claude-macmini
21b237f0da
All checks were successful
build-and-push / build (push) Successful in 8s
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
22 lines
1.2 KiB
Docker
22 lines
1.2 KiB
Docker
# WKD (OpenPGP Web Key Directory) — publieke PGP-sleutels van de eigenaar, advanced method
|
|
# (https://openpgpkey.<domein>/.well-known/openpgpkey/<domein>/hu/<hash>?l=<local-part>).
|
|
# Route-B image-app op de derden-box. Alles in git (alleen PUBLIEKE sleutels — nooit een privésleutel
|
|
# of passphrase in deze repo); sleutel toevoegen/vernieuwen = commit + push → CI → watcher deployt.
|
|
#
|
|
# Twee stappen:
|
|
# 1. build-stage: GnuPG's eigen gpg-wks-client bouwt uit keys/<domein>/<adres>.asc de hu/-boom
|
|
# (z-base-32(SHA-1(lowercased local-part))) + het verplichte policy-bestand. Het GnuPG-tool
|
|
# garandeert de juiste hash én exporteert alléén de UID van dat adres (spec: andere UIDs MOETEN weg).
|
|
# 2. runtime: nginx serveert de boom met de juiste headers (application/octet-stream, CORS *).
|
|
# Bumpen = de twee FROM-tags (Docker Hub: library/alpine, library/nginx).
|
|
|
|
FROM alpine:3.22.5 AS build
|
|
RUN apk add --no-cache gnupg gnupg-wks-client
|
|
COPY keys/ /keys/
|
|
COPY build-wkd.sh /build-wkd.sh
|
|
RUN sh /build-wkd.sh /keys /out
|
|
|
|
FROM nginx:1.30.4-alpine
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
COPY --from=build /out/ /usr/share/nginx/html/.well-known/openpgpkey/
|
|
EXPOSE 80
|