maSSO/Dockerfile at main · doyensec/maSSO · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
# ── Stage 1: Build Go binary ──────────────────────────────────────────────────
FROM golang:1.25-bookworm AS go-builder
WORKDIR /build
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -trimpath -o masso .

# ── Stage 2: Install Node dependencies ────────────────────────────────────────
FROM node:18-bookworm-slim AS node-builder
WORKDIR /build
RUN apt-get update && apt-get install -y --no-install-recommends git \
    && rm -rf /var/lib/apt/lists/*
COPY saml-engine/package.json saml-engine/package-lock.json ./
RUN npm ci --omit=dev

# ── Stage 3: Final runtime image ──────────────────────────────────────────────
FROM node:18-bookworm-slim
WORKDIR /app

# cloudflared for optional Quick Tunnel (MASSO_CLOUDFLARED=1, same as --cloudflared locally)
# https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/
# Use dpkg --print-architecture so arm64/amd64 images get the matching official binary (not build ARG).
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl \
    && set -eux; \
    DPKG_ARCH=$(dpkg --print-architecture); \
    case "$DPKG_ARCH" in \
        amd64) CF_ARCH=amd64 ;; \
        arm64) CF_ARCH=arm64 ;; \
        *) echo "Unsupported image arch=$DPKG_ARCH (official cloudflared builds: amd64, arm64)"; exit 1 ;; \
    esac; \
    curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${CF_ARCH}" \
        -o /usr/local/bin/cloudflared; \
    chmod +x /usr/local/bin/cloudflared; \
    /usr/local/bin/cloudflared --version; \
    apt-get purge -y curl; \
    apt-get autoremove -y; \
    rm -rf /var/lib/apt/lists/*

COPY --from=go-builder /build/masso ./masso
COPY saml-engine/ ./saml-engine/
COPY --from=node-builder /build/node_modules ./saml-engine/node_modules
COPY dashboard/ui.html ./dashboard/ui.html
COPY docs/assets/masso-logo.png ./docs/assets/masso-logo.png
COPY entrypoint.sh ./entrypoint.sh
RUN chmod +x ./masso ./entrypoint.sh

# IdP endpoints (expose publicly) and attacker dashboard
EXPOSE 8081 8082

# Persist database, crypto key, and SAML certs across restarts
VOLUME ["/app/data"]

ENTRYPOINT ["./entrypoint.sh"]
CMD ["oidc"]