean package -DskipTests -U -B
|
|
|
|
FROM eclipse-temurin:17-jre
|
|
WORKDIR /app
|
|
COPY --from=build /build/cameleer3-server-app/target/cameleer3-server-app-*.jar /app/server.jar
|
|
COPY docker-entrypoint.sh /app/
|
|
RUN chmod +x /app/docker-entrypoint.sh
|
|
|
|
EXPOSE 8081
|
|
ENV TZ=UTC
|
|
ENTRYPOINT ["/app/docker-entrypoint.sh"]
|