soroush.asadi
9a27858125
The mirror's Let's Encrypt cert renewed under the new ISRG Root YR root, which isn't in the dotnet SDK image's trust store. `dotnet restore` validates TLS and fails (NU1301 / unable to get local issuer certificate), so both backend CI jobs fail and the deploy is skipped. The npm jobs are unaffected because they already pass --strict-ssl=false. Pin the mirror's intermediate (CN=YR2, CA:TRUE, valid to Sept 2028) and add it as a trust anchor before restore in: - CI api-build + admin-api-build jobs (.gitea/workflows/ci-cd.yml) - docker/api/Dockerfile + docker/admin-api/Dockerfile (deploy image builds) Also set NUGET_CERT_REVOCATION_MODE=offline in the CI restore steps to avoid CRL/OCSP fetches to lencr.org (filtered from Iran). Permanent fix is server-side (re-chain to ISRG Root X1 or update trust stores); this unblocks CI/deploys without depending on that. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
37 lines
1.3 KiB
Docker
37 lines
1.3 KiB
Docker
ARG DOTNET_SDK_IMAGE=mirror.soroushasadi.com/dotnet/sdk:10.0
|
|
ARG DOTNET_ASPNET_IMAGE=mirror.soroushasadi.com/dotnet/aspnet:10.0
|
|
|
|
FROM ${DOTNET_SDK_IMAGE} AS build
|
|
WORKDIR /src
|
|
|
|
COPY global.json Directory.Build.props Directory.Packages.props ./
|
|
# nuget.docker.config points to Nexus mirror (mirror.soroushasadi.com)
|
|
COPY nuget.docker.config ./nuget.config
|
|
|
|
# Trust the Nexus mirror's TLS CA (new ISRG Root YR chain, not in the SDK image's
|
|
# trust store). See docker/api/Dockerfile for the full rationale.
|
|
COPY docker/nexus-mirror-ca.crt /usr/local/share/ca-certificates/nexus-mirror-ca.crt
|
|
RUN update-ca-certificates
|
|
|
|
COPY src/Meezi.Shared/Meezi.Shared.csproj src/Meezi.Shared/
|
|
COPY src/Meezi.Core/Meezi.Core.csproj src/Meezi.Core/
|
|
COPY src/Meezi.Infrastructure/Meezi.Infrastructure.csproj src/Meezi.Infrastructure/
|
|
COPY src/Meezi.Admin.API/Meezi.Admin.API.csproj src/Meezi.Admin.API/
|
|
|
|
ENV NUGET_CERT_REVOCATION_MODE=offline
|
|
RUN --mount=type=cache,target=/root/.nuget/packages \
|
|
dotnet restore src/Meezi.Admin.API/Meezi.Admin.API.csproj --disable-parallel
|
|
|
|
COPY src/ src/
|
|
RUN dotnet publish src/Meezi.Admin.API/Meezi.Admin.API.csproj -c Release -o /app/publish /p:UseAppHost=false
|
|
|
|
FROM ${DOTNET_ASPNET_IMAGE} AS runtime
|
|
WORKDIR /app
|
|
|
|
ENV ASPNETCORE_URLS=http://+:8080
|
|
EXPOSE 8080
|
|
|
|
COPY --from=build /app/publish .
|
|
|
|
ENTRYPOINT ["dotnet", "Meezi.Admin.API.dll"]
|