eho/register-referentie
1
0
Fork 0
Code Issues 16 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

ci(infra): Gitea Actions CI pipeline + full-stack compose smoke (closes #30) #50

Merged
not merged 12 commits from ci/30-gitea-actions-ci into main 2026-06-25 12:34:44 +00:00
Conversation 0 Commits 12 Files Changed 15 +50 -62
9 changed files with 50 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 6d8e1d0830 - Show all commits

24
docs/runbooks/gitea-actions-gotchas.md
View File

@@ -40,18 +40,24 @@ exposed it.
**Fix: bake assets into derived images instead of bind-mounting them.** Anything **Fix: bake assets into derived images instead of bind-mounting them.** Anything
a Compose service needs at runtime that lives in the repo is `COPY`-ed into a a Compose service needs at runtime that lives in the repo is `COPY`-ed into a
small derived image, so it is present regardless of where the daemon runs: small derived image, so it is present regardless of where the daemon runs. We use
**`build.dockerfile_inline`** — the 2-line recipe lives in the compose file, so
there are no standalone `Dockerfile` artifacts to maintain:
| Asset | Derived image | Dockerfile | | Asset | Derived image | Built by |
|---|---|---| |---|---|---|
| OpenZaak `setup_configuration/data.yaml` | `register-referentie/openzaak:dev` | `infra/openzaak/Dockerfile` | | OpenZaak `setup_configuration/data.yaml` | `register-referentie/openzaak:dev` | `oz-init` `dockerfile_inline` |
| Open Notificaties `setup_configuration/data.yaml` | `register-referentie/opennotificaties:dev` | `infra/opennotificaties/Dockerfile` | | Keycloak realm exports | `register-referentie/keycloak:dev` | `keycloak` `dockerfile_inline` |
| Keycloak realm exports | `register-referentie/keycloak:dev` | `infra/keycloak/Dockerfile` | | `workflows/registratie.bpmn` | `register-referentie/flowable-init:dev` | `flowable-init` `dockerfile_inline` |
| `workflows/registratie.bpmn` | `register-referentie/flowable-init:dev` | `build.dockerfile_inline` in the compose files |
The base image tag stays a build `arg` (`OPENZAAK_TAG`, `OPENNOTIFICATIES_TAG`) The base image tag is interpolated by Compose (`${OPENZAAK_TAG}`) so pinning is
so version pinning is unchanged. The three `*-init`/web/celery services that share unchanged. OpenZaak's `openzaak`/`oz-celery` reuse the one image `oz-init` builds.
a base now share one built image tag, so the bake happens once per `up --build`. Open Notificaties needs **no** bake — `nrc-init` runs migrations only, so all NRC
services use the plain base image.
`dockerfile_inline` works on both the CI runner (docker compose) and local
**podman-compose**, unlike `docker cp`-into-volumes (which needs `docker compose
create`, a subcommand podman-compose lacks).
**Why not the alternatives.** **Why not the alternatives.**

6
docs/runbooks/openzaak.md
View File

@@ -74,6 +74,6 @@ The Makefile auto-points `DOCKER_HOST` at the Podman socket when it exists, so t
- **Image tag.** Pinned to `openzaak/open-zaak:1.28.2` via `${OPENZAAK_TAG}` (bump - **Image tag.** Pinned to `openzaak/open-zaak:1.28.2` via `${OPENZAAK_TAG}` (bump
deliberately, not via `:latest`). deliberately, not via `:latest`).
- **Config is baked, not mounted.** `setup_configuration/data.yaml` is `COPY`-ed into - **Config is baked, not mounted.** `setup_configuration/data.yaml` is `COPY`-ed into
a derived image (`infra/openzaak/Dockerfile`) rather than bind-mounted, so the a derived image via `oz-init`'s inline Dockerfile (`build.dockerfile_inline` in
init container finds it on Gitea's containerized CI runner too. See the compose) rather than bind-mounted, so the init container finds it on Gitea's
[gitea-actions-gotchas.md](gitea-actions-gotchas.md). containerized CI runner too. See [gitea-actions-gotchas.md](gitea-actions-gotchas.md).

30
infra/docker-compose.yml
View File

@@ -47,11 +47,16 @@ services:
networks: [cg] networks: [cg]
oz-init: oz-init:
# Derived image: base OpenZaak + the setup_configuration YAML baked in. We use
# an inline Dockerfile (not a separate file, not a bind mount) because bind
# mounts don't reach sibling containers on the containerized CI runner.
# The ${OPENZAAK_TAG} below is interpolated by Compose. See
# docs/runbooks/gitea-actions-gotchas.md.
build: build:
context: ./openzaak context: ./openzaak
dockerfile: Dockerfile dockerfile_inline: |
args: FROM docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
OPENZAAK_TAG: ${OPENZAAK_TAG:-1.28.2} COPY setup_configuration /app/setup_configuration
image: register-referentie/openzaak:dev image: register-referentie/openzaak:dev
environment: &oz-env environment: &oz-env
DJANGO_SETTINGS_MODULE: openzaak.conf.docker DJANGO_SETTINGS_MODULE: openzaak.conf.docker
@@ -127,12 +132,9 @@ services:
networks: [cg] networks: [cg]
nrc-init: nrc-init:
build: # Plain base image — nrc-init runs migrations only (see command below), so it
context: ./opennotificaties # needs no baked config.
dockerfile: Dockerfile image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
args:
OPENNOTIFICATIES_TAG: ${OPENNOTIFICATIES_TAG:-1.16.1}
image: register-referentie/opennotificaties:dev
environment: &nrc-env environment: &nrc-env
DJANGO_SETTINGS_MODULE: nrc.conf.docker DJANGO_SETTINGS_MODULE: nrc.conf.docker
SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production} SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
@@ -165,7 +167,7 @@ services:
networks: [cg] networks: [cg]
nrc-web: nrc-web:
image: register-referentie/opennotificaties:dev image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
environment: *nrc-env environment: *nrc-env
healthcheck: healthcheck:
test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"] test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
@@ -181,7 +183,7 @@ services:
networks: [cg] networks: [cg]
nrc-celery: nrc-celery:
image: register-referentie/opennotificaties:dev image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
environment: *nrc-env environment: *nrc-env
command: /celery_worker.sh command: /celery_worker.sh
depends_on: depends_on:
@@ -191,9 +193,13 @@ services:
# ── Keycloak (S-02) ────────────────────────────────────────────────────── # ── Keycloak (S-02) ──────────────────────────────────────────────────────
keycloak: keycloak:
# Derived image: base Keycloak + the realm exports baked into the import dir
# (inline Dockerfile, no bind mount — see docs/runbooks/gitea-actions-gotchas.md).
build: build:
context: ./keycloak context: ./keycloak
dockerfile: Dockerfile dockerfile_inline: |
FROM quay.io/keycloak/keycloak:26.1
COPY realms /opt/keycloak/data/import
image: register-referentie/keycloak:dev image: register-referentie/keycloak:dev
command: ["start-dev", "--import-realm"] command: ["start-dev", "--import-realm"]
environment: environment:

7
infra/keycloak/Dockerfile
View File

@@ -1,7 +0,0 @@
# Derived Keycloak image with the four realm exports baked into the import dir.
# `start-dev --import-realm` reads /opt/keycloak/data/import at boot. Baking the
# realms in (rather than bind-mounting ./realms) keeps the import working on
# Gitea's containerized runner, where bind mounts do not reach sibling
# containers. See docs/runbooks/gitea-actions-gotchas.md.
FROM quay.io/keycloak/keycloak:26.1
COPY realms /opt/keycloak/data/import

6
infra/keycloak/docker-compose.yml
View File

@@ -9,9 +9,13 @@
# Admin console: http://localhost:8180/ (admin / admin — dev only) # Admin console: http://localhost:8180/ (admin / admin — dev only)
services: services:
keycloak: keycloak:
# Derived image: base Keycloak + realm exports baked into the import dir via an
# inline Dockerfile. See docs/runbooks/gitea-actions-gotchas.md.
build: build:
context: . context: .
dockerfile: Dockerfile dockerfile_inline: |
FROM quay.io/keycloak/keycloak:26.1
COPY realms /opt/keycloak/data/import
image: register-referentie/keycloak:dev image: register-referentie/keycloak:dev
command: ["start-dev", "--import-realm"] command: ["start-dev", "--import-realm"]
environment: environment:

7
infra/opennotificaties/Dockerfile
View File

@@ -1,7 +0,0 @@
# Derived Open Notificaties image with the setup_configuration YAML baked in.
# Rationale is identical to infra/openzaak/Dockerfile: bind mounts do not reach
# sibling containers on Gitea's containerized runner, so nrc-init would not find
# data.yaml. See docs/runbooks/gitea-actions-gotchas.md.
ARG OPENNOTIFICATIES_TAG=1.16.1
FROM docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG}
COPY setup_configuration /app/setup_configuration

12
infra/opennotificaties/docker-compose.yml
View File

@@ -33,12 +33,8 @@ services:
networks: [cg] networks: [cg]
nrc-init: nrc-init:
build: # Plain base image — nrc-init runs migrations only (see command below).
context: . image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
dockerfile: Dockerfile
args:
OPENNOTIFICATIES_TAG: ${OPENNOTIFICATIES_TAG:-1.16.1}
image: register-referentie/opennotificaties:dev
environment: &nrc-env environment: &nrc-env
DJANGO_SETTINGS_MODULE: nrc.conf.docker DJANGO_SETTINGS_MODULE: nrc.conf.docker
SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production} SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
@@ -69,7 +65,7 @@ services:
networks: [cg] networks: [cg]
nrc-web: nrc-web:
image: register-referentie/opennotificaties:dev image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
environment: *nrc-env environment: *nrc-env
healthcheck: healthcheck:
test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"] test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
@@ -85,7 +81,7 @@ services:
networks: [cg] networks: [cg]
nrc-celery: nrc-celery:
image: register-referentie/opennotificaties:dev image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
environment: *nrc-env environment: *nrc-env
command: /celery_worker.sh command: /celery_worker.sh
depends_on: depends_on:

12
infra/openzaak/Dockerfile
View File

@@ -1,12 +0,0 @@
# Derived OpenZaak image with the setup_configuration YAML baked in.
#
# Why bake instead of bind-mount: Gitea's containerized `ubuntu-latest` runner
# runs the job inside a container, so `docker compose` starts the stack as
# SIBLING containers via the host daemon. A bind mount of a workspace path is
# then resolved on the daemon host (where it does not exist), and Docker mounts
# an empty directory — oz-init would not find data.yaml and exits 1. Baking the
# file into the image makes it present regardless of runtime (local Podman or
# CI Docker-in-Docker). See docs/runbooks/gitea-actions-gotchas.md.
ARG OPENZAAK_TAG=1.28.2
FROM docker.io/openzaak/open-zaak:${OPENZAAK_TAG}
COPY setup_configuration /app/setup_configuration

8
infra/openzaak/docker-compose.yml
View File

@@ -32,11 +32,13 @@ services:
networks: [cg] networks: [cg]
oz-init: oz-init:
# Derived image: base OpenZaak + setup_configuration baked in via an inline
# Dockerfile. See docs/runbooks/gitea-actions-gotchas.md for why not a mount.
build: build:
context: . context: .
dockerfile: Dockerfile dockerfile_inline: |
args: FROM docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
OPENZAAK_TAG: ${OPENZAAK_TAG:-1.28.2} COPY setup_configuration /app/setup_configuration
image: register-referentie/openzaak:dev image: register-referentie/openzaak:dev
environment: &oz-env environment: &oz-env
DJANGO_SETTINGS_MODULE: openzaak.conf.docker DJANGO_SETTINGS_MODULE: openzaak.conf.docker