Dockerfile

# IPFS Storage Service with WSS Support
# Based on ssl-manager for automatic SSL certificate management and HAProxy integration

# ---- Go sidecar build stage (issue #17) ----
# Builds the IPNS routing-get sidecar that replaces the Python hot path,
# eliminating CPython pymalloc fragmentation under high-throughput reads.
FROM golang:1.22-bookworm AS go-builder
WORKDIR /build
COPY go-sidecar/ ./
RUN go mod tidy && CGO_ENABLED=1 go build -o /go-sidecar -ldflags="-s -w" .

# ---- Main image ----
FROM ghcr.io/unicitynetwork/ssl-manager:latest

# ssl-manager is based on debian:trixie-slim and already includes:
#   certbot, openssl, curl, jq, netcat-openbsd, python3, procps, ca-certificates
#
# IPFS-specific dependencies:
RUN apt-get update && apt-get install -y --no-install-recommends \
    tini \
    nginx \
    libnginx-mod-stream \
    supervisor \
    gettext-base \
    python3-pip \
    python3-dev \
    # Build dependencies for secp256k1 Python package
    build-essential \
    autoconf \
    automake \
    libtool \
    libsecp256k1-dev \
    pkg-config \
    && rm -rf /var/lib/apt/lists/*

# Install IPFS Kubo
ARG IPFS_VERSION=v0.39.0
RUN cd /tmp && \
    ARCH=$(dpkg --print-architecture) && \
    curl -fsSL "https://dist.ipfs.tech/kubo/${IPFS_VERSION}/kubo_${IPFS_VERSION}_linux-${ARCH}.tar.gz" -o kubo.tar.gz && \
    tar -xzf kubo.tar.gz && \
    mv kubo/ipfs /usr/local/bin/ && \
    rm -rf /tmp/* && \
    ipfs --version

# Create ipfs user and directories
RUN useradd -m -d /data/ipfs -u 1000 -s /bin/bash ipfs && \
    mkdir -p /data/ipfs && \
    mkdir -p /data/ipfs/.config/ipfs/denylists && \
    chown -R ipfs:ipfs /data/ipfs

# Create nginx directories
RUN mkdir -p /run/nginx /var/log/nginx /var/cache/nginx/ipfs /var/cache/nginx/routing && \
    chown -R www-data:www-data /run/nginx /var/log/nginx /var/cache/nginx

# Install nostr-pinner Python dependencies
COPY nostr-pinner/requirements.txt /tmp/nostr-requirements.txt
RUN pip3 install --no-cache-dir --break-system-packages -r /tmp/nostr-requirements.txt && \
    rm /tmp/nostr-requirements.txt

# Copy nostr-pinner script(s)
COPY nostr-pinner/nostr_pinner.py /usr/local/bin/nostr_pinner.py
COPY nostr-pinner/instant_pin_cache.py /usr/local/bin/instant_pin_cache.py
RUN chmod 644 /usr/local/bin/nostr_pinner.py /usr/local/bin/instant_pin_cache.py

# Copy Go sidecar binary (issue #17: IPNS routing-get + DHT refresh)
COPY --from=go-builder /go-sidecar /usr/local/bin/go-sidecar
RUN chmod 755 /usr/local/bin/go-sidecar

# Copy configuration files
COPY config/supervisord.conf /etc/supervisord.conf
COPY config/nginx.conf.template /etc/nginx/nginx.conf.template
COPY scripts/ /usr/local/bin/
RUN chmod 755 /usr/local/bin/*.sh

# Volumes — declared for documentation; explicit -v mounts are always used
# Do NOT use VOLUME ["/data/ipfs"] — it creates anonymous volumes that silently
# mask mount failures, risking data loss of 690GB+ of pinned IPFS content.
VOLUME ["/etc/letsencrypt"]

# Ports
# 4001 - IPFS Swarm (TCP/UDP)
# 4002 - WebSocket (internal, proxied by nginx)
# 4003 - WSS (TLS-terminated by nginx)
# 5001 - IPFS API (internal)
# 8080 - IPFS Gateway (internal)
# 443  - HTTPS Gateway (via nginx)
# 9080 - HTTP Gateway (exposed)
# Port 80 is already EXPOSE'd by ssl-manager base image
EXPOSE 4001/tcp 4001/udp 4003 443 9080

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=120s --retries=3 \
    CMD /usr/local/bin/healthcheck.sh

# Environment variables
ENV DOMAIN=localhost \
    IPFS_PROFILE=server \
    IPFS_LOGGING=info \
    # Nostr pinner configuration (Unicity relays)
    NOSTR_RELAYS="wss://nostr-relay.testnet.unicity.network,ws://unicity-nostr-relay-20250927-alb-1919039002.me-central-1.elb.amazonaws.com:8080" \
    IPFS_API_URL="http://127.0.0.1:5001" \
    PIN_KIND="30078" \
    LOG_LEVEL="INFO" \
    RECONNECT_DELAY="10" \
    PIN_TIMEOUT="300" \
    # Propagation sidecar configuration
    MAX_PINS_PER_SECOND="100" \
    HTTP_PORT="9081" \
    DB_PATH="/data/ipfs/propagation.db" \
    NODE_NAME="ipfs-node" \
    NOSTR_PRIVATE_KEY="" \
    ANNOUNCE_INTERVAL="0" \
    ANNOUNCE_PROBABILITY="0.000277778" \
    # Instant-pin write-through cache (issue #6)
    SIDECAR_CACHE_ENABLED="true" \
    SIDECAR_CACHE_DIR="/data/ipfs/sidecar-cache" \
    SIDECAR_CACHE_MAX_BYTES="1073741824" \
    SIDECAR_CACHE_MAX_ENTRIES="10000" \
    SIDECAR_CACHE_MAX_BLOB_BYTES="33554432" \
    SIDECAR_CACHE_RECONCILE_INTERVAL="5" \
    SIDECAR_CACHE_PROMOTION_TIMEOUT="86400" \
    SIDECAR_CACHE_KUBO_TIMEOUT="30" \
    # Go sidecar configuration (issue #17: IPNS routing-get + DHT refresh)
    GO_SIDECAR_PORT="9082" \
    REFRESH_INTERVAL_SECONDS="10" \
    REFRESH_BATCH_SIZE="50" \
    MAX_REFRESH_CONCURRENCY="10" \
    PYTHON_SIDECAR_URL="http://127.0.0.1:9081"

ENTRYPOINT ["tini", "--", "/usr/local/bin/entrypoint.sh"]