mirror of
https://github.com/MODSetter/SurfSense.git
synced 2026-10-26 08:11:18 +00:00
a0c715633b
plugins/registry/ holds the list publishers add to by pull request, starting with DeepWiki, and its icons. registry_check checks every entry and icon rule; on dev, CI signs the list with Ed25519 into published/, which the release pull request carries to main, so nothing pushes to main and the source list is never rewritten. A small Caddy container serves the signed list, its icons and SurfSense's OAuth client document and callback page on plugins.surfsense.com, apart from the plugin host so a listing never restarts the scrapers. CI does not contact listed servers: most need a sign-in, so a maintainer connects each listing on dev. plugins/README.md is the guide for publishers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
58 lines
2.2 KiB
Docker
58 lines
2.2 KiB
Docker
# syntax=docker.io/docker/dockerfile:1
|
|
# The plugin host: one image for every SurfSense plugin, wherever it is deployed.
|
|
#
|
|
# The build context is plugins/; the registry has its own image (plugins/registry/).
|
|
# docker build -f plugins/remote/host/Dockerfile -t surfsense-plugins plugins
|
|
# docker run --env-file plugins/remote/host/.env -p 8000:8000 surfsense-plugins
|
|
# Settings are environment variables; host/.env.example lists them.
|
|
|
|
FROM python:3.12-slim
|
|
|
|
ENV PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
# Outside /root, so the unprivileged user below can launch them.
|
|
PLAYWRIGHT_BROWSERS_PATH=/ms-playwright \
|
|
PORT=8000
|
|
|
|
# Real fonts, so a stealth browser's canvas and font fingerprints look like a
|
|
# desktop's rather than a bare server's; Xvfb, a virtual display for the headed
|
|
# browser TikTok's profile feeds need.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
xvfb \
|
|
fonts-noto-color-emoji \
|
|
fonts-unifont \
|
|
fonts-ipafont-gothic \
|
|
fonts-wqy-zenhei \
|
|
fonts-tlwg-loma-otf \
|
|
fonts-dejavu \
|
|
fonts-liberation \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /srv/remote
|
|
|
|
# Dependencies first, frozen from uv.lock, so a code change reuses this layer.
|
|
COPY remote/host/pyproject.toml remote/host/uv.lock host/
|
|
RUN pip install --no-cache-dir uv \
|
|
&& uv export --project host --frozen --no-dev --no-hashes \
|
|
--format requirements-txt -o /tmp/requirements.txt \
|
|
&& uv pip install --system --no-cache-dir -r /tmp/requirements.txt \
|
|
&& rm /tmp/requirements.txt
|
|
|
|
# Chromium and the system libraries it needs, for Scrapling's fetchers; then
|
|
# patchright's own build, which its stealth fetchers launch.
|
|
RUN scrapling install \
|
|
&& python -m patchright install chromium \
|
|
&& chmod -R a+rX "$PLAYWRIGHT_BROWSERS_PATH"
|
|
|
|
# plugins/remote/ is the import root: `python -m host` runs from here.
|
|
COPY remote/ .
|
|
RUN chmod +x host/entrypoint.sh
|
|
|
|
RUN useradd --create-home --uid 10001 plugins
|
|
USER plugins
|
|
|
|
EXPOSE 8000
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s \
|
|
CMD python -c "import os, urllib.request; urllib.request.urlopen(f'http://127.0.0.1:{os.environ[\"PORT\"]}/health', timeout=4)"
|
|
CMD ["host/entrypoint.sh"]
|