fix(compose): certs dir writable by livereload

- readonly mapping would prevent cert auto-generation

.env

@@ -0,0 +1,119 @@
+#
+# Parameters for node-livereload-tls stack:
+#   This file makes it easier to customize your node-livereload-tls stack deployment by providing centralized configuration options.
+#   This file is *not required* since all values have (sane) default settings.
+#   There is *no* sensitive information in this file.
+
+
+#
+# COMMON PARAMETERS
+
+# TZ:
+# Timezone used in logs and console messages. No effect on operation, purely aesthetic.
+# REQUIRED: NO
+# DEFAULT: Etc/UTC
+# VALID OPTIONS: Any valid IANA TZ formatted timezone. Refer to https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.
+TZ=Etc/UTC
+
+# GID:
+# You may wish to change the GroupID of the container's user. This allows it access certain resources on the host like certificates or files.
+# REQUIRED: NO
+# DEFAULT:
+# VALID OPTIONS: Any valid UID/GID
+#GID=
+
+# WATCHDIR:
+# Directory containing files you want to monitor for changes and trigger a browser reload.
+# REQUIRED: NO
+# DEFAULT:
+# VALID OPTIONS: Any valid directory on the host
+WATCHDIR=~/myWebProject
+
+
+#
+# AB-NGINX parameters
+#    refer to https://git.asifbacchus.dev/ab-docker/ab-nginx/wiki for more details
+
+# NGINX_HTTP:
+# Port to map on the host for ab-nginx to listen for HTTP connections.
+# REQUIRED: NO
+# DEFAULT: 80
+# VALID OPTIONS: Any valid TCP port that does not cause conflicts in your environment
+#NGINX_HTTP=80
+
+# NGINX_HTTPS:
+# Port to map on the host for ab-nginx to listen for HTTPS connections.
+# REQUIRED: NO
+# DEFAULT: 443
+# VALID OPTIONS: Any valid TCP port that does not cause conflicts in your environment
+#NGINX_HTTPS=443
+
+# SERVER_NAMES:
+# Space-delimited list of names to which the server should respond. This needs to match any certificates being used.
+# REQUIRED: NO
+# DEFAULT: _
+# VALID OPTIONS: Any valid hostnames for your environment
+SERVER_NAMES=_
+
+# TLS13_ONLY:
+# Use and accept only TLS version 1.3 connections. If false, both TLS versions 1.2 and 1.3 will be accepted.
+# REQUIRED: NO
+# DEFAULT: TRUE
+# VALID OPTIONS: TRUE, FALSE
+TLS13_ONLY=TRUE
+
+
+#
+# node-livereload parameters
+
+# LR_PORT:
+# Port on which the server should listen. Virtually all clients expect the default setting.
+# REQUIRED: NO
+# DEFAULT: 35729
+# VALID OPTIONS: Any valid TCP port number that does not conflict within your environment
+#LR_PORT=35729
+
+# LR_EXTS:
+# Comma-delimited list of extensions to watch for changes and trigger a browser reload. This list *must* be quoted.
+# REQUIRED: NO
+# DEFAULT: "html,xml,css,js,jsx,ts,tsx,php,py"
+# VALID OPTIONS: Any valid file extension(s)
+LR_EXTS="html,xml,css,js,jsx,ts,tsx,php,py"
+
+# LR_EXCLUDE:
+# Comma-delimited list of files/directories to exclude from monitoring. This list *must* be quoted.
+# REQUIRED: NO
+# DEFAULT: ".git/,.svn/,.vscode/,.idea/"
+# VALID OPTIONS: Any valid files or directories/
+LR_EXCLUDE=".git/,.svn/,.vscode/,.idea/"
+
+# LR_DELAY:
+# Amount of time in milliseconds before detecting a change and sending a trigger for a browser reload. Useful if you need to allow time for background recompilation, etc.
+# REQUIRED: NO
+# DEFAULT: 500
+# VALID OPTIONS: Any integer representing a number of milliseconds (ms)
+LR_DELAY=500
+
+# LR_DEBUG:
+# Whether or not to print diagnostic debugging messages about the server's operation. Usually a good idea to leave this set to 'true'.
+# REQUIRED: NO
+# DEFAULT: true
+# VALID OPTIONS: true, false
+LR_DEBUG=true
+
+# LR_HTTPS:
+# Whether or not to enable SSL/TLS on the server's listening port. This may be required depending on your domain and environment configuration.
+# REQUIRED: NO
+# DEFAULT: true
+# VALID OPTIONS: true, false
+LR_HTTPS=true
+
+# CERT_HOSTNAME:
+# Hostname to use if container is auto-generating a self-signed certificate.
+# REQUIRED: NO
+# DEFAULT: $HOSTNAME
+# VALID OPTIONS: Any valid hostname
+CERT_HOSTNAME=${SERVER_NAMES}
+
+
+#EOF

.gitattributes

@@ -4,9 +4,6 @@
 # https://www.davidlaing.com/2012/09/19/customise-your-gitattributes-to-become-a-git-ninja/
 *          text=auto
 
-# JetBrains: Do not touch line endings, but show diff
-.idea/** -text
-
 #
 # The above will handle all files NOT found below
 #
@@ -23,7 +20,7 @@
 *.PDF      diff=astextplain
 *.rtf      diff=astextplain
 *.RTF      diff=astextplain
-*.md       text
+*.md       text diff=markdown
 *.tex      text diff=tex
 *.adoc     text
 *.textile  text
@@ -33,6 +30,7 @@
 *.tsv      text
 *.txt      text
 *.sql      text
+*.ps1      text eol=crlf
 
 # Graphics
 *.png      binary
@@ -56,7 +54,22 @@
 # These are explicitly windows files and should use crlf
 *.bat      text eol=crlf
 *.cmd      text eol=crlf
-*.ps1      text eol=crlf
+
+# web frontend stack -- force LF so SRI hashes are always correct
+*.html     text eol=lf
+*.htm      text eol=lf
+*.css      text eol=lf
+*.min.css  text eol=lf
+*.js       text eol=lf
+*.min.js   text eol=lf
+
+# Visual Studio projects (Rider also)
+*.cs     diff=csharp
+*.sln    merge=union
+*.csproj merge=union
+*.vbproj merge=union
+*.fsproj merge=union
+*.dbproj merge=union
 
 # Serialisation
 *.json     text
@@ -72,9 +85,6 @@
 *.tgz      binary
 *.zip      binary
 
-# Docker build files
-Dockerfile  text eol=lf
-
 # Text files where line endings should be preserved
 *.patch    -text
 
@@ -85,5 +95,5 @@ Dockerfile  text eol=lf
 .gitattributes  export-ignore
 .gitignore      export-ignore
 .gitkeep        export-ignore
-.vscode        export-ignore
 .idea           export-ignore
+.vscode         export-ignore

.gitignore

@@ -1,10 +1,72 @@
-.vscode/*
-!.vscode/settings.json
-!.vscode/tasks.json
-!.vscode/launch.json
-!.vscode/extensions.json
-!.vscode/numbered-bookmarks.json
-*.code-workspace
+### JetBrains template
+# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
+# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
 
-# Local History for Visual Studio Code
-.history/
+# User-specific stuff
+.idea/**/workspace.xml
+.idea/**/tasks.xml
+.idea/**/usage.statistics.xml
+.idea/**/dictionaries
+.idea/**/shelf
+
+# Generated files
+.idea/**/contentModel.xml
+
+# Sensitive or high-churn files
+.idea/**/dataSources/
+.idea/**/dataSources.ids
+.idea/**/dataSources.local.xml
+.idea/**/sqlDataSources.xml
+.idea/**/dynamic.xml
+.idea/**/uiDesigner.xml
+.idea/**/dbnavigator.xml
+
+# Gradle
+.idea/**/gradle.xml
+.idea/**/libraries
+
+# Gradle and Maven with auto-import
+# When using Gradle or Maven with auto-import, you should exclude module files,
+# since they will be recreated, and may cause churn.  Uncomment if using
+# auto-import.
+# .idea/artifacts
+# .idea/compiler.xml
+# .idea/jarRepositories.xml
+# .idea/modules.xml
+# .idea/*.iml
+# .idea/modules
+# *.iml
+# *.ipr
+
+# CMake
+cmake-build-*/
+
+# Mongo Explorer plugin
+.idea/**/mongoSettings.xml
+
+# File-based project format
+*.iws
+
+# IntelliJ
+out/
+
+# mpeltonen/sbt-idea plugin
+.idea_modules/
+
+# JIRA plugin
+atlassian-ide-plugin.xml
+
+# Cursive Clojure plugin
+.idea/replstate.xml
+
+# Crashlytics plugin (for Android Studio and IntelliJ)
+com_crashlytics_export_strings.xml
+crashlytics.properties
+crashlytics-build.properties
+fabric.properties
+
+# Editor-based Rest Client
+.idea/httpRequests
+
+# Android studio 3.1+ serialized cache file
+.idea/caches/build_file_checksums.ser

Dockerfile

@@ -1,58 +0,0 @@
-#
-# nodejs with livereload
-#
-
-# allow dynamic build by specifying base image as build arg
-ARG NODE_TAG="16.4.2-alpine3.14"
-FROM node:${NODE_TAG}
-
-# change user id of node user
-ARG NODE_UID=9999
-RUN deluser --remove-home node \
-    && addgroup -g ${NODE_UID} -S node \
-    && adduser -G node -S -u ${NODE_UID} node
-
-# add tini, timezone support
-RUN apk --update --no-cache add tzdata tini
-
-# labels
-LABEL org.opencontainers.image.authors="Asif Bacchus <asif@asifbacchus.dev>"
-LABEL org.opencontainers.image.title="livereload npm"
-LABEL org.opencontainers.image.description="Dockerized npm livereload running under limited user account. Environment variables allow specifying files to watch/exclude and notification delay."
-LABEL org.opencontainers.image.url="https://git.asifbacchus.dev/ab-docker/livereload"
-LABEL org.opencontainers.image.documentation="https://git.asifbacchus.dev/ab-docker/livereload/raw/branch/master/README.md"
-LABEL org.opencontainers.image.source="https://git.asifbacchus.dev/ab-docker/livereload.git"
-
-# create default volume in case user forgets to map one
-VOLUME [ "/var/watch" ]
-
-# expose port
-EXPOSE 35729
-
-# default environment variables
-ENV TZ=Etc/UTC
-ENV NODE_ENV=production
-ENV NPM_CONFIG_PREFIX=/home/node/.npm-global
-ENV PATH=$PATH:/home/node/.npm-global/bin
-ENV EXT="html,xml,css,js,jsx,ts,tsx,php,py"
-ENV EXCLUDE=".git/,.svn/"
-ENV DELAY=500
-
-# install livereload for node user
-USER node
-WORKDIR /home/node
-RUN mkdir -p .npm-global/bin .npm-global/lib \
-    && npm install -g livereload
-
-# run node via tini by default
-ENTRYPOINT [ "/sbin/tini", "--" ]
-CMD livereload /var/watch --debug --exts $EXT --exclusions $EXCLUDE -u true --wait $DELAY
-
-# set build timestamp and version labels
-ARG BUILD_DATE
-LABEL org.opencontainers.image.version="16.4.2"
-LABEL org.opencontainers.image.vendor="nodeJS"
-LABEL dev.asifbacchus.image.name="livereload npm"
-LABEL dev.asifbacchus.image.version="1.2"
-LABEL org.opencontainers.image.created=${BUILD_DATE}
-#EOF

build/Dockerfile

@@ -0,0 +1,80 @@
+# node-livereload server supporting SSL/TLS
+
+# allow dynamic building by specifying base image elements as build-args
+ARG NODE_VERSION=16
+ARG ALPINE_VERSION=3.14
+FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION}
+
+# create new node user with set id from build-arg and create volume directories
+ARG NODE_UID=9999
+RUN deluser --remove-home node \
+    && addgroup -g ${NODE_UID} -S node \
+    && adduser -G node -S -u ${NODE_UID} node \
+    && mkdir /watch /certs \
+    && chown root:node /certs \
+    && chmod 770 /certs
+
+# create default volumes in-case user forgets, expose default port
+VOLUME [ "/watch", "/certs" ]
+EXPOSE 35729
+
+# add tini, timezone support and create certificate directories
+RUN apk --update --no-cache add \
+    tini \
+    tzdata \
+    openssl
+
+# labels
+LABEL org.opencontainers.image.authors="Asif Bacchus <asif@asifbacchus.dev>"
+LABEL org.opencontainers.image.title="node-livereload-tls"
+LABEL org.opencontainers.image.description="Dockerized node-livereload supporting TLS and running under limited user account. Environment variables allow specifying files to watch/exclude and notification delay."
+LABEL org.opencontainers.image.url="https://git.asifbacchus.dev/ab-docker/livereload"
+LABEL org.opencontainers.image.documentation="https://git.asifbacchus.dev/ab-docker/livereload/raw/branch/master/README.md"
+LABEL org.opencontainers.image.source="https://git.asifbacchus.dev/ab-docker/livereload.git"
+
+# default environment variables
+ENV NODE_ENV=production
+ENV NPM_CONFIG_PREFIX=/home/node/.npm-global
+ENV PATH=/home/node/.npm-global/bin:$PATH
+ENV TZ="Etc/UTC"
+ENV LR_PORT=35729
+ENV LR_EXTS="html,xml,css,js,jsx,ts,tsx,php,py"
+ENV LR_EXCLUDE=".git/,.svn/,.vscode/,.idea/"
+ENV LR_DELAY=500
+ENV LR_DEBUG=true
+ENV LR_HTTPS=true
+ENV CERT_HOSTNAME=""
+
+# install node-livereload as node user then switch back to root user
+USER node
+WORKDIR /home/node
+RUN mkdir -p .npm-global/bin .npm-global/lib \
+    && npm config set fund false \
+    && npm config set update-notifier false \
+    && npm install livereload --save
+
+# copy scripts and fix-up all permissions
+USER root
+COPY [ "selfsigned.cnf", "/etc/selfsigned.cnf" ]
+COPY [ "livereload.js", "/home/node/livereload.js" ]
+COPY [ "entrypoint.sh", "/usr/local/bin/entrypoint.sh" ]
+RUN chown node:node /home/node/livereload.js \
+    && chmod 644 /home/node/livereload.js \
+    && chmod 755 /usr/local/bin/entrypoint.sh \
+    && chmod 644 /etc/selfsigned.cnf
+
+# switch to node user, run entrypoint script by default
+USER node
+WORKDIR /home/node
+ENTRYPOINT [ "/sbin/tini", "--", "/usr/local/bin/entrypoint.sh" ]
+
+# set build timestamp and version labels
+ARG INTERNAL_VERSION
+ARG BUILD_DATE
+LABEL org.opencontainers.image.version="16.5.0, 0.9.3"
+LABEL org.opencontainers.image.vendor="NODE.js, node-livereload"
+LABEL dev.asifbacchus.image.name="node-livereload-tls"
+LABEL dev.asifbacchus.image.version=${INTERNAL_VERSION}
+LABEL org.opencontainers.image.created=${BUILD_DATE}
+
+#EOF

build/entrypoint.sh

@@ -0,0 +1,169 @@
+#!/bin/sh
+
+#
+# entrypoint script for node-livereload-tls container
+#
+
+# functions
+certificateCheckExist() {
+    if [ -n "$(find /certs/ -type d -empty -print)" ]; then
+        printf "noexist"
+    elif ! [ -r "/certs/fullchain.pem" ]; then
+        printf "noread_certificate"
+    elif ! [ -r "/certs/privkey.pem" ]; then
+        printf "noread_key"
+    else
+        printf "ok"
+    fi
+}
+
+certificateGenerateNew() {
+    # generate self-signed certificate and export as PFX
+    printf "\nGenerating new self-signed certificate:\n"
+    # shellcheck disable=SC3028
+    if [ -z "$CERT_HOSTNAME" ]; then export CERT_HOSTNAME="$HOSTNAME"; fi
+    if ! openssl req -new -x509 -days 365 -nodes -out /certs/fullchain.pem -keyout /certs/privkey.pem -config /etc/selfsigned.cnf; then
+        printf "\nUnable to generate certificate. Is your 'certs' directory writable by this container?\n\n"
+        exit 55
+    fi
+
+    # print message to user
+    printf "\n\nA self-signed certificate has been generated and saved in the location mounted to '/certs' in this container.\n"
+    printf "The certificate and private key are PEM formatted with names 'fullchain.pem' and 'privkey.pem', respectively.\n"
+    printf "Remember to import 'fullchain.pem' to the trusted store on any client machines or you will get warnings.\n\n"
+}
+
+certificateShow() {
+    printf "\nCurrently loaded certificate:\n"
+    certStatus="$(certificateCheckExist)"
+    case "$certStatus" in
+    noexist)
+        printf "[ERROR]: No certificate is loaded (certificate directory empty).\n\n"
+        exit 51
+        ;;
+    noread_certificate)
+        printf "[ERROR]: Cannot read loaded certificate.\n\n"
+        exit 52
+        ;;
+    noread_key)
+        printf "\n[WARNING]: Cannot find private key associated with certificate!\n\n"
+        ;;
+    esac
+    if ! openssl x509 -noout -text -nameopt align,multiline -certopt no_pubkey,no_sigdump -in /certs/fullchain.pem; then
+        printf "\n[ERROR]: Unable to display loaded certificate.\n\n"
+        exit 52
+    fi
+}
+
+convertCaseLower() {
+    printf "%s" "$1" | tr "[:upper:]" "[:lower:]"
+}
+
+# default variable values
+doCertNew=0
+doCertShow=0
+doServer=0
+doShell=0
+
+# clean-up boolean environment variables for this script and JavaScript
+enableHTTPS="$(convertCaseLower "$LR_HTTPS")"
+enableDebug="$(convertCaseLower "$LR_DEBUG")"
+export LR_HTTPS="$enableHTTPS"
+export LR_DEBUG="$enableDebug"
+
+# process action parameter
+case "$1" in
+listen | server | run | start)
+    doServer=1
+    ;;
+shell)
+    doShell=1
+    ;;
+new-cert)
+    doCertNew=1
+    ;;
+show-cert)
+    doCertShow=1
+    ;;
+*)
+    # invalid or unknown option
+    printf "\nUnknown action requested: %s\n" "$1"
+    printf "Valid actions: [listen | server | run | start] | shell | new-cert | show-cert\n\n"
+    exit 1
+    ;;
+esac
+
+# action: run server
+if [ "$doServer" -eq 1 ]; then
+    printf "Starting node-livereload-tls server:\n"
+
+    # https pre-flight check
+    if [ "$enableHTTPS" = "true" ]; then
+        printf "[SSL/TLS mode enabled]\n"
+        certStatus="$(certificateCheckExist)"
+        case "$certStatus" in
+            noexist)
+                printf "[Generating certificate]\n"
+                certificateGenerateNew
+                ;;
+            noread_certificate)
+                printf "[Checking mounted certificate]"
+                printf "\nERROR: SSL/TLS mode selected but unable to read certificate!\n\n"
+                exit 52
+                ;;
+            noread_key)
+                printf "[Checking mounted certificate]"
+                printf "\nERROR: SSL/TLS mode selected but unable to read private key!\n\n"
+                exit 53
+                ;;
+            ok)
+                printf "[Certificate OK]\n"
+                ;;
+        esac
+    else
+        printf "[HTTP mode enabled]\n"
+    fi
+    exec node livereload.js
+    exit "$?"
+fi
+
+# action: drop to shell
+if [ "$doShell" -eq 1 ]; then
+    if [ -z "$2" ]; then
+        printf "\nExecuting interactive shell:\n"
+        exec /bin/sh
+    else
+        shift
+        printf "\nExecuting shell: '%s'\n" "$*"
+        exec /bin/sh -c "$*"
+    fi
+    exit "$?"
+fi
+
+# action: generate new self-signed certificate
+if [ "$doCertNew" -eq 1 ]; then
+    certificateGenerateNew
+    exit 0
+fi
+
+# action: show loaded certificate
+if [ "$doCertShow" -eq 1 ]; then
+    certificateShow
+    exit 0
+fi
+
+# failsafe exit - terminate with code 99: this code should never be executed!
+exit 99
+
+# exit codes:
+# 0:   normal exit, no errors
+# 1:   invalid or invalid parameter passed to script
+# 2:   interactive shell required
+# 50:  certificate errors
+# 51:    certificate directory empty
+# 52:    unable to read certificate/chain
+# 53:    unable to read private key
+# 55:    unable to generate new certificate
+# 99:  code error
+
+#EOF

build/livereload.js

@@ -0,0 +1,29 @@
+// implement node-livereload over an HTTPS connection
+
+// load livereload module
+let livereload = require('livereload');
+
+// set createServer options
+const fs = require('fs');
+const options = {
+    port: process.env.LR_PORT,
+    exts: process.env.LR_EXTS,
+    exclusions: process.env.LR_EXCLUDE,
+    usePolling: true,
+    delay: process.env.LR_DELAY,
+    debug: process.env.LR_DEBUG
+};
+
+if (process.env.LR_HTTPS) {
+    options.https = {
+        cert: fs.readFileSync('/certs/fullchain.pem'),
+        key: fs.readFileSync('/certs/privkey.pem')
+
+    };
+}
+
+// start server
+let server = livereload.createServer(options);
+server.watch('/watch')
+
+//#EOF

build/selfsigned.cnf

@@ -0,0 +1,16 @@
+default_bits = 4096
+default_md = sha256
+distinguished_name = dn
+req_extensions = san
+x509_extensions = san
+prompt = no
+
+[dn]
+organizationName = LiveReload WebServer
+CN = ${ENV::CERT_HOSTNAME}
+
+[san]
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = ${ENV::CERT_HOSTNAME}

docker-compose.yml

@@ -0,0 +1,43 @@
+#
+# node-livereload-tls stack
+#
+
+version: '2.4'
+
+services:
+  ab-nginx:
+    image: docker.asifbacchus.dev/nginx/ab-nginx:latest
+    container_name: ab-nginx
+    volumes:
+    - ./certs/certs:ro
+    - ${WATCHDIR}:/usr/share/nginx/html:ro
+    - ./nginx/config:/etc/nginx/config:ro
+    ports:
+    - "${NGINX_HTTP:-80}:80"
+    - "${NGINX_HTTPS:-443}:443"
+    environment:
+      - TZ=${TZ}
+      - SERVER_NAMES=${SERVER_NAMES}
+      - TLS13_ONLY=${TLS13_ONLY}
+    user: "8080:${GID:-8080}"
+  livereload:
+    image: docker.asifbacchus.dev/livereload/livereload:latest
+    container_name: livereload
+    volumes:
+    - ./certs:certs
+    - ${WATCHDIR}:/watch:ro
+    ports:
+    - "${LR_PORT:-35729}:${LR_PORT:-35729}"
+    environment:
+      - TZ=${TZ}
+      - LR_PORT=${LR_PORT}
+      - LR_EXTS=${LR_EXTS}
+      - LR_EXCLUDE=${LR_EXCLUDE}
+      - LR_DELAY=${LR_DELAY}
+      - LR_DEBUG=${LR_DEBUG}
+      - LR_HTTPS=${LR_HTTPS}
+      - CERT_HOSTNAME=${CERT_HOSTNAME}
+    user: "9999:${GID:-9999}"
+    command: listen
+
+#EOF