Initial: Angie 1.11.3 OCI image build for aarch64

Builds via dockerTools.streamLayeredImage from nixpkgs unstable's pkgs.angie. Woodpecker pipeline pushes to git.oleks.space/oleks/angie with both <version>-arm64 and latest-arm64 tags. Used by the kotkanagrilli.fi staging Helm chart on the kotkan node (arm64) to replace the upstream amd64-only runalsh/angie image.
2026-05-09 22:18:57 +03:00
commit a55f3823ef
5 changed files with 194 additions and 0 deletions
@@ -0,0 +1,72 @@
+{
+  description = "Angie web server (aarch64) — OCI image for Gitea registry";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      system = "aarch64-linux";
+      pkgs = import nixpkgs { inherit system; };
+
+      # nixpkgs ships angie compiled against `--prefix=/etc/angie` and
+      # `--http-log-path=/var/log/angie/access.log`; the package's `bin/angie`
+      # already knows where to look for its main config (/etc/angie/angie.conf).
+      angie = pkgs.angie;
+
+      # Stock main config: turns on http and includes whatever drop-ins the
+      # chart mounts at /etc/angie/http.d/*.conf — same idiom as the alpine
+      # nginx image's /etc/nginx/conf.d/.
+      mainConf = pkgs.writeText "angie.conf" ''
+        worker_processes auto;
+        error_log /var/log/angie/error.log notice;
+        pid /run/angie.pid;
+
+        events { worker_connections 1024; }
+
+        http {
+            include       ${angie}/conf/mime.types;
+            default_type  application/octet-stream;
+
+            sendfile on;
+            keepalive_timeout 65;
+
+            access_log /var/log/angie/access.log;
+
+            include /etc/angie/http.d/*.conf;
+        }
+      '';
+
+      image = pkgs.dockerTools.streamLayeredImage {
+        name = "angie";
+        tag = angie.version;
+        contents = with pkgs; [
+          angie
+          cacert
+          dockerTools.fakeNss
+          coreutils
+          bash
+        ];
+        # Writable runtime dirs — image filesystem is otherwise read-only.
+        extraCommands = ''
+          mkdir -p var/log/angie var/cache/angie var/lib/angie run tmp etc/angie/http.d
+          chmod 1777 tmp
+          cp ${mainConf} etc/angie/angie.conf
+        '';
+        config = {
+          Entrypoint = [ "${angie}/bin/angie" ];
+          Cmd = [ "-g" "daemon off;" ];
+          ExposedPorts = { "80/tcp" = { }; };
+          WorkingDir = "/etc/angie";
+        };
+      };
+    in
+    {
+      packages.${system} = {
+        default = image;
+        # Plain text file containing just the version string — read by CI to
+        # produce the registry tag without re-evaluating the flake.
+        version = pkgs.writeText "angie-version" angie.version;
+      };
+    };
+}