GnosysLabs/Synapsis
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Add GitHub Container Registry (GHCR) support with automated builds

Browse Source 
- Add GitHub Actions workflow to build and push Docker images to GHCR
- Create root-level docker-compose.yml using pre-built ghcr.io/cyph3rasi/synapsis:latest image
- Update docker/README.md with new simplified installation instructions
- Update main README.md with quick start Docker instructions
- Users can now deploy without cloning: just download compose file + Caddyfile + .env
- Supports automatic tagging: latest, semver, sha, branch names
- Multi-platform builds: linux/amd64, linux/arm64
- Includes SBOM generation for security tracking
This commit is contained in:
Christomatt
2026-01-31 04:11:14 +01:00
parent df5b61f42a
commit 2a9c91d623
5 changed files with 396 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+38 -13
View File
@@ -1,29 +1,54 @@
# =========================================== # ===========================================
# Synapsis Environment Configuration # Synapsis Docker Environment Configuration
# =========================================== # ===========================================
# Copy this file to .env and fill in your values # Copy this file to .env and configure your values
# Database (Required) # ===========================================
DATABASE_URL=postgresql://user:password@localhost/synapsis # Required Settings
# ===========================================
# Authentication (Required) # Domain Configuration
# Replace with your actual domain
DOMAIN=your-domain.com
# Database Credentials
# Change these to secure values!
DB_USER=synapsis
DB_PASSWORD=your-secure-password-here
DB_NAME=synapsis
# Authentication Secret
# Generate with: openssl rand -hex 32 # Generate with: openssl rand -hex 32
AUTH_SECRET=your-secret-key-here AUTH_SECRET=your-secret-key-here-minimum-32-characters
# Node Configuration (Required) # Admin Users
NEXT_PUBLIC_NODE_DOMAIN=your-domain.com # Comma-separated list of email addresses with admin access
ADMIN_EMAILS=admin@your-domain.com
# Admin Users (Required) # ===========================================
# Comma-separated list of email addresses that have admin access # S3-Compatible Storage (Required for uploads)
ADMIN_EMAILS=admin@example.com # ===========================================
# You can use AWS S3, MinIO, Wasabi, Backblaze B2, etc.
# S3-Compatible Storage (Required for media uploads)
STORAGE_ENDPOINT=https://s3.your-provider.com STORAGE_ENDPOINT=https://s3.your-provider.com
STORAGE_REGION=us-east-1 STORAGE_REGION=us-east-1
STORAGE_BUCKET=synapsis STORAGE_BUCKET=synapsis-uploads
STORAGE_ACCESS_KEY=your-access-key STORAGE_ACCESS_KEY=your-access-key
STORAGE_SECRET_KEY=your-secret-key STORAGE_SECRET_KEY=your-secret-key
STORAGE_PUBLIC_BASE_URL=https://cdn.your-domain.com STORAGE_PUBLIC_BASE_URL=https://cdn.your-domain.com
# ===========================================
# Optional Settings # Optional Settings
# ===========================================
# Maximum bots per user (default: 5)
# BOT_MAX_PER_USER=5 # BOT_MAX_PER_USER=5
# Redis configuration (if using external Redis)
# REDIS_URL=redis://redis:6379
# ===========================================
# Docker Compose Settings
# ===========================================
# COMPOSE_PROJECT_NAME=synapsis
.github/workflows/docker.yml
+79
View File
@@ -0,0 +1,79 @@
name: Build and Push Docker Image to GHCR
on:
push:
branches:
- main
tags:
- 'v*'
pull_request:
branches:
- main
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
build-and-push:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
id-token: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Log in to Container Registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract metadata
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=ref,event=branch
type=ref,event=pr
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
type=sha,prefix=,suffix=,format=short
# Always tag main branch as latest
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
- name: Build and push Docker image
uses: docker/build-push-action@v5
with:
context: .
file: ./docker/Dockerfile
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
platforms: linux/amd64,linux/arm64
- name: Generate SBOM
uses: anchore/sbom-action@v0
with:
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
format: spdx-json
output-file: sbom.spdx.json
if: github.ref == 'refs/heads/main'
- name: Upload SBOM as artifact
uses: actions/upload-artifact@v4
with:
name: sbom
path: sbom.spdx.json
if: github.ref == 'refs/heads/main'
README.md
+32 -2
View File
@@ -109,9 +109,39 @@ Synapsis operates on the **Swarm** — a native peer-to-peer network designed sp
--- ---
## Run Your Own Node ## 🚀 Run Your Own Node
For complete setup instructions, visit the official documentation: ### Quick Start (Docker - Recommended)
Deploy your own Synapsis node in minutes using Docker:
```bash
# 1. Create directory and download files
mkdir -p /opt/synapsis && cd /opt/synapsis
curl -O https://raw.githubusercontent.com/cyph3rasi/synapsis/main/docker-compose.yml
curl -O https://raw.githubusercontent.com/cyph3rasi/synapsis/main/docker/Caddyfile
curl -O https://raw.githubusercontent.com/cyph3rasi/synapsis/main/.env.example
# 2. Configure environment
cp .env.example .env
# Edit .env with your domain, database password, auth secret, etc.
# 3. Start your node
docker compose up -d
```
Your node will be available at `https://your-domain.com` with automatic SSL.
**Updating:**
```bash
docker compose pull && docker compose up -d
```
For detailed instructions, see [docker/README.md](docker/README.md).
### Documentation
For complete setup instructions, visit:
**📚 [docs.synapsis.social/run-your-own-node](https://docs.synapsis.social/run-your-own-node)** **📚 [docs.synapsis.social/run-your-own-node](https://docs.synapsis.social/run-your-own-node)**
docker-compose.yml
+139
View File
@@ -0,0 +1,139 @@
# Synapsis - Docker Compose (Production)
# Uses pre-built image from GitHub Container Registry
#
# Quick Start:
# 1. Download this file, Caddyfile, and .env.example
# 2. Copy .env.example to .env and fill in your values
# 3. Run: docker compose up -d
#
# Services:
# - Synapsis Next.js application (from GHCR)
# - PostgreSQL database (persistent storage)
# - Caddy reverse proxy with automatic SSL
version: "3.8"
services:
# ============================================
# PostgreSQL Database
# ============================================
postgres:
image: postgres:16-alpine
container_name: synapsis-db
restart: unless-stopped
environment:
POSTGRES_USER: ${DB_USER:-synapsis}
POSTGRES_PASSWORD: ${DB_PASSWORD:-changeme}
POSTGRES_DB: ${DB_NAME:-synapsis}
PGDATA: /var/lib/postgresql/data/pgdata
volumes:
- postgres_data:/var/lib/postgresql/data
networks:
- synapsis-network
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-synapsis} -d ${DB_NAME:-synapsis}"]
interval: 10s
timeout: 5s
retries: 5
deploy:
resources:
limits:
memory: 1G
reservations:
memory: 256M
# ============================================
# Synapsis Application (from GHCR)
# ============================================
app:
image: ghcr.io/cyph3rasi/synapsis:latest
container_name: synapsis-app
restart: unless-stopped
environment:
# Database connection
DATABASE_URL: postgresql://${DB_USER:-synapsis}:${DB_PASSWORD:-changeme}@postgres:5432/${DB_NAME:-synapsis}
# Authentication
AUTH_SECRET: ${AUTH_SECRET}
# Domain configuration
NEXT_PUBLIC_NODE_DOMAIN: ${DOMAIN:-localhost}
# Admin emails
ADMIN_EMAILS: ${ADMIN_EMAILS}
# S3 Storage configuration
STORAGE_ENDPOINT: ${STORAGE_ENDPOINT}
STORAGE_REGION: ${STORAGE_REGION:-us-east-1}
STORAGE_BUCKET: ${STORAGE_BUCKET}
STORAGE_ACCESS_KEY: ${STORAGE_ACCESS_KEY}
STORAGE_SECRET_KEY: ${STORAGE_SECRET_KEY}
STORAGE_PUBLIC_BASE_URL: ${STORAGE_PUBLIC_BASE_URL}
# Optional settings
BOT_MAX_PER_USER: ${BOT_MAX_PER_USER:-5}
# Node environment
NODE_ENV: production
volumes:
# Uploads directory (if using local file storage)
- uploads_data:/app/uploads
networks:
- synapsis-network
depends_on:
postgres:
condition: service_healthy
healthcheck:
test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000/api/health"]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s
deploy:
resources:
limits:
memory: 1G
reservations:
memory: 256M
# ============================================
# Caddy Reverse Proxy (Automatic SSL)
# ============================================
caddy:
image: caddy:2-alpine
container_name: synapsis-caddy
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile:ro
- caddy_data:/data
- caddy_config:/config
networks:
- synapsis-network
depends_on:
app:
condition: service_healthy
environment:
- DOMAIN=${DOMAIN:-localhost}
# ============================================
# Persistent Volumes
# ============================================
volumes:
postgres_data:
driver: local
uploads_data:
driver: local
caddy_data:
driver: local
caddy_config:
driver: local
# ============================================
# Networks
# ============================================
networks:
synapsis-network:
driver: bridge
docker/README.md
+108 -106
View File
@@ -1,24 +1,31 @@
# Synapsis Docker Production Deployment # Synapsis Docker Production Deployment
One-command Docker deployment for Synapsis that solves the "user modifies file and breaks git sync" problem. One-command Docker deployment for Synapsis using pre-built images from GitHub Container Registry.
## 🚀 Quick Start ## 🚀 Quick Start
```bash ```bash
cd /var/www/Synapsis/docker # 1. Create a directory for your Synapsis instance
mkdir -p /opt/synapsis
cd /opt/synapsis
# 1. Copy and edit environment variables # 2. Download the required files
curl -O https://raw.githubusercontent.com/cyph3rasi/synapsis/main/docker-compose.yml
curl -O https://raw.githubusercontent.com/cyph3rasi/synapsis/main/docker/Caddyfile
curl -O https://raw.githubusercontent.com/cyph3rasi/synapsis/main/docker/.env.example
# 3. Set up environment variables
cp .env.example .env cp .env.example .env
nano .env # Edit all required values nano .env # Edit all required values
# 2. Start the stack # 4. Start the stack
docker-compose up -d docker compose up -d
# 3. Check logs # 5. Check logs
docker-compose logs -f docker compose logs -f
``` ```
Your Synapsis instance will be available at `http://localhost` (or your configured domain). Your Synapsis instance will be available at `https://your-domain.com` (Caddy automatically handles SSL).
--- ---
@@ -44,7 +51,7 @@ newgrp docker
# Verify # Verify
docker --version docker --version
docker-compose --version docker compose version
``` ```
--- ---
@@ -56,8 +63,8 @@ docker-compose --version
Copy `.env.example` to `.env` and configure: Copy `.env.example` to `.env` and configure:
```bash ```bash
cd /var/www/Synapsis/docker
cp .env.example .env cp .env.example .env
nano .env
``` ```
**Required settings:** **Required settings:**
@@ -67,66 +74,36 @@ cp .env.example .env
- `ADMIN_EMAILS` - Admin user email(s) - `ADMIN_EMAILS` - Admin user email(s)
- `STORAGE_*` - S3-compatible storage credentials - `STORAGE_*` - S3-compatible storage credentials
### 2. SSL/HTTPS Setup ### 2. DNS Setup
#### Option A: Let's Encrypt (Recommended) Point your domain's A record to your server's IP address:
```
1. Start with HTTP first: A synapsis.example.com → YOUR_SERVER_IP
```bash
docker-compose up -d
``` ```
2. Obtain SSL certificates: Caddy will automatically obtain and renew SSL certificates via Let's Encrypt.
```bash
docker run -it --rm \
-v ./certbot_data:/etc/letsencrypt \
-v ./certbot_www:/var/www/certbot \
-p 80:80 \
certbot/certbot certonly \
--standalone \
-d your-domain.com
```
3. Enable SSL configuration:
```bash
cd nginx/conf.d
mv default.conf default.conf.http
mv default.conf.ssl default.conf
# Edit default.conf and replace ${DOMAIN} with your actual domain
docker-compose restart nginx
```
4. Uncomment the certbot service in docker-compose.yml for auto-renewal.
#### Option B: Custom SSL Certificates
Place your certificates in `./certbot_data/live/your-domain.com/`:
- `fullchain.pem`
- `privkey.pem`
--- ---
## 🔄 Updates ## 🔄 Updates
### Standard Update Process Updating is now simple - just pull the latest image:
```bash ```bash
cd /var/www/Synapsis/docker cd /opt/synapsis
# 1. Pull latest changes # Pull the latest image
git pull origin main docker compose pull
# 2. Rebuild and restart # Restart with new image
docker-compose down docker compose up -d
docker-compose pull # If using pre-built images
docker-compose up -d --build
# 3. Run migrations (if needed) # Run migrations if needed
docker-compose exec app npx drizzle-kit push docker compose exec app npx drizzle-kit push
# 4. Verify # Verify
docker-compose ps docker compose ps
docker-compose logs -f app docker compose logs -f app
``` ```
### One-Command Update Script ### One-Command Update Script
@@ -134,79 +111,78 @@ docker-compose logs -f app
Create `update.sh`: Create `update.sh`:
```bash ```bash
#!/bin/bash #!/bin/bash
cd /var/www/Synapsis/docker cd /opt/synapsis
git pull origin main docker compose pull
docker-compose down docker compose up -d
docker-compose up -d --build docker compose exec -T app npx drizzle-kit push || true
docker-compose exec -T app npx drizzle-kit push || true
echo "✅ Update complete!" echo "✅ Update complete!"
``` ```
Make it executable and run:
```bash
chmod +x update.sh
./update.sh
```
--- ---
## 📁 Directory Structure ## 📁 Directory Structure
``` ```
/var/www/Synapsis/docker/ /opt/synapsis/
├── docker-compose.yml # Main orchestration file ├── docker-compose.yml # Main orchestration file (downloaded from GitHub)
├── Dockerfile # Multi-stage build ├── Caddyfile # Caddy reverse proxy config
├── docker-entrypoint.sh # Startup script
├── .env # Your environment variables ├── .env # Your environment variables
├── .env.example # Template └── update.sh # Optional update script
├── .dockerignore # Build exclusions
├── nginx/
│ ├── nginx.conf # Main Nginx config
│ └── conf.d/
│ ├── default.conf # HTTP config
│ └── default.conf.ssl # HTTPS config
└── README.md # This file
``` ```
**Note:** You no longer need to clone the entire Git repository. Just download the three files above.
--- ---
## 🛠️ Management Commands ## 🛠️ Management Commands
### View Logs ### View Logs
```bash ```bash
docker-compose logs -f app # Application logs docker compose logs -f app # Application logs
docker-compose logs -f nginx # Nginx logs docker compose logs -f caddy # Caddy logs
docker-compose logs -f postgres # Database logs docker compose logs -f postgres # Database logs
docker-compose logs -f # All logs docker compose logs -f # All logs
``` ```
### Database Operations ### Database Operations
```bash ```bash
# Access database shell # Access database shell
docker-compose exec postgres psql -U synapsis -d synapsis docker compose exec postgres psql -U synapsis -d synapsis
# Backup database # Backup database
docker-compose exec postgres pg_dump -U synapsis synapsis > backup.sql docker compose exec postgres pg_dump -U synapsis synapsis > backup.sql
# Restore database # Restore database
docker-compose exec -T postgres psql -U synapsis -d synapsis < backup.sql docker compose exec -T postgres psql -U synapsis -d synapsis < backup.sql
# Run migrations manually # Run migrations manually
docker-compose exec app npx drizzle-kit push docker compose exec app npx drizzle-kit push
``` ```
### Container Management ### Container Management
```bash ```bash
# Restart services # Restart services
docker-compose restart app docker compose restart app
docker-compose restart nginx docker compose restart caddy
# Stop everything # Stop everything
docker-compose down docker compose down
# Stop and remove volumes (⚠️ destroys data!) # Stop and remove volumes (⚠️ destroys data!)
docker-compose down -v docker compose down -v
# View running containers # View running containers
docker-compose ps docker compose ps
# Enter container shell # Enter container shell
docker-compose exec app sh docker compose exec app sh
docker-compose exec postgres sh docker compose exec postgres sh
``` ```
--- ---
@@ -215,10 +191,10 @@ docker-compose exec postgres sh
This Docker setup includes: This Docker setup includes:
- **Immutable source code** - Application runs from image, not bind-mounted files - **Immutable source code** - Application runs from pre-built image
- **Non-root execution** - App runs as unprivileged user - **Non-root execution** - App runs as unprivileged user
- **Network isolation** - Services communicate via internal Docker network - **Network isolation** - Services communicate via internal Docker network
- **Rate limiting** - Nginx protects against brute force attacks - **Automatic HTTPS** - Caddy handles SSL certificates
- **Security headers** - X-Frame-Options, X-Content-Type-Options, etc. - **Security headers** - X-Frame-Options, X-Content-Type-Options, etc.
- **Resource limits** - Memory constraints on all containers - **Resource limits** - Memory constraints on all containers
- **Health checks** - Automatic container health monitoring - **Health checks** - Automatic container health monitoring
@@ -230,28 +206,28 @@ This Docker setup includes:
### Container won't start ### Container won't start
```bash ```bash
# Check for configuration errors # Check for configuration errors
docker-compose config docker compose config
# View detailed logs # View detailed logs
docker-compose logs app --tail=100 docker compose logs app --tail=100
``` ```
### Database connection failed ### Database connection failed
```bash ```bash
# Check database is healthy # Check database is healthy
docker-compose ps docker compose ps
# Verify environment variables # Verify environment variables
docker-compose exec app env | grep DATABASE docker compose exec app env | grep DATABASE
``` ```
### SSL certificate issues ### SSL certificate issues
```bash ```bash
# Test SSL configuration # Check Caddy logs
docker-compose exec nginx nginx -t docker compose logs caddy
# Check certificate files # Test Caddy configuration
ls -la certbot_data/live/ docker compose exec caddy caddy validate --config /etc/caddy/Caddyfile
``` ```
### Port already in use ### Port already in use
@@ -262,13 +238,22 @@ sudo netstat -tlnp | grep :80
# Change ports in docker-compose.yml if needed # Change ports in docker-compose.yml if needed
``` ```
### Image pull fails
```bash
# Check if image exists
docker pull ghcr.io/cyph3rasi/synapsis:latest
# View available tags at:
# https://github.com/cyph3rasi/synapsis/pkgs/container/synapsis
```
--- ---
## 📊 Monitoring ## 📊 Monitoring
### Health Checks ### Health Checks
- App: `http://your-domain/api/health` - App: `https://your-domain.com/api/health`
- Nginx: `http://your-domain/nginx-health` - Caddy: Built into the Caddyfile
### Resource Usage ### Resource Usage
```bash ```bash
@@ -285,7 +270,7 @@ docker system df
### Automated Backup Script ### Automated Backup Script
Create `/var/www/Synapsis/docker/backup.sh`: Create `/opt/synapsis/backup.sh`:
```bash ```bash
#!/bin/bash #!/bin/bash
BACKUP_DIR="/var/backups/synapsis" BACKUP_DIR="/var/backups/synapsis"
@@ -293,7 +278,7 @@ DATE=$(date +%Y%m%d_%H%M%S)
mkdir -p $BACKUP_DIR mkdir -p $BACKUP_DIR
# Database backup # Database backup
docker-compose exec -T postgres pg_dump -U synapsis synapsis > "$BACKUP_DIR/db_$DATE.sql" docker compose exec -T postgres pg_dump -U synapsis synapsis > "$BACKUP_DIR/db_$DATE.sql"
# Uploads backup # Uploads backup
tar -czf "$BACKUP_DIR/uploads_$DATE.tar.gz" -C /var/lib/docker/volumes/synapsis_uploads_data/_data . tar -czf "$BACKUP_DIR/uploads_$DATE.tar.gz" -C /var/lib/docker/volumes/synapsis_uploads_data/_data .
@@ -306,17 +291,34 @@ echo "✅ Backup complete: $DATE"
Add to crontab: Add to crontab:
```bash ```bash
0 2 * * * /var/www/Synapsis/docker/backup.sh >> /var/log/synapsis-backup.log 2>&1 0 2 * * * /opt/synapsis/backup.sh >> /var/log/synapsis-backup.log 2>&1
``` ```
--- ---
## 🏗️ Building from Source (Advanced)
If you prefer to build the image locally instead of using the pre-built one:
```bash
# Clone the repository
git clone https://github.com/cyph3rasi/synapsis.git
cd synapsis/docker
# Build and run
docker compose -f docker-compose.build.yml up -d --build
```
See `docker-compose.yml` in the docker/ directory for the build configuration.
---
## 📞 Support ## 📞 Support
For issues or questions: For issues or questions:
1. Check logs: `docker-compose logs -f` 1. Check logs: `docker compose logs -f`
2. Review configuration: `docker-compose config` 2. Review configuration: `docker compose config`
3. Consult the main Synapsis documentation 3. Consult the main Synapsis documentation: https://docs.synapsis.social
--- ---