bvandeusenandClaude Opus 5.5
ed9da56efa
The Syslog page says where to send (this server, its port and protocols) and where the setting is on Synology, QNAP, TrueNAS, OpenWrt, UniFi and rsyslog, open until a device sends. A sender whose address is on Steward's own container network (Swarm ingress publishing hides the real sender) is flagged, with the host-mode ports to publish instead. compose files and the Dockerfile publish 5514/udp and /tcp; docs/plugins/syslog.md describes the plugin and the deploy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
59 lines
2.5 KiB
Docker
59 lines
2.5 KiB
Docker
# The Python CI tests on (ci-python:3.14), so the image runs what was tested.
|
|
FROM python:3.14-slim
|
|
|
|
RUN DEBIAN_FRONTEND=noninteractive apt-get update \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
|
iputils-ping \
|
|
# gosu — minimal privilege-drop tool used by entrypoint.sh
|
|
gosu \
|
|
# openssh-client — ansible-playbook reaches remote hosts over ssh
|
|
openssh-client \
|
|
# sshpass — Ansible shells out to it for first-contact password SSH
|
|
# (provisioning a fresh host before the managed key is installed)
|
|
sshpass \
|
|
# git — clones and pulls Ansible git sources (Settings > Ansible)
|
|
git \
|
|
# tini — PID 1: reaps the zombies ssh and ansible leave behind and
|
|
# forwards SIGTERM to Steward so a stop is a graceful shutdown
|
|
tini \
|
|
# tzdata — the zone database, so times show in each reader's own zone
|
|
# (milestone 490); Debian's slim base no longer carries it
|
|
tzdata \
|
|
# postgresql-client-17 — pg_dump and pg_restore for Steward's own
|
|
# backups (milestone 507); 17 reads and writes a Postgres 16 server
|
|
postgresql-client-17 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Upgrade pip to suppress the version notice
|
|
RUN pip install --upgrade pip
|
|
|
|
WORKDIR /app
|
|
|
|
COPY pyproject.toml .
|
|
COPY steward/ steward/
|
|
# Bundle the extras whose features ship in the image: [ansible] for the
|
|
# playbook runner, [snmp] (pysnmp) for the SNMP poller, [ldap] (ldap3, pure
|
|
# Python) for LDAP sign-in under Settings -> Auth. Without them those features
|
|
# load but fail for want of their runtime dependency.
|
|
RUN pip install --no-cache-dir '.[ansible,snmp,ldap]'
|
|
|
|
COPY alembic.ini .
|
|
# First-party plugins ship inside the image (bundled root at /app/plugins).
|
|
# Third-party plugins are mounted at runtime into the external root
|
|
# (STEWARD_PLUGIN_DIR, default /data/plugins).
|
|
COPY plugins/ plugins/
|
|
COPY entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
|
|
# Runtime directories — owned by app user. The container starts as root
|
|
# so the entrypoint can fix up /data permissions if needed, then drops to
|
|
# 'app' (uid 1000) via gosu before launching steward.
|
|
RUN useradd -m -u 1000 app \
|
|
&& mkdir -p /data/ansible/sources /data/ansible/runs /data/ansible/playbooks /data/plugins \
|
|
&& chown -R app:app /data /app
|
|
|
|
EXPOSE 5000 5514/udp 5514/tcp
|
|
|
|
ENTRYPOINT ["/usr/bin/tini", "--", "/entrypoint.sh"]
|
|
CMD ["steward", "--host", "0.0.0.0", "--port", "5000"]
|