Adding release notes and weekly build support (to pull latest nginx release)

2026-08-01 14:26:55 +02:00
parent 8022bd5834
commit 7116fff888
3 changed files with 113 additions and 3 deletions
@@ -10,7 +10,8 @@ steps:
        path: /var/run/docker.sock
    commands:
      - echo "Building redirect image on host Docker daemon..."
-      - docker build -t redirect:latest .
+      # --pull ensures base image vulnerabilities/patches are pulled on weekly cron builds
+      - docker build --pull -t redirect:latest .
      - |
        if [ -n "$DRONE_COMMIT_SHA" ]; then
          SHORT_SHA=$(echo $DRONE_COMMIT_SHA | cut -c1-7)
@@ -22,6 +23,15 @@ steps:
          docker tag redirect:latest redirect:$DRONE_TAG
          echo "Tagged redirect:$DRONE_TAG"
        fi
+      - |
+        # Fetch latest git tag to update the latest release tag (e.g., on weekly cron builds)
+        apk add --no-cache git 2>/dev/null || true
+        git fetch --tags 2>/dev/null || true
+        LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)
+        if [ -n "$LATEST_TAG" ]; then
+          docker tag redirect:latest redirect:$LATEST_TAG
+          echo "Tagged latest release tag: redirect:$LATEST_TAG"
+        fi
      - echo "Build complete. Images registered on host Docker engine:"
      - docker images | grep redirect || true

@@ -34,4 +44,4 @@ trigger:
  event:
    - push
    - tag
-
+    - cron
@@ -1,5 +1,7 @@
 # Unprivileged Nginx Redirect Docker Image

+[![Build Status](https://ci.mrose.cloud/api/badges/vincent/redirect/status.svg?ref=refs/heads/main)](https://ci.mrose.cloud/vincent/redirect)
+
 A lightweight, secure, and reusable Docker image based on `nginxinc/nginx-unprivileged:alpine-slim` designed to redirect HTTP requests to any configurable target domain/path with customizable HTTP status codes.

 It is designed to be built via **Drone CI** directly onto the host server's Docker daemon, allowing multiple containers to run on the host system using the single tagged image.
@@ -42,16 +44,34 @@ steps:
      - name: dockersock
        path: /var/run/docker.sock
    commands:
-      - docker build -t redirect:latest .
+      - docker build --pull -t redirect:latest .
      - |
        if [ -n "$DRONE_COMMIT_SHA" ]; then
          SHORT_SHA=$(echo $DRONE_COMMIT_SHA | cut -c1-7)
          docker tag redirect:latest redirect:$SHORT_SHA
        fi
+      - |
+        if [ -n "$DRONE_TAG" ]; then
+          docker tag redirect:latest redirect:$DRONE_TAG
+        fi
+      - |
+        apk add --no-cache git 2>/dev/null || true
+        git fetch --tags 2>/dev/null || true
+        LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)
+        if [ -n "$LATEST_TAG" ]; then
+          docker tag redirect:latest redirect:$LATEST_TAG
+        fi
+
 volumes:
  - name: dockersock
    host:
      path: /var/run/docker.sock
+
+trigger:
+  event:
+    - push
+    - tag
+    - cron
 ```

 > **Note**: Ensure your Drone runner environment allows mounting the host socket volume.
@@ -72,6 +92,16 @@ git push origin v1.0.0
 2. Drone automatically populates `$DRONE_TAG` with the tag value (e.g. `v1.0.0`) and triggers the pipeline.
 3. The pipeline builds and tags the host image as `redirect:v1.0.0` (as well as `redirect:latest` and `redirect:<short_sha>`).

+### Weekly Scheduled Rebuilds (`weekly-build`)
+
+To keep your Docker images updated with upstream OS/Nginx security patches:
+
+1. In the **Drone CI UI** (or via Drone CLI), navigate to **Repository Settings** -> **Cron Jobs**.
+2. Add a new Cron job named `weekly-build` set to trigger weekly (e.g., `@weekly` or `0 0 * * 0`).
+3. When the `cron` event triggers:
+   - The pipeline executes `docker build --pull -t redirect:latest .` to fetch updated base layers from Alpine/Nginx.
+   - It fetches the latest Git release tag (`git describe --tags --abbrev=0`) and automatically updates `redirect:<latest_tag>` (e.g., `redirect:v1.0.0`) on the host daemon.
+
 ---

 ## Quick Start & Usage
@@ -0,0 +1,70 @@
+# Release v1.0.0 - Initial Release: Reusable Unprivileged Nginx Redirect
+
+We are pleased to announce **v1.0.0** of the Reusable Unprivileged Nginx Redirect container image! This release provides an ultra-lightweight, secure, non-root Docker solution for redirecting web traffic dynamically using environment variables.
+
+---
+
+## 🚀 Key Features
+
+* **Non-Root & Secure Base**: Built on `nginxinc/nginx-unprivileged:alpine-slim` (~12 MB footprint, runs as UID 101).
+* **Zero Overhead Template Engine**: Leverages native Nginx Docker template substitution (`envsubst`) on startup.
+* **Drone CI Host Integration**: Pipeline builds directly onto the host server's Docker daemon via `/var/run/docker.sock`, making tagged images immediately available locally for `docker run` or `docker compose`.
+* **Path & Query String Preservation**: Support for preserving request paths via `$request_uri` (e.g., `REDIRECT_TARGET="https://destination.com$request_uri"`).
+* **Health Check Bypass Endpoint**: Built-in `/healthz` location returns `200 OK` for orchestrator probes without triggering redirects.
+
+---
+
+## ⚙️ Environment Variables
+
+| Variable | Default Value | Description |
+| :--- | :--- | :--- |
+| `REDIRECT_TARGET` | `https://example.com` | Target URL/domain for redirection. Append `$request_uri` to preserve path & query parameters. |
+| `REDIRECT_CODE` | `301` | HTTP status code for redirection (e.g., `301`, `302`, `307`, `308`). |
+| `LISTEN_PORT` | `8080` | Internal listening port (unprivileged non-root standard). |
+
+---
+
+## 📦 Drone CI Pipeline
+
+Builds are triggered automatically on `push` and `tag` events. The host image is tagged as:
+- `redirect:latest`
+- `redirect:<commit_sha>`
+- `redirect:<git_tag>` (e.g., `redirect:v1.0.0`)
+
+---
+
+## 🛠️ Quick Usage Examples
+
+### Single Container (Docker Run)
+
+```bash
+docker run -d \
+  --name redirect-domain \
+  -p 8080:8080 \
+  -e REDIRECT_TARGET="https://example.com\$request_uri" \
+  -e REDIRECT_CODE="301" \
+  redirect:v1.0.0
+```
+
+### Multi-Container Deployment (Docker Compose)
+
+```yaml
+services:
+  site-a-redirect:
+    image: redirect:v1.0.0
+    container_name: site-a-redirect
+    ports:
+      - "8081:8080"
+    environment:
+      - REDIRECT_TARGET=https://site-a.com
+      - REDIRECT_CODE=301
+
+  site-b-redirect:
+    image: redirect:v1.0.0
+    container_name: site-b-redirect
+    ports:
+      - "8082:8080"
+    environment:
+      - REDIRECT_TARGET=https://site-b.com$request_uri
+      - REDIRECT_CODE=302
+```