chore(deps): update docker.io/alpine docker tag to v3.20 (#14)

Reviewed-on: #14
Co-authored-by: Renovator Bot <renovator@rknet.org>
Co-committed-by: Renovator Bot <renovator@rknet.org>

.dictionary

@@ -0,0 +1,5 @@
+nginx-s3
+S3
+UID
+(N|n)ginx
+preconfigured

.drone.yml

@@ -1,170 +0,0 @@
----
-kind: pipeline
-name: test
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-  - name: markdownlint
-    image: thegeeklab/markdownlint-cli
-    commands:
-      - markdownlint 'README.md'
-
-trigger:
-  ref:
-    - refs/heads/main
-    - refs/tags/**
-    - refs/pull/**
-
----
-kind: pipeline
-name: build-container
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-  - name: tags
-    image: thegeeklab/docker-autotag
-    environment:
-      DOCKER_AUTOTAG_FORCE_LATEST: True
-      DOCKER_AUTOTAG_IGNORE_PRERELEASE: True
-      DOCKER_AUTOTAG_OUTPUT_FILE: .tags
-      DOCKER_AUTOTAG_VERSION: ${DRONE_TAG}
-
-  - name: dryrun
-    image: thegeeklab/drone-docker-buildx:23
-    settings:
-      dockerfile: Dockerfile.multiarch
-      dry_run: true
-      platforms:
-        - linux/amd64
-        - linux/arm64
-        - linux/arm/v7
-        - linux/arm/v6
-      provenance: false
-      repo: thegeeklab/${DRONE_REPO_NAME}
-    when:
-      ref:
-        - refs/pull/**
-    depends_on:
-      - tags
-
-  - name: publish-dockerhub
-    image: thegeeklab/drone-docker-buildx:23
-    settings:
-      dockerfile: Dockerfile.multiarch
-      password:
-        from_secret: docker_password
-      platforms:
-        - linux/amd64
-        - linux/arm64
-        - linux/arm/v7
-        - linux/arm/v6
-      provenance: false
-      repo: thegeeklab/${DRONE_REPO_NAME}
-      username:
-        from_secret: docker_username
-    when:
-      ref:
-        - refs/heads/main
-        - refs/tags/**
-    depends_on:
-      - dryrun
-
-  - name: publish-quay
-    image: thegeeklab/drone-docker-buildx:23
-    settings:
-      dockerfile: Dockerfile.multiarch
-      password:
-        from_secret: quay_password
-      platforms:
-        - linux/amd64
-        - linux/arm64
-        - linux/arm/v7
-        - linux/arm/v6
-      provenance: false
-      registry: quay.io
-      repo: quay.io/thegeeklab/${DRONE_REPO_NAME}
-      username:
-        from_secret: quay_username
-    when:
-      ref:
-        - refs/heads/main
-        - refs/tags/**
-    depends_on:
-      - dryrun
-
-trigger:
-  ref:
-    - refs/heads/main
-    - refs/tags/**
-    - refs/pull/**
-
-depends_on:
-  - test
-
----
-kind: pipeline
-name: notifications
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-  - name: pushrm-dockerhub
-    image: chko/docker-pushrm:1
-    environment:
-      DOCKER_PASS:
-        from_secret: docker_password
-      DOCKER_USER:
-        from_secret: docker_username
-      PUSHRM_FILE: README.md
-      PUSHRM_SHORT: Nginx (openresty) S3 proxy
-      PUSHRM_TARGET: thegeeklab/${DRONE_REPO_NAME}
-    when:
-      status:
-        - success
-
-  - name: pushrm-quay
-    image: chko/docker-pushrm:1
-    environment:
-      APIKEY__QUAY_IO:
-        from_secret: quay_token
-      PUSHRM_FILE: README.md
-      PUSHRM_TARGET: quay.io/thegeeklab/${DRONE_REPO_NAME}
-    when:
-      status:
-        - success
-
-  - name: matrix
-    image: thegeeklab/drone-matrix
-    settings:
-      homeserver:
-        from_secret: matrix_homeserver
-      password:
-        from_secret: matrix_password
-      roomid:
-        from_secret: matrix_roomid
-      template: "Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}"
-      username:
-        from_secret: matrix_username
-    when:
-      status:
-        - success
-        - failure
-
-trigger:
-  ref:
-    - refs/heads/main
-    - refs/tags/**
-  status:
-    - success
-    - failure
-
-depends_on:
-  - build-container

.gitsv/config.yml

@@ -0,0 +1,47 @@
+---
+version: "1.1"
+
+versioning:
+  update-major: []
+  update-minor: [feat]
+  update-patch: [fix, perf, refactor, chore, test, ci, docs]
+
+tag:
+  pattern: "v%d.%d.%d"
+
+release-notes:
+  sections:
+    - name: Features
+      commit-types: [feat]
+      section-type: commits
+    - name: Bug Fixes
+      commit-types: [fix]
+      section-type: commits
+    - name: Performance Improvements
+      commit-types: [perf]
+      section-type: commits
+    - name: Code Refactoring
+      commit-types: [refactor]
+      section-type: commits
+    - name: Others
+      commit-types: [chore]
+      section-type: commits
+    - name: Testing
+      commit-types: [test]
+      section-type: commits
+    - name: CI Pipeline
+      commit-types: [ci]
+      section-type: commits
+    - name: Documentation
+      commit-types: [docs]
+      section-type: commits
+    - name: BREAKING CHANGES
+      section-type: breaking-changes
+
+commit-message:
+  footer:
+    issue:
+      key: issue
+      add-value-prefix: "#"
+  issue:
+    regex: "#?[0-9]+"

.prettierignore

@@ -1,3 +1,2 @@
-.drone.yml
 *.tpl.md
 LICENSE

.woodpecker/build-container.yml

@@ -0,0 +1,69 @@
+---
+when:
+  - event: [pull_request, tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+steps:
+  - name: security-build
+    image: quay.io/thegeeklab/wp-docker-buildx:4
+    settings:
+      containerfile: Containerfile.multiarch
+      output: type=oci,dest=oci/${CI_REPO_NAME},tar=false
+      repo: thegeeklab/${CI_REPO_NAME}
+
+  - name: security-scan
+    image: ghcr.io/aquasecurity/trivy
+    commands:
+      - trivy -v
+      - trivy image --input oci/${CI_REPO_NAME}
+    environment:
+      TRIVY_EXIT_CODE: "1"
+      TRIVY_IGNORE_UNFIXED: "true"
+      TRIVY_NO_PROGRESS: "true"
+      TRIVY_SEVERITY: HIGH,CRITICAL
+      TRIVY_TIMEOUT: 1m
+
+  - name: publish-dockerhub
+    image: quay.io/thegeeklab/wp-docker-buildx:4
+    group: container
+    settings:
+      auto_tag: true
+      containerfile: Containerfile.multiarch
+      password:
+        from_secret: docker_password
+      platforms:
+        - linux/amd64
+        - linux/arm64
+      provenance: false
+      repo: thegeeklab/${CI_REPO_NAME}
+      username:
+        from_secret: docker_username
+    when:
+      - event: [tag]
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}
+
+  - name: publish-quay
+    image: quay.io/thegeeklab/wp-docker-buildx:4
+    group: container
+    settings:
+      auto_tag: true
+      containerfile: Containerfile.multiarch
+      password:
+        from_secret: quay_password
+      platforms:
+        - linux/amd64
+        - linux/arm64
+      provenance: false
+      registry: quay.io
+      repo: quay.io/thegeeklab/${CI_REPO_NAME}
+      username:
+        from_secret: quay_username
+    when:
+      - event: [tag]
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}

.woodpecker/build-package.yml

@@ -0,0 +1,25 @@
+---
+when:
+  - event: [pull_request, tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+steps:
+  - name: changelog
+    image: quay.io/thegeeklab/git-sv
+    commands:
+      - git sv current-version
+      - git sv release-notes -t ${CI_COMMIT_TAG:-next} -o CHANGELOG.md
+      - cat CHANGELOG.md
+
+  - name: publish-gitea
+    image: quay.io/thegeeklab/wp-gitea-release
+    settings:
+      api_key:
+        from_secret: gitea_token
+      base_url: https://gitea.rknet.org
+      note: CHANGELOG.md
+      title: ${CI_COMMIT_TAG}
+    when:
+      - event: [tag]

.woodpecker/docs.yml

@@ -0,0 +1,62 @@
+---
+when:
+  - event: [pull_request, tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+steps:
+  - name: markdownlint
+    image: quay.io/thegeeklab/markdownlint-cli
+    group: test
+    commands:
+      - markdownlint 'README.md'
+
+  - name: spellcheck
+    image: quay.io/thegeeklab/alpine-tools
+    group: test
+    commands:
+      - spellchecker --files '_docs/**/*.md' 'README.md' -d .dictionary -p spell indefinite-article syntax-urls
+    environment:
+      FORCE_COLOR: "true"
+
+  - name: link-validation
+    image: docker.io/lycheeverse/lychee
+    group: test
+    commands:
+      - lychee --no-progress --format detailed README.md
+
+  - name: pushrm-dockerhub
+    image: docker.io/chko/docker-pushrm:1
+    secrets:
+      - source: docker_password
+        target: DOCKER_PASS
+      - source: docker_username
+        target: DOCKER_USER
+    environment:
+      PUSHRM_FILE: README.md
+      PUSHRM_SHORT: Nginx (openresty) S3 proxy
+      PUSHRM_TARGET: thegeeklab/${CI_REPO_NAME}
+    when:
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}
+        status: [success]
+
+  - name: pushrm-quay
+    image: docker.io/chko/docker-pushrm:1
+    secrets:
+      - source: quay_token
+        target: APIKEY__QUAY_IO
+    environment:
+      PUSHRM_FILE: README.md
+      PUSHRM_TARGET: quay.io/thegeeklab/${CI_REPO_NAME}
+    when:
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}
+        status: [success]
+
+depends_on:
+  - build-package
+  - build-container

.woodpecker/notify.yml

@@ -0,0 +1,26 @@
+---
+when:
+  - event: [tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+runs_on: [success, failure]
+
+steps:
+  - name: matrix
+    image: quay.io/thegeeklab/wp-matrix
+    settings:
+      homeserver:
+        from_secret: matrix_homeserver
+      password:
+        from_secret: matrix_password
+      roomid:
+        from_secret: matrix_roomid
+      username:
+        from_secret: matrix_username
+    when:
+      - status: [success, failure]
+
+depends_on:
+  - docs

Containerfile.multiarch

@@ -1,11 +1,11 @@
-FROM alpine:3.18@sha256:7144f7bab3d4c2648d7e59409f15ec52a18006a128c733fcff20d3a4a54ba44a
+FROM docker.io/alpine:3.20@sha256:77726ef6b57ddf65bb551896826ec38bc3e53f75cdde31354fbffb4f25238ebd
 
 LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
 LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
 LABEL org.opencontainers.image.title="nginx-s3"
-LABEL org.opencontainers.image.url="https://gitea.rknet.org/docker/nginx-s3"
-LABEL org.opencontainers.image.source="https://gitea.rknet.org/docker/nginx-s3"
-LABEL org.opencontainers.image.documentation="https://gitea.rknet.org/docker/nginx-s3"
+LABEL org.opencontainers.image.url="https://gitea.rknet.org/container/nginx-s3"
+LABEL org.opencontainers.image.source="https://gitea.rknet.org/container/nginx-s3"
+LABEL org.opencontainers.image.documentation="https://gitea.rknet.org/container/nginx-s3"
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -15,17 +15,18 @@ ARG GOMPLATE_VERSION
 ARG CONTAINER_LIBRARY
 
 # renovate: datasource=github-releases depName=hairyhenderson/gomplate
-ENV GOMPLATE_VERSION="${GOMPLATE_VERSION:-v3.11.5}"
-# renovate: datasource=git-tags depName=https://gitea.rknet.org/docker/container-library
+ENV GOMPLATE_VERSION="${GOMPLATE_VERSION:-v3.11.7}"
+# renovate: datasource=git-tags depName=https://gitea.rknet.org/container/container-library
 ENV CONTAINER_LIBRARY="${CONTAINER_LIBRARY:-v0.1.3}"
 
 RUN addgroup -g 1001 -S nginx && \
     adduser -S -D -H -u 1001 -h /var/www -s /sbin/nologin -G nginx -g nginx nginx && \
     apk --update add --virtual .build-deps curl && \
     apk --update --no-cache add inotify-tools ca-certificates && \
-    apk --update --no-cache add openresty --repository=https://dl-cdn.alpinelinux.org/alpine/edge/testing/ && \
+    apk --update --no-cache add openresty --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community/ && \
+    apk --no-cache upgrade libcrypto3 libssl3 && \
     rm -rf /etc/nginx/conf.d && \
-    curl -SsfL "https://gitea.rknet.org/docker/container-library/releases/download/${CONTAINER_LIBRARY}/container-library.tar.gz" | tar xz -C / && \
+    curl -SsfL "https://gitea.rknet.org/container/container-library/releases/download/${CONTAINER_LIBRARY}/container-library.tar.gz" | tar xz -C / && \
     curl -SsfL -o /usr/local/bin/gomplate "https://github.com/hairyhenderson/gomplate/releases/download/${GOMPLATE_VERSION}/gomplate_${TARGETOS}-${TARGETARCH}${TARGETVARIANT}" && \
     chmod 755 /usr/local/bin/gomplate && \
     apk del .build-deps && \

README.md

@@ -2,14 +2,18 @@
 
 Nginx (openresty) S3 proxy
 
-[![Build Status](https://img.shields.io/drone/build/docker/nginx?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/docker/nginx)
+<!-- spellchecker-disable -->
+
+[![Build Status](https://ci.rknet.org/api/badges/container/nginx-s3/status.svg)](https://ci.rknet.org/repos/container/nginx-s3)
 [![Docker Hub](https://img.shields.io/badge/dockerhub-latest-blue.svg?logo=docker&logoColor=white)](https://hub.docker.com/r/thegeeklab/nginx)
 [![Quay.io](https://img.shields.io/badge/quay-latest-blue.svg?logo=docker&logoColor=white)](https://quay.io/repository/thegeeklab/nginx)
-[![Source: Gitea](https://img.shields.io/badge/source-gitea-blue.svg?logo=gitea&logoColor=white)](https://gitea.rknet.org/docker/nginx)
-[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/docker/nginx/src/branch/main/LICENSE)
+[![Source: Gitea](https://img.shields.io/badge/source-gitea-blue.svg?logo=gitea&logoColor=white)](https://gitea.rknet.org/container/nginx)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/container/nginx/src/branch/main/LICENSE)
 
-Nginx (openresty) container based on Alpine to proxy S3 buckets. The pre-configured non-root user is a system user named `nginx` with the UID `1001`. There is also a primary group with the same values.
+<!-- spellchecker-enable -->
+
+Nginx (openresty) container based on Alpine to proxy S3 buckets. The preconfigured non-root user is a system user named `nginx` with the UID `1001`. There is also a primary group with the same values.
 
 ## License
 
-This project is licensed under the MIT License - see the [LICENSE](https://gitea.rknet.org/docker/nginx/src/branch/main/LICENSE) file for details.
+This project is licensed under the MIT License - see the [LICENSE](https://gitea.rknet.org/container/nginx/src/branch/main/LICENSE) file for details.

overlay/etc/templates/vhosts.conf.tmpl

@@ -65,7 +65,7 @@ server {
         proxy_buffering off;
         proxy_connect_timeout 300;
         proxy_intercept_errors on;
-        port_in_redirect off;
+        absolute_redirect off;
 
         {{ if $this.upstream_use_tls -}}
         proxy_set_header Host "{{ $upstream_host }}";

trivy.yaml

@@ -0,0 +1,4 @@
+---
+scan:
+  skip-files:
+    - /usr/local/bin/gomplate