penpot: add patch disallow. reg. with invite, if pass. login is disabled

This is in preparation for building penpot images with custom patches
applied.

.woodpecker/keycloak.yaml

@@ -1,5 +1,8 @@
 when:
   - event: push
+    path: 
+      - 'keycloak/**'
+      - '.woodpecker/keycloak.yaml'
   - event: cron
     cron: daily
 
@@ -25,6 +28,7 @@ steps:
     image: alpine
     commands:
       - mkdir /woodpecker/images
+
   - name: build-image
     image: gcr.io/kaniko-project/executor
     entrypoint:
@@ -35,6 +39,7 @@ steps:
       - --destination=${IMAGE_NAME}:${KEYCLOAK_VERSION}
       - --no-push
       - --tar-path=/woodpecker/images/keycloak.tar
+
   - name: publish-image
     image: alpine
     secrets:
@@ -42,8 +47,9 @@ steps:
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
-      - crane push /woodpecker/images/keycloak.tar $IMAGE_NAME:$CI_COMMIT_BRANCH
-  - name: tag-version-and-latest
+      - crane push /woodpecker/images/keycloak.tar $IMAGE_NAME:$KEYCLOAK_VERSION-$CI_COMMIT_BRANCH
+
+  - name: tag-version
     image: alpine
     when:
       - branch: main
@@ -52,5 +58,16 @@ steps:
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
-      - crane tag $IMAGE_NAME:$CI_COMMIT_BRANCH $KEYCLOAK_VERSION
-      - crane tag $IMAGE_NAME:$CI_COMMIT_BRANCH latest
+      - crane tag $IMAGE_NAME:$KEYCLOAK_VERSION-$CI_COMMIT_BRANCH $KEYCLOAK_VERSION
+
+  - name: tag-latest
+    image: alpine
+    when:
+      - branch: main
+        evaluate: 'KEYCLOAK_VERSION == "25.0"'
+    secrets:
+      - GIT_API_TOKEN
+    commands:
+      - apk -u add crane
+      - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
+      - crane tag $IMAGE_NAME:$KEYCLOAK_VERSION-$CI_COMMIT_BRANCH latest

.woodpecker/nextcloud.yaml

@@ -0,0 +1,74 @@
+when:
+  - event: push
+    path: 
+      - 'nextcloud/**'
+      - '.woodpecker/nextcloud.yaml'
+  - event: cron
+    cron: daily
+
+# Manually set a workspace path, so we can use it literally, without using
+# ${CI_WORKSPACE}, when running kaniko, since using ${CI_WORKSPACE} doesn't work.
+# https://github.com/woodpecker-ci/woodpecker/issues/3982
+workspace:
+  path: src
+
+# Use matrix to set NEXTCLOUD_VERSION instead of setting the NEXTCLOUD_VERSION as
+# an environment variable in the build-images step, since string substitution
+# doesn't work for custom environment variables.
+# https://github.com/woodpecker-ci/woodpecker/issues/3983
+# Also because global environment variables aren't a thing.
+matrix:
+  NEXTCLOUD_VERSION:
+    - 28
+    - 29
+  IMAGE_NAME:
+    - git.hamburg.ccc.de/ccchh/oci-images/nextcloud
+
+steps:
+  - name: setup-image-path
+    image: docker.io/library/alpine
+    commands:
+      - mkdir /woodpecker/images
+
+  - name: build-image
+    image: gcr.io/kaniko-project/executor
+    entrypoint:
+      - /kaniko/executor
+      - --context=dir:///woodpecker/src/nextcloud
+      - --dockerfile=./Containerfile
+      - --build-arg=TAG=${NEXTCLOUD_VERSION}
+      - --destination=${IMAGE_NAME}:${NEXTCLOUD_VERSION}
+      - --no-push
+      - --tar-path=/woodpecker/images/nextcloud.tar
+
+  - name: publish-image
+    image: docker.io/library/alpine
+    secrets:
+      - GIT_API_TOKEN
+    commands:
+      - apk -u add crane
+      - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
+      - crane push /woodpecker/images/nextcloud.tar $IMAGE_NAME:$NEXTCLOUD_VERSION-$CI_COMMIT_BRANCH
+
+  - name: tag-version
+    image: docker.io/library/alpine
+    when:
+      - branch: main
+    secrets:
+      - GIT_API_TOKEN
+    commands:
+      - apk -u add crane
+      - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
+      - crane tag $IMAGE_NAME:$NEXTCLOUD_VERSION-$CI_COMMIT_BRANCH $NEXTCLOUD_VERSION
+
+  - name: tag-latest
+    image: docker.io/library/alpine
+    when:
+      - branch: main
+        evaluate: 'NEXTCLOUD_VERSION == "28"'
+    secrets:
+      - GIT_API_TOKEN
+    commands:
+      - apk -u add crane
+      - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
+      - crane tag $IMAGE_NAME:$NEXTCLOUD_VERSION-$CI_COMMIT_BRANCH latest

.woodpecker/penpot.yaml

@@ -0,0 +1,95 @@
+when:
+  - event: push
+    path: 
+      - 'penpot/**'
+      - '.woodpecker/penpot.yaml'
+  - event: cron
+    cron: daily
+
+# Manually set a workspace path, so we can use it literally, without using
+# ${CI_WORKSPACE}, when running kaniko, since using ${CI_WORKSPACE} doesn't work.
+# https://github.com/woodpecker-ci/woodpecker/issues/3982
+workspace:
+  path: src
+
+# Use matrix to set PENPOT_VERSION instead of setting the PENPOT_VERSION as an
+# environment variable in the build-images step, since string substitution
+# doesn't work for custom environment variables.
+# https://github.com/woodpecker-ci/woodpecker/issues/3983
+# Also because global environment variables aren't a thing.
+matrix:
+  PENPOT_VERSION:
+    - 2.1.2
+  IMAGE_BASE_NAME:
+    - git.hamburg.ccc.de/ccchh/oci-images/penpot
+  IMAGE_TYPE:
+    - frontend
+    - backend
+    - exporter
+
+steps:
+  - name: setup-image-path
+    image: alpine
+    commands:
+      - mkdir /woodpecker/images
+
+  - name: setup-penpot-repo
+    image: alpine
+    commands:
+      - apk -u add git curl
+      - git clone --branch $PENPOT_VERSION https://github.com/penpot/penpot.git /woodpecker/penpot
+      - cd /woodpecker/penpot
+      - git submodule update --init --recursive
+      # Get build system patch allowing for building images with kaniko.
+      # https://github.com/penpot/penpot/pull/4945
+      # https://github.com/penpot/penpot/pull/4945/commits/752574bac789cc90cc218004bb9545cc6239895d
+      - curl https://github.com/penpot/penpot/commit/752574bac789cc90cc218004bb9545cc6239895d.patch > 0001-move-entire-image-build-process-into-Dockerfiles.patch
+      # Get patch disallowing registration with invitation token, when disable-login-with-password flag is set.
+      # https://github.com/penpot/penpot/issues/4975
+      # https://github.com/june128/penpot/commit/f799da132bf5a51015859031f45154172fbf7cd0
+      - curl https://github.com/june128/penpot/commit/f799da132bf5a51015859031f45154172fbf7cd0.patch > 0002-hotfix-dont-allow-registration-with-invite-if-password-login-is-disabled.patch
+      - git config user.name "Woodpecker"
+      - git config user.email "woodpecker@woodpecker.invalid"
+      - git am *.patch
+
+  - name: build-image
+    image: gcr.io/kaniko-project/executor
+    entrypoint:
+      - /kaniko/executor
+      - --context=dir:///woodpecker/penpot
+      - --dockerfile=./docker/images/Dockerfile.${IMAGE_TYPE}
+      - --destination=${IMAGE_BASE_NAME}/${IMAGE_TYPE}:${PENPOT_VERSION}
+      - --no-push
+      - --tar-path=/woodpecker/images/penpot-${IMAGE_TYPE}.tar
+
+  - name: publish-image
+    image: docker.io/library/alpine
+    secrets:
+      - GIT_API_TOKEN
+    commands:
+      - apk -u add crane
+      - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
+      - crane push /woodpecker/images/penpot-$IMAGE_TYPE.tar $IMAGE_BASE_NAME/$IMAGE_TYPE:$PENPOT_VERSION-$CI_COMMIT_BRANCH
+
+  - name: tag-version
+    image: docker.io/library/alpine
+    when:
+      - branch: main
+    secrets:
+      - GIT_API_TOKEN
+    commands:
+      - apk -u add crane
+      - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
+      - crane tag $IMAGE_BASE_NAME/$IMAGE_TYPE:$PENPOT_VERSION-$CI_COMMIT_BRANCH $PENPOT_VERSION
+
+  - name: tag-latest
+    image: docker.io/library/alpine
+    when:
+      - branch: main
+        evaluate: 'PENPOT_VERSION == "2.1.2"'
+    secrets:
+      - GIT_API_TOKEN
+    commands:
+      - apk -u add crane
+      - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
+      - crane tag $IMAGE_BASE_NAME/$IMAGE_TYPE:$PENPOT_VERSION-$CI_COMMIT_BRANCH latest

README.md

@@ -11,3 +11,7 @@ Tools in use:
 ## Images
 
 - `git.hamburg.ccc.de/CCCHH/oci-images/keycloak`
+- `git.hamburg.ccc.de/CCCHH/oci-images/nextcloud`
+- `git.hamburg.ccc.de/CCCHH/oci-images/penpot/frontend`
+- `git.hamburg.ccc.de/CCCHH/oci-images/penpot/backend`
+- `git.hamburg.ccc.de/CCCHH/oci-images/penpot/exporter`

keycloak/themes/ccchh/login/resources/css/ccchh/login.css

@@ -2,4 +2,15 @@
     background: url("../../img/blur-more-blur-edit.jpg") no-repeat center center fixed;
     background-size: cover;
     height: 100%;
+}
+
+div.kc-logo-text {
+    background: url("../../img/CCCHH.svg") no-repeat center center;
+    background-size: contain;
+    filter: invert(1);
+    height: 100px;
+}
+
+div.kc-logo-text span {
+    display: none;
 }

keycloak/themes/ccchh/login/resources/img/CCCHH.svg

@@ -0,0 +1,123 @@
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
+<svg xmlns="http://www.w3.org/2000/svg"  xmlns:xlink="http://www.w3.org/1999/xlink" width='270.000mm' height='78.923mm' viewBox="0 0 270.000 78.923">
+
+<title>Exported SVG</title>
+
+<style><![CDATA[
+polygon {
+shape-rendering:crispEdges;
+stroke-width:0.270000;
+}
+.s1 {
+stroke:#000000;
+stroke-width:0.245682;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.s2 {
+stroke:#19b219;
+stroke-width:0.245682;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.s3 {
+stroke:#7f4c00;
+stroke-width:0.245682;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.s4 {
+stroke:#00cc00;
+stroke-width:0.245682;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.s5 {
+stroke:#000000;
+stroke-width:0.163788;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.s6 {
+stroke:#ff19ff;
+stroke-width:0.163788;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.s7 {
+stroke:#ff0000;
+stroke-width:0.245682;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.s8 {
+stroke:#ffff00;
+stroke-width:0.245682;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.s9 {
+stroke:#001919;
+stroke-width:0.163788;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.sa {
+stroke:#006666;
+stroke-width:0.163788;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.sb {
+stroke:#00ffff;
+stroke-width:0.491365;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.sc {
+stroke:#ff0000;
+stroke-width:1.310307;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.sd {
+stroke:#191919;
+stroke-width:0.163788;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+.se {
+stroke:#000000;
+stroke-width:0.163788;
+stroke-linecap:round;
+stroke-linejoin:round;
+stroke-dasharray:2.457,2.457;
+fill:none;
+}
+.sf {
+stroke:#000000;
+stroke-width:0.491365;
+stroke-linecap:round;
+stroke-linejoin:round;
+fill:none;
+}
+]]></style>
+<path d='M62.272 26.962 A30.000,30.000 0 0,0 28.603,10.152 A30.000,30.000 0 0,0 5.000,39.462 A30.000,30.000 0 0,0 28.603,68.772 A30.000,30.000 0 0,0 62.272,51.962 L56.651,51.962 A25.000,25.000 0 0,1 28.530,63.610 A25.000,25.000 0 0,1 10.000,39.462 A25.000,25.000 0 0,1 28.530,15.313 A25.000,25.000 0 0,1 56.651,26.962 L62.272,26.962 ' class='s0' />
+<path d='M53.540 31.962 A20.000,20.000 0 0,0 31.180,19.830 A20.000,20.000 0 0,0 15.000,39.462 A20.000,20.000 0 0,0 31.180,59.093 A20.000,20.000 0 0,0 53.540,46.962 L65.953,46.962 A30.000,30.000 0 0,0 92.347,69.344 A30.000,30.000 0 0,0 122.272,51.962 L116.651,51.962 A25.000,25.000 0 0,1 89.747,63.903 A25.000,25.000 0 0,1 70.125,41.962 L49.790,41.962 A15.000,15.000 0 0,1 33.746,54.409 A15.000,15.000 0 0,1 20.000,39.462 A15.000,15.000 0 0,1 33.746,24.514 A15.000,15.000 0 0,1 49.790,36.962 L70.125,36.962 A25.000,25.000 0 0,1 89.747,15.020 A25.000,25.000 0 0,1 116.651,26.962 L122.272,26.962 A30.000,30.000 0 0,0 92.347,9.579 A30.000,30.000 0 0,0 65.953,31.962 L53.540,31.962 ' class='s0' />
+<path d='M113.540 31.962 A20.000,20.000 0 0,0 91.180,19.830 A20.000,20.000 0 0,0 75.000,39.462 A20.000,20.000 0 0,0 91.180,59.093 A20.000,20.000 0 0,0 113.540,46.962 L125.953,46.962 A30.000,30.000 0 0,0 152.347,69.344 A30.000,30.000 0 0,0 182.272,51.962 L176.651,51.962 A25.000,25.000 0 0,1 149.747,63.903 A25.000,25.000 0 0,1 130.125,41.962 L109.790,41.962 A15.000,15.000 0 0,1 93.746,54.409 A15.000,15.000 0 0,1 80.000,39.462 A15.000,15.000 0 0,1 93.746,24.514 A15.000,15.000 0 0,1 109.790,36.962 L130.125,36.962 A25.000,25.000 0 0,1 149.747,15.020 A25.000,25.000 0 0,1 176.651,26.962 L182.272,26.962 A30.000,30.000 0 0,0 152.347,9.579 A30.000,30.000 0 0,0 125.953,31.962 L113.540,31.962 ' class='s0' />
+<path d='M173.540 31.962 A20.000,20.000 0 0,0 151.180,19.830 A20.000,20.000 0 0,0 135.000,39.462 A20.000,20.000 0 0,0 151.180,59.093 A20.000,20.000 0 0,0 173.540,46.962 L190.000,46.962 L190.000,69.462 L205.000,69.462 L205.000,46.962 L220.000,46.962 L220.000,69.462 L235.000,69.462 L235.000,46.962 L250.000,46.962 L250.000,69.462 L265.000,69.462 L265.000,9.462 L250.000,9.462 L250.000,31.962 L235.000,31.962 L235.000,9.462 L220.000,9.462 L220.000,31.962 L205.000,31.962 L205.000,9.462 L190.000,9.462 L190.000,31.962 L173.540,31.962 M169.790 36.962 L195.000,36.962 L195.000,14.462 L200.000,14.462 L200.000,36.962 L225.000,36.962 L225.000,14.462 L230.000,14.462 L230.000,36.962 L255.000,36.962 L255.000,14.462 L260.000,14.462 L260.000,64.462 L255.000,64.462 L255.000,41.962 L230.000,41.962 L230.000,64.462 L225.000,64.462 L225.000,41.962 L200.000,41.962 L200.000,64.462 L195.000,64.462 L195.000,41.962 L169.790,41.962 A15.000,15.000 0 0,1 153.746,54.409 A15.000,15.000 0 0,1 140.000,39.462 A15.000,15.000 0 0,1 153.746,24.514 A15.000,15.000 0 0,1 169.790,36.962 ' class='s0' />
+
+</svg>

nextcloud/Containerfile

@@ -0,0 +1,16 @@
+ARG TAG=latest
+FROM docker.io/library/nextcloud:${TAG}
+
+RUN apt-get update \
+    && apt-get install -y supervisor \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /var/log/supervisord /var/run/supervisord 
+
+# We need to copy a file to the supervisord folder in /var/run so it exists when the container starts.
+COPY .keep /var/run/supervisord/
+
+COPY supervisord.conf /
+
+ENV NEXTCLOUD_UPDATE=1
+
+CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]

nextcloud/supervisord.conf

@@ -0,0 +1,22 @@
+[supervisord]
+nodaemon=true
+logfile=/var/log/supervisord/supervisord.log
+pidfile=/var/run/supervisord/supervisord.pid
+childlogdir=/var/log/supervisord/
+logfile_maxbytes=50MB                           ; maximum size of logfile before rotation
+logfile_backups=10                              ; number of backed up logfiles
+loglevel=error
+
+[program:apache2]
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+command=apache2-foreground
+
+[program:cron]
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+command=/cron.sh