From a6d6658bdbeab8ed740ced57784561731228417b Mon Sep 17 00:00:00 2001
From: Janik von Rotz <login@janikvonrotz.ch>
Date: Sun, 14 Sep 2025 15:37:35 +0200
Subject: [PATCH] feat(docker): add Docker image build and deployment with
 Forgejo CI and entrypoint script

---
 .dockerignore                |  3 ++
 .forgejo/workflows/build.yml | 41 +++++++++++++++++++++++
 image/Dockerfile             | 18 ++++++++++
 image/README.md              | 33 ++++++++++++++++++
 image/entrypoint.sh          | 65 ++++++++++++++++++++++++++++++++++++
 task                         | 37 +++++++++++++-------
 6 files changed, 185 insertions(+), 12 deletions(-)
 create mode 100644 .dockerignore
 create mode 100644 .forgejo/workflows/build.yml
 create mode 100644 image/Dockerfile
 create mode 100644 image/README.md
 create mode 100644 image/entrypoint.sh

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..0e7fa33
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,3 @@
+**
+!./bin
+!./image
diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
new file mode 100644
index 0000000..1d1c775
--- /dev/null
+++ b/.forgejo/workflows/build.yml
@@ -0,0 +1,41 @@
+
+on:
+  push:
+    branches:
+      - "main"
+
+jobs:
+  build:
+    name: Build Docker Image
+    runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-latest
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Create Kubeconfig for Buildx
+        run: |
+          mkdir -p $HOME/.kube
+          echo "${{ secrets.KUBECONFIG_BUILDX }}" > $HOME/.kube/config
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: kubernetes
+          driver-opts: |
+            namespace=codeberg
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          username: janikvonrotz
+          password: ${{ secrets.DOCKER_PAT }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: janikvonrotz/taskfile.build:latest
diff --git a/image/Dockerfile b/image/Dockerfile
new file mode 100644
index 0000000..2387ca6
--- /dev/null
+++ b/image/Dockerfile
@@ -0,0 +1,18 @@
+FROM node:20-slim
+
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable && \
+    apt-get update && \
+    apt-get install -y git hugo caddy && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY ./bin /usr/local/bin
+COPY ./image/entrypoint.sh /usr/local/bin/entrypoint.sh
+
+EXPOSE 80
+
+ENTRYPOINT ["./entrypoint.sh"]
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD curl -f http://localhost:80/ || exit 1
diff --git a/image/README.md b/image/README.md
new file mode 100644
index 0000000..a0caf2a
--- /dev/null
+++ b/image/README.md
@@ -0,0 +1,33 @@
+
+[taskfile.build](https://taskfile.build/image)
+===
+
+[![Docker pulls](https://img.shields.io/docker/pulls/janikvonrotz/taskfile-build)](https://hub.docker.com/r/janikvonrotz/taskfile-build/)
+
+The taskfile.build Docker image runs any project. The only thing required is a task file.
+
+Source: <https://git.taskfile.build/tree/main/image>
+
+## Usage
+
+Setup environment variables:
+
+```bash
+export GIT_URL="https://git.taskfile.build"
+export TASK_COMMANDS="install,build"
+export CADDY_ROOT="_site"
+```
+
+Run the tasfile.buld image:
+
+```bash
+function run() {
+    echo "Open http://localhost:8080 in your browser"
+    docker run -p 8080:80 \
+        -e GIT_URL="$GIT_URL" \
+        -e TASK_COMMANDS="$TASK_COMMANDS" \
+        -e CADDY_ROOT="$CADDY_ROOT" \
+        janikvonrotz/taskfile.build:latest
+```
+
+The entrypoint script of the container will clone the project from git url. If the project is already cloned it will pull the origin. Afterwards if runs each command in the root the of the cloned repository with the task file `./task <command>`. Finally the Caddy webserver is started that serves static content from the root path.
diff --git a/image/entrypoint.sh b/image/entrypoint.sh
new file mode 100644
index 0000000..4aded78
--- /dev/null
+++ b/image/entrypoint.sh
@@ -0,0 +1,65 @@
+#!/bin/bash
+set -e
+
+echo "pnpm version: $(pnpm --version)"
+echo "hugo version: $(hugo version)"
+
+
+if [ -z "$GIT_URL" ]; then
+    echo "Error: GIT_URL environment variable is required." >&2
+    exit 1
+fi
+
+if [ -z "$CADDY_ROOT" ]; then
+    echo "Error: CADDY_ROOT environment variable is required." >&2
+    exit 1
+fi
+
+
+GIT_LOCAL_PATH="${PWD}/repo"
+if [ ! -d "$GIT_LOCAL_PATH" ]; then
+    mkdir -p "$GIT_LOCAL_PATH"
+
+    echo "Cloning git repo: $GIT_URL"
+    git clone "$GIT_URL" "$GIT_LOCAL_PATH"
+else
+    echo "Pull git repo: $GIT_URL"
+    git -C "$GIT_LOCAL_PATH" pull
+fi
+
+echo "Ensure task file is executable."
+chmod +x "${GIT_LOCAL_PATH}/task"
+
+
+cd "$GIT_LOCAL_PATH"
+COMMANDS=$(echo "$TASK_COMMANDS" | tr "," "\n")
+for COMMAND in $COMMANDS; do
+    echo "Run task command: $COMMAND"
+    ./task "$COMMAND"
+done
+
+echo "Template Caddyfile."
+CADDY_ROOT="${CADDY_ROOT:=/srv}"
+
+cat > /etc/caddy/Caddyfile <<EOF
+:80 {
+    root * ${GIT_LOCAL_PATH}/${CADDY_ROOT}
+    file_server
+    try_files {path} {path}/ /index.html
+    encode gzip
+    header {
+        X-Content-Type-Options nosniff
+        X-Frame-Options DENY
+        X-XSS-Protection "1; mode=block"
+        Referrer-Policy strict-origin-when-cross-origin
+    }
+    @static {
+        file
+        path *.css *.js *.png *.jpg *.jpeg *.gif *.ico *.svg *.woff *.woff2 *.ttf *.eot
+    }
+    header @static Cache-Control "public, max-age=31536000, immutable"
+}
+EOF
+
+echo "Start Caddy."
+exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
diff --git a/task b/task
index 2bfe8a1..253091c 100755
--- a/task
+++ b/task
@@ -10,15 +10,15 @@ function help-table() {
     printf "$COLUMN" "Command" "Option" "Description"
     echo "|$(printf '%*s' $((CMD_WIDTH + 2)) '' | tr ' ' '-')|$(printf '%*s' $((OPT_WIDTH + 2)) '' | tr ' ' '-')|$(printf '%*s' $((DESC_WIDTH + 2)) '' | tr ' ' '-')|"
     printf "$COLUMN" "all" "" "Run all tasks."
-    printf "$COLUMN" "build" "" "Build the 11ty website."
+    printf "$COLUMN" "build-11ty" "" "Build the 11ty website."
+    printf "$COLUMN" "build-and-push-image" "" "Build and push Docker image."
     printf "$COLUMN" "commit-with-llm" "" "Commit with llm generated commit message."
-    printf "$COLUMN" "dev" "" "Run 11ty server."
+    printf "$COLUMN" "dev-11ty" "" "Run 11ty server."
     printf "$COLUMN" "help" "[grep]" "Show help for commands."
     printf "$COLUMN" "install" "" "Install node packages."
     printf "$COLUMN" "lint" "" "Lint code with prettier."
     printf "$COLUMN" "run-tests" "" "Test with shellcheck."
-    printf "$COLUMN" "serve" "" "Serve the 11ty output folder."
-    printf "$COLUMN" "publish" "" "Publish the static site."
+    printf "$COLUMN" "serve-11y" "" "Serve the 11ty output folder."
     printf "$COLUMN" "version" "" "Show version of required tools."
 }
 
@@ -48,11 +48,28 @@ fi
 
 # Project commands
 
+function build-and-push-image() {
+    echo "Building Docker image:"
+    SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) docker buildx build . \
+        --platform "linux/amd64,linux/arm64" \
+        --file "image/Dockerfile" \
+        --tag "janikvonrotz/taskfile.build:latest" \
+        --push
+}
+
+
+function run() {
+    echo "Open http://localhost:8080" in your browser
+    docker run -p 8080:80 "janikvonrotz/taskfile.build:latest" \
+
+}
+
+
 function install() {
     pnpm install
 }
 
-function dev() {
+function dev-11ty() {
     pnpm dlx @11ty/eleventy --serve
 }
 
@@ -65,18 +82,14 @@ function run-tests() {
     shellcheck task
 }
 
-function build() {
+function build-11ty() {
     pnpm dlx @11ty/eleventy
 }
 
-function serve() {
+function serve-11ty() {
     pnpx serve ./_site
 }
 
-function publish() {
-    vercel --prod
-}
-
 function version() {
     echo "eleventy: $(pnpm dlx @11ty/eleventy --version)"
 }
@@ -87,7 +100,7 @@ else
     case "$1" in
         all)
             install
-            build
+            build-11ty
             ;;
         *)
             echo "Unknown command: $1"