Containerization

.dockerignore

@@ -0,0 +1,32 @@
+# Include any files or directories that you don't want to be copied to your
+# container here (e.g., local build artifacts, temporary files, etc.).
+#
+# For more help, visit the .dockerignore file reference guide at
+# https://docs.docker.com/go/build-context-dockerignore/
+
+**/.DS_Store
+**/.classpath
+**/.dockerignore
+**/.env
+**/.git
+**/.gitignore
+**/.project
+**/.settings
+**/.toolstarget
+**/.vs
+**/.vscode
+**/*.*proj.user
+**/*.dbmdl
+**/*.jfm
+**/bin
+**/charts
+**/docker-compose*
+**/compose.y*ml
+**/Dockerfile*
+**/node_modules
+**/npm-debug.log
+**/obj
+**/secrets.dev.yaml
+**/values.dev.yaml
+LICENSE
+README.md

.github/workflows/docker.yml

@@ -0,0 +1,60 @@
+name: Docker build
+
+on:
+  push:
+    branches: [ master ]
+    # Publish semver tags as releases.
+    tags: [ '*.*.*' ]
+  pull_request:
+    branches: [ master ]
+
+env:
+  # Use docker.io for Docker Hub if empty
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}
+  DOCKER_BUILDKIT: 1
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+      attestations: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        id: push
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -2,6 +2,7 @@ lcpserve
 readium-lcp-server
 lcpencrypt/lcpencrypt
 files/
+data/
 *.sqlite*
 lcpserver/manage/config.js
 .vscode/launch.json

Dockerfile

@@ -0,0 +1,39 @@
+FROM golang:1.22 AS builder
+
+WORKDIR /usr/local/src
+
+RUN apt update && apt install -y build-essential libsqlite3-dev
+
+COPY go.mod go.sum ./
+
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=1 GOOS=linux go build -o /usr/local/bin/lcpencrypt ./lcpencrypt
+RUN CGO_ENABLED=1 GOOS=linux go build -o /usr/local/bin/lcpserver ./lcpserver
+RUN CGO_ENABLED=1 GOOS=linux go build -o /usr/local/bin/lsdserver ./lsdserver
+
+FROM debian:12-slim
+
+RUN apt update && apt install -y sqlite3 supervisor
+
+RUN useradd -m readium
+RUN useradd -m -g readium lcp
+RUN useradd -m -g readium lsd
+
+COPY --from=builder --chown=:readium --chmod=0550 /usr/local/bin/lcpencrypt /usr/local/bin/lcpencrypt
+COPY --from=builder --chown=lcp:readium --chmod=0540 /usr/local/bin/lcpserver /usr/local/bin/lcpserver
+COPY --from=builder --chown=lsd:readium --chmod=0540 /usr/local/bin/lsdserver /usr/local/bin/lsdserver
+COPY --from=builder --chown=readium:readium --chmod=0640 /usr/local/src/test/cert /usr/local/var/readium/lcp/cert
+
+COPY --chown=readium:readium --chmod=0440 docker/config.yaml /usr/local/etc/readium/config.yaml
+
+COPY docker/supervisord.conf /etc/supervisord.conf
+
+ENV READIUM_LCPSERVER_CONFIG=/usr/local/etc/readium/config.yaml
+ENV READIUM_LSDSERVER_CONFIG=/usr/local/etc/readium/config.yaml
+
+EXPOSE 8990
+
+ENTRYPOINT ["supervisord", "--nodaemon", "--configuration", "/etc/supervisord.conf"]

compose.yml

@@ -0,0 +1,19 @@
+services:
+  readium:
+    build: .
+    volumes:
+      - ./data/readium/db:/usr/local/var/readium/db
+      - ./data/readium/storage:/usr/local/var/readium/storage
+      - ./data/logs:/var/log/readium
+      - ./docker/config.yaml:/usr/local/etc/readium/config.yaml
+      - ./test/htpasswd:/usr/local/etc/readium/htpasswd
+      - ./test/cert/cert-edrlab-test.pem:/usr/local/var/readium/lcp/cert/cert.pem
+      - ./test/cert/privkey-edrlab-test.pem:/usr/local/var/readium/lcp/cert/privkey.pem
+  nginx:
+    image: nginx:1.27
+    volumes:
+      - ./docker/http.conf:/etc/nginx/conf.d/default.conf
+      - ./data/readium/storage:/usr/local/var/readium/storage
+      - ./data/logs/nginx:/var/log/nginx
+    ports:
+      - "8988:8988"

docker/config.yaml

@@ -0,0 +1,45 @@
+profile: "basic"
+
+lcp:
+  host: "0.0.0.0"
+  port: 8989
+  public_base_url: "http://127.0.0.1:8988/lcpserver"
+  database: "sqlite3://file:/usr/local/var/readium/db/lcp.sqlite?cache=shared&mode=rwc"
+  auth_file: "/usr/local/etc/readium/htpasswd"
+
+certificate:
+  cert: "/usr/local/var/readium/lcp/cert/cert.pem"
+  private_key: "/usr/local/var/readium/lcp/cert/privkey.pem"
+
+license:
+  links:
+    status: "https://www.example.net/lsdserver/licenses/{license_id}/status"
+    hint: "https://www.example.net/static/lcp_hint.html"
+
+filesystem:
+  mode: "fs"
+  directory: "/usr/local/var/readium/storage"
+  url: "http://127.0.0.1:8988/storage"
+
+lsd_notify_auth:
+  username: "admin"
+  password: "admin"
+
+lsd:
+  host: "0.0.0.0"
+  port: 8990
+  public_base_url: "http://127.0.0.1:8988/lsdserver"
+  database: "sqlite3://file:/usr/local/var/readium/db/lsd.sqlite?cache=shared&mode=rwc"
+  auth_file: "/usr/local/etc/readium/htpasswd"
+  license_link_url: "https://www.example.net/lcp/licenses/{license_id}"
+
+license_status:
+  register: true
+  renew: true
+  return: true
+  renting_days: 60
+  renew_days: 7
+
+lcp_update_auth:
+  username: "admin"
+  password: "admin"

docker/http.conf

@@ -0,0 +1,18 @@
+server {
+    client_max_body_size 0;
+
+    listen 8988;
+    server_name readium-fe;
+
+    location /lcpserver/ {
+        proxy_pass http://readium:8989/;
+    }
+
+    location /lsdserver/ {
+        proxy_pass http://readium:8990/;
+    }
+
+    location /storage/ {
+        alias /usr/local/var/readium/storage;
+    }
+}

docker/supervisord.conf

@@ -0,0 +1,25 @@
+[supervisord]
+nodaemon=true
+user=root
+
+[program:lsd]
+user=lsd
+group=readium
+directory=/usr/local/var/readium
+command=/usr/local/bin/lsdserver
+autostart=true
+autorestart=true
+priority=900
+stdout_logfile=/var/log/readium/lsd.std.log
+stderr_logfile=/var/log/readium/lsd.err.log
+
+[program:lcp]
+user=lcp
+group=readium
+directory=/usr/local/var/readium
+command=/usr/local/bin/lcpserver
+autostart=true
+autorestart=true
+priority=900
+stdout_logfile=/var/log/readium/lcp.std.log
+stderr_logfile=/var/log/readium/lcp.err.log

test/htpasswd

@@ -0,0 +1 @@
+admin:$apr1$z3d816lt$9y4ym05IQrez2gF4o9eaG1