harder-hub Docker Images

Custom Docker images built and pushed by Woodpecker CI to registry.docker.home/harder-hub/.

Workflows live under .woodpecker/:

File	Images
hub.yml	jellyfin, nextcloud, paperless, codeserver, code-resolver, superset
php-apache.yml	php-apache-{trixie,noble}
php-fpm.yml	php-fpm-{trixie,noble}
php-nginx.yml	php-nginx-{trixie,noble}
dle.yml	dle-{apache,nginx,fpm} (runs after php-* workflows)

Images (matrix)

Image	Base	Build file
jellyfin	jellyfin/jellyfin:latest	images/Jellyfin.build
nextcloud	nextcloud:latest	images/Nextcloud.build
paperless	ghcr.io/paperless-ngx/paperless-ngx:latest	images/Paperless.build
paperless-smart-gateway	python:3.13-slim-trixie	images/Paperless.SmartGateway.build
codeserver	ghcr.io/coder/code-server:latest	images/Codeserver.build
code-resolver	python:3.13-slim-trixie	images/CodeResolver.build
superset	apache/superset:${DEPLOY_SUPERSET_TAG} (lean)	images/Superset.build
php-apache-trixie	php:8.x-apache-trixie	images/PhpApache.build
php-apache-noble	shivammathur/node:php-8.x-noble	images/PhpApache.build
php-fpm-trixie	php:8.x-fpm-trixie	images/PhpApache.build
php-fpm-noble	shivammathur/node:php-8.x-noble	images/PhpApache.build
php-nginx-trixie	php:8.x-fpm-trixie + nginx	images/PhpApache.build
php-nginx-noble	shivammathur/node:php-8.x-noble + nginx	images/PhpApache.build
dle-apache	php-apache-trixie:8.3 + assets/dle/*.zip	images/Dle.build
dle-nginx	php-nginx-trixie:8.3 + pack	images/Dle.build
dle-fpm	php-fpm-trixie:8.3 + pack	images/Dle.build

CI runs on main for cron, manual, and push events.

If the resolved upstream patch version tag already exists in the registry, CI skips build/push for that matrix cell (FORCE_REBUILD=1 to force).

Registry auth uses Woodpecker secrets (no host docker login mount):

Secret	Used as
HOMEHUB_USERNAME	REGISTRY_USER
HOMEHUB_PASSWORD	REGISTRY_PASS
DEPLOY_SUPERSET_TAG	Superset upstream/build tag (fallback 6.1.0)

The build step logs in with docker login registry.docker.home before push/prune. DOCKER_CONFIG=/tmp/docker-config stays writable for buildx.

Non-PHP builds are tagged <name>:<version> and <name>:latest. CI keeps the 5 newest patch tags (latest is never deleted). Compose stacks should keep using :latest except Superset, which pins TAG to the same version as the Hub image.

DNS for registry.docker.home on the homeserver goes through Tailscale MagicDNS (100.100.100.100). That resolver is not available inside Woodpecker step containers, which caused intermittent lookup registry.docker.home: no such host.

Fix on the agent host: pin the name in /etc/hosts (Tailscale does not overwrite that file’s extra lines — only regenerates resolv.conf). The pipeline mounts that hosts file:

# on the Woodpecker agent — once
getent hosts registry.docker.home
# then add the IPv4 you see, e.g.:
echo '192.168.178.6 registry.docker.home' | sudo tee -a /etc/hosts
getent hosts registry.docker.home

Pushes also retry up to 5 times on transient errors.

Local build

Build context is the repo root (.):

docker build -f images/Codeserver.build -t codeserver:local .
docker build -f images/CodeResolver.build -t code-resolver:local .
# Superset requires an explicit tag (no Dockerfile default):
docker build --build-arg SUPERSET_TAG=6.1.0 -f images/Superset.build -t harder-hub/superset:6.1.0 .
# PHP (SAPI × OS):
docker build -f images/PhpApache.build \
  --build-arg PHP_VERSION=8.3 --build-arg OS=trixie --build-arg SAPI=apache \
  --build-arg BASE_IMAGE=php:8.3-apache-trixie \
  -t harder-hub/php-apache-trixie:8.3 .
docker build -f images/PhpApache.build \
  --build-arg PHP_VERSION=8.3 --build-arg OS=noble --build-arg SAPI=nginx \
  --build-arg BASE_IMAGE=shivammathur/node:php-8.3-noble \
  -t harder-hub/php-nginx-noble:8.3 .
# DLE (after php-* base exists):
docker build -f images/Dle.build \
  --build-arg PHP_VERSION=8.3 --build-arg OS=trixie --build-arg SAPI=apache \
  --build-arg BASE_IMAGE=registry.docker.home/harder-hub/php-apache-trixie:8.3 \
  --build-arg DLE_ZIP=dle20_0.zip \
  -t harder-hub/dle-apache:20.0.109 .

DLE images (dle-{apache,nginx,fpm})

DataLife Engine web image only (MariaDB is a compose service). Pack is assets/dle/*.zip (no unpacked trees in git). Default PHP 8.3; override with PHP_VERSION. CI workflow dle depends_on php-apache, php-fpm, and php-nginx so bases exist before pull.

Tag	Meaning
20.0.109	VERSIONID.BUILDID from pack init.php (skip-if-exists)
20.0	floating minor
latest	retagged each build

Init is a oneshot of the same image: entrypoint: ["/usr/local/bin/dle-init"] unpacks the zip into /var/www/html, runs schema/admin via install.php actions, writes .dle-installed.

Sample stack: assets/dle-compose/ (DLE_SAPI=apache by default; set nginx / fpm to switch image). Copy .env.example → .env, then docker compose up -d.

Env	Default
DLE_LANGUAGE	Russian
DLE_ADMIN_USER / DLE_ADMIN_PASS / DLE_ADMIN_EMAIL	admin / admin / admin@localhost
DLE_DB_HOST / NAME / USER / PASS / PREFIX	db / dle / dle / dle / dle
DLE_DB_PORT	3306

Web still needs SERVER_NAME for apache/nginx SAPIs.

PHP images (php-{apache,fpm,nginx}-{trixie,noble})

Naming: harder-hub/php-{apache|nginx|fpm}-{trixie|noble}:{patch|minor|latest}

Tag	Meaning
8.3.33	PHP patch (skip-if-exists / authoritative)
8.3	floating minor (updated each build of that minor)
latest	tip of 8.5 for that SAPI+OS only

SAPI	Ports	SERVER_NAME
apache	80	required
fpm	9000	not used
nginx	80 (FPM on localhost:9000)	required

Runtime env:

Variable	Default	Notes
SERVER_NAME	—	Required for apache and nginx
UPLOAD_MAX_FILESIZE	2G
POST_MAX_SIZE	2G
MAX_INPUT_TIME	-1
MAX_EXECUTION_TIME	600
XDEBUG_MODE	develop,coverage,debug	без profile: он сильно тормозит шаг отладки
XDEBUG_DISCOVER_CLIENT_HOST	no	иначе контейнер берёт адрес клиента из запроса и XDEBUG_CLIENT_HOST не используется
XDEBUG_START_WITH_REQUEST	yes	отладка с первого запроса, как в статье про PhpStorm
XDEBUG_CLIENT_HOST	host.docker.internal	машина, где слушает PhpStorm. На Linux нужен extra_hosts ниже, либо свой IP: hostname -I
XDEBUG_CLIENT_PORT	9003	порт Xdebug 3 и PhpStorm по умолчанию
XDEBUG_IDEKEY	PHPSTORM	тот же ключ в PhpStorm: PHP Remote Debug → IDE key
XDEBUG_TRIGGER_VALUE	PHPSTORM
XDEBUG_LOG	/dev/stdout
XDEBUG_LOG_LEVEL	0

Build-time (optional):

Variable / build-arg	Default	Meaning
EXTRA_APT_PACKAGES	(empty)	Extra apt packages
EXTRA_PHP_EXTENSIONS	(empty)	Extra PHP extensions (docker-php-ext-install / php{V}-*)

CI pushes to registry.docker.home/harder-hub/…; public DNS may be docker-hub.hrdr.dev / docker-regestry.hrdr.dev.

name: DLE 20.0
services:
  web:
    image: docker-hub.hrdr.dev/harder-hub/php-apache-noble:8.3
    # or pin patch: .../php-apache-noble:8.3.33
    container_name: dle20_web
    volumes:
      - ./:/var/www/html
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      SERVER_NAME: dle200.test
      UPLOAD_MAX_FILESIZE: 2G
      POST_MAX_SIZE: 2G
      XDEBUG_CLIENT_HOST: host.docker.internal
      XDEBUG_CLIENT_PORT: "9003"
      XDEBUG_IDEKEY: PHPSTORM
    networks:
      - phpmaster
    ports:
      - "8200:80"
networks:
  phpmaster:
    external: true
    name: phpmaster

Nginx variant: same compose with php-nginx-noble:8.3 and required SERVER_NAME.
FPM-only: php-fpm-noble:8.3, port 9000, no SERVER_NAME.

Secrets

Do not commit secrets. These paths are gitignored and excluded from the Docker build context:

• assets/forgejo/.env — copy from assets/forgejo/.env.example and fill in locally
• assets/superset/.env — copy from assets/superset/.env.example
• **/password.txt, **/passwords.txt — runtime mounts (e.g. Smart Gateway reads password.txt at runtime, not baked into the image)

None of the current image builds require .env at build time.

---

Superset auf dem Homeserver

Image: registry.docker.home/harder-hub/superset (lean apache/superset + psycopg2-binary + Env-Bridge-Config). Konfiguration nur über Environment — kein Config-Mount nötig.

Voraussetzungen

• Image liegt im Hub (Woodpecker mit Secret DEPLOY_SUPERSET_TAG, z. B. 6.1.0)
• registry.docker.home auf dem Homeserver auflösbar (/etc/hosts oder DNS)
• Registry-Login auf dem Host (docker login registry.docker.home)

1. Verzeichnis anlegen

mkdir -p ~/apps/superset
cd ~/apps/superset
# Aus dem DockerImages-Repo (Pfad anpassen):
cp /path/to/DockerImages/assets/superset/docker-compose-image-tag.yml .
cp /path/to/DockerImages/assets/superset/.env.example .env

2. .env ausfüllen

Variable	Pflicht	Bedeutung
TAG	nein (Default 6.1.0 in Compose)	Image-Tag = Hub-Version / DEPLOY_SUPERSET_TAG
SUPERSET_SECRET_KEY	ja	Langer Zufallswert (Session/Crypto)
DATABASE_DIALECT	ja	z. B. postgresql
DATABASE_HOST	ja	In Compose: superset-db (nicht db — Kollision auf shared nets)
DATABASE_PORT	ja	5432
DATABASE_DB / USER / PASSWORD	ja	Metadata-DB
POSTGRES_DB / USER / PASSWORD	ja	Gleich wie DATABASE_* (Postgres-Container)
REDIS_HOST / REDIS_PORT	ja	In Compose: redis / 6379
ADMIN_USERNAME / PASSWORD / EMAIL	ja	Erster Admin (superset-init)
SUPERSET_LOAD_EXAMPLES	nein	yes / no (Default no)
SUPERSET_PORT	nein	Host-Port (Default 8088)

Optional: SUPERSET__SQLALCHEMY_DATABASE_URI statt einzelner DATABASE_*. Kommentare stehen in .env.example.

.env nicht committen.

3. Tag setzen

Gleicher Stand wie im Hub / Woodpecker-Secret:

# in .env:
TAG=6.1.0
# oder:
export TAG=6.1.0

4. Starten

cd ~/apps/superset
docker compose -f docker-compose-image-tag.yml pull
docker compose -f docker-compose-image-tag.yml up -d

Services: superset-db, redis, superset-init (einmalig Migration + Admin), superset (Web), superset-worker, superset-worker-beat.

5. Prüfen

docker compose -f docker-compose-image-tag.yml ps
docker compose -f docker-compose-image-tag.yml logs -f superset-init

UI: http://homeserver:8088 (oder Reverse-Proxy). Login mit ADMIN_*.

6. Update

1. Woodpecker-Secret DEPLOY_SUPERSET_TAG auf neue Version setzen (z. B. 6.2.0)
2. Pipeline laufen lassen → Hub hat harder-hub/superset:6.2.0 (+ :latest)
3. Auf dem Homeserver TAG=6.2.0 in .env → pull && up -d

Rollen (gleiches Image)

Service	Command
Web	/app/docker/docker-bootstrap.sh app-gunicorn
Worker	/app/docker/docker-bootstrap.sh worker
Beat	/app/docker/docker-bootstrap.sh beat
Init	/app/docker/docker-init.sh