disable apk cache

.gitea/workflows/build_and_publish.yaml

@@ -1,30 +1,73 @@
 ---
 name: Container Publish
 
+env:
+  REGISTRY: docker.asperti.com
+  REPOSITORY: paspo/powerdns
+
 on:
   push:
-    tags:
-      - '*'
   schedule:
-    - cron: "0 12 3 * *"
+    - cron: "0 12 * * 3"
   workflow_dispatch:
+  workflow_call:
+  workflow_run:
+    workflows: [vulnscan.yaml]
+    types: [completed]
 
 jobs:
+  on-success-skip:
+    runs-on:
+      labels: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    steps:
+      - run: exit_with_success
+
   build-image:
-    runs-on: ubuntu-latest
+    runs-on:
+      labels: [ubuntu-latest, "arch-${{ matrix.arch }}"]
     container:
       image: catthehacker/ubuntu:act-latest
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
+
     steps:
       - uses: actions/checkout@v4
 
       - name: Login to registry
         uses: docker/login-action@v3
         with:
-          registry: docker.asperti.com
+          registry: ${{ env.REGISTRY }}
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and publish
         run: |
-          docker build -t docker.asperti.com/paspo/powerdns:latest --platform linux/amd64 -f Dockerfile .
+          docker build \
-          docker push docker.asperti.com/paspo/powerdns:latest
+            --tag ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:latest-${{ matrix.arch }} \
+            --platform linux/${{ matrix.arch }} --no-cache -f Dockerfile .
+          docker push ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:latest-${{ matrix.arch }}
+
+  manifest:
+    name: update docker manifest
+    needs: build-image
+    runs-on: ubuntu-latest
+    container:
+      image: catthehacker/ubuntu:act-latest
+
+    steps:
+      - name: Login to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: latest
+        run: |
+          docker manifest create \
+            ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:latest \
+            --amend ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:latest-amd64 \
+            --amend ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:latest-arm64
+          docker manifest push ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:latest

.gitea/workflows/vulnscan.yaml

@@ -1,21 +1,33 @@
 ---
 name: Vulnerability Scan
 
+env:
+  REGISTRY: docker.asperti.com
+  REPOSITORY: paspo/powerdns
+
 on:
   schedule:
     - cron: "0 14 * * *"
   workflow_dispatch:
+  workflow_call:
+  workflow_run:
+    workflows: [build_and_publish.yaml]
+    types: [completed]
 
 jobs:
   scan:
     name: Daily Vulnerability Scan
-    runs-on: ubuntu-latest
+    runs-on:
+      labels: [ubuntu-latest, "arch-${{ matrix.arch }}"]
     container:
       image: catthehacker/ubuntu:act-latest
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
 
     steps:
       - name: Pull docker image
-        run: docker pull docker.asperti.com/paspo/powerdns:latest
+        run: docker pull ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:latest
 
       - name: Setup trivy
         run: |
@@ -32,9 +44,7 @@ jobs:
       - name: Run Trivy vulnerability scanner
         id: scan
         run: |
-          trivy --server ${{ secrets.TRIVY_SERVER }} \
+          trivy --server ${{ secrets.TRIVY_SERVER }} --token ${{ secrets.TRIVY_TOKEN }} image --format json ${{ env.REGISTRY }}/${{ env.REPOSITORY }}:latest > trivy-results.json
-            --token ${{ secrets.TRIVY_TOKEN }} image --format json \
-            docker.asperti.com/paspo/powerdns:latest > trivy-results.json
 
       # if some vulnerability is found, we fail
       - name: check output
@@ -51,4 +61,4 @@ jobs:
           token: ${{ secrets.TELEGRAM_TOKEN }}
           format: markdown
           message: |
-            Found **${{ steps.vulncount.outputs.VULNCOUNT }}** vulnerabilities in `${{ github.repository }}`
+            Found **${{ steps.vulncount.outputs.VULNCOUNT }}** vulnerabilities in `${{ env.REGISTRY }}/${{ env.REPOSITORY }}:latest`

Dockerfile

@@ -1,12 +1,12 @@
 FROM alpine:latest
 
 RUN \
-  apk --update upgrade && \
+  apk --no-cache upgrade && \
-  apk add tini pdns pdns-backend-sqlite3
+  apk --no-cache add tini curl pdns pdns-backend-sqlite3
 
 COPY rootfs /
 
 HEALTHCHECK --interval=30s --start-period=5s --timeout=10s \
-  CMD /usr/bin/host -T -p 1053 asperti.com 127.0.0.1
+  CMD curl http://127.0.0.1:8081/metrics
 
 ENTRYPOINT ["/sbin/tini", "--", "/bin/sh", "/app/entrypoint.sh"]

rootfs/app/entrypoint.sh

@@ -17,7 +17,6 @@ EOF
 
 # database setup
 cat >> /etc/pdns/pdns.conf.d/sqlite.conf << EOF
-launch=gsqlite3
 gsqlite3-database=${DB_PATH}
 EOF
 DB_DIR=$(dirname "${DB_PATH}")

rootfs/etc/pdns/pdns.conf.d/launch.conf

@@ -0,0 +1 @@
+launch=gsqlite3

rootfs/etc/pdns/pdns.conf.d/webserver.conf

@@ -0,0 +1,3 @@
+webserver=yes
+webserver-address=0.0.0.0
+webserver-allow-from=0.0.0.0/0,::/0