cluster

commit 70911c5eaa66361c2424a12d34ddccea890ec017
parent 61872f3d2f4775c40ae7a91c84d1f88ca8bdb6b4
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Fri, 17 Apr 2026 16:51:44 +0200

prepare media wiki

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
A
.github/workflows/build-mediawiki.yaml
 | 
126
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
A
apps/talos_cluster/mediawiki/Dockerfile
 | 
9
+++++++++
A
apps/talos_cluster/mediawiki/php-custom.ini
 | 
4
++++

3 files changed, 139 insertions(+), 0 deletions(-)
diff --git a/.github/workflows/build-mediawiki.yaml b/.github/workflows/build-mediawiki.yaml
@@ -0,0 +1,126 @@
+name: Build MediaWiki Image
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "apps/talos_cluster/mediawiki/Dockerfile"
+      - "apps/talos_cluster/mediawiki/php-custom.ini"
+      - ".github/workflows/build-mediawiki.yaml"
+  schedule:
+    # Check for new upstream releases daily at 04:30 UTC
+    - cron: "30 4 * * *"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "MediaWiki version to build (e.g. 1.45.3). Leave empty to use latest upstream release."
+        required: false
+      force:
+        description: "Force rebuild even if tag already exists in registry"
+        required: false
+        default: "false"
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Check for new version
+    runs-on: ubuntu-latest
+    outputs:
+      new_version: ${{ steps.versions.outputs.new_version }}
+      needs_build: ${{ steps.versions.outputs.needs_build }}
+    steps:
+      - name: Determine versions
+        id: versions
+        env:
+          GH_TOKEN: ${{ github.token }}
+          INPUT_VERSION: ${{ inputs.version }}
+          INPUT_FORCE: ${{ inputs.force }}
+        run: |
+          if [ -n "$INPUT_VERSION" ]; then
+            NEW="$INPUT_VERSION"
+          else
+            NEW=$(gh api repos/wikimedia/mediawiki/releases/latest --jq '.tag_name' | sed 's/^v//')
+          fi
+          echo "new_version=$NEW" >> "$GITHUB_OUTPUT"
+
+          if [ "$INPUT_FORCE" = "true" ]; then
+            echo "needs_build=true" >> "$GITHUB_OUTPUT"
+            echo "Force rebuild requested for version ${NEW}"
+          else
+            TAGS=$(curl -sf "https://registry.midnightthoughts.space/v2/mtrnord/mediawiki/tags/list" \
+              | grep -o '"tags":\[[^]]*\]' || echo "")
+            if echo "$TAGS" | grep -q "\"${NEW}\""; then
+              echo "needs_build=false" >> "$GITHUB_OUTPUT"
+              echo "Version ${NEW} already exists in registry, skipping build"
+            else
+              echo "needs_build=true" >> "$GITHUB_OUTPUT"
+              echo "Version ${NEW} not found in registry, will build"
+            fi
+          fi
+
+  build:
+    name: Build, Push and Sign
+    needs: check
+    if: needs.check.outputs.needs_build == 'true'
+    runs-on: ubuntu-latest
+    environment: registry
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+
+      - name: Log in to self-hosted registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        with:
+          registry: registry.midnightthoughts.space
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+        with:
+          cosign-release: v3.0.5
+
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
+        with:
+          context: apps/talos_cluster/mediawiki
+          file: apps/talos_cluster/mediawiki/Dockerfile
+          push: true
+          build-args: |
+            MEDIAWIKI_VERSION=${{ needs.check.outputs.new_version }}
+          tags: |
+            registry.midnightthoughts.space/mtrnord/mediawiki:${{ needs.check.outputs.new_version }}
+            registry.midnightthoughts.space/mtrnord/mediawiki:latest
+          labels: |
+            org.opencontainers.image.description=MediaWiki personal wiki — custom image with bundled extensions
+            org.opencontainers.image.title=mediawiki
+            org.opencontainers.image.vendor=MTRNord
+            org.opencontainers.image.version=${{ needs.check.outputs.new_version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64,linux/arm64
+
+      - name: Sign image
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+          COSIGN_OCI_EXPERIMENTAL: "1"
+          COSIGN_EXPERIMENTAL: "1"
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          cosign sign --yes --key env://COSIGN_PRIVATE_KEY \
+            --new-bundle-format=false \
+            --use-signing-config=false \
+            --registry-referrers-mode=oci-1-1 \
+            "registry.midnightthoughts.space/mtrnord/mediawiki@${DIGEST}"
diff --git a/apps/talos_cluster/mediawiki/Dockerfile b/apps/talos_cluster/mediawiki/Dockerfile
@@ -0,0 +1,9 @@
+ARG MEDIAWIKI_VERSION=1.45.3
+FROM mediawiki:${MEDIAWIKI_VERSION}
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    librsvg2-bin \
+    python3-pygments \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY php-custom.ini /usr/local/etc/php/conf.d/mediawiki-custom.ini
diff --git a/apps/talos_cluster/mediawiki/php-custom.ini b/apps/talos_cluster/mediawiki/php-custom.ini
@@ -0,0 +1,4 @@
+upload_max_filesize = 50M
+post_max_size = 50M
+memory_limit = 256M
+max_execution_time = 60