From 3012e5b994f413687ac5adf57bc5640dcdd2d4dd Mon Sep 17 00:00:00 2001
From: rorapp <robert.rapp@mindboost.team>
Date: Thu, 23 Oct 2025 11:06:52 +0200
Subject: [PATCH] improve deployment process

---
 Jenkinsfile              | 29 ++++++++++++++++-------------
 entrypoint.sh            | 28 ++++++++++++++++++++++++++++
 id.env                   |  5 +++--
 scripts/publish-image.sh | 27 +++++++++++++++++++--------
 4 files changed, 66 insertions(+), 23 deletions(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index 74259cb..5b11505 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -15,18 +15,7 @@ pipeline {
             }
         }
 
-        stage('Build image') {
-            steps {
-                sh """
-                    docker build \
-                      --file kirby/Dockerfile \
-                      --tag ${IMAGE_REF} \
-                      kirby
-                """
-            }
-        }
-
-        stage('Push image') {
+        stage('Build & Push image') {
             steps {
                 withCredentials([usernamePassword(
                     credentialsId: 'gitea-container-registry',
@@ -34,9 +23,23 @@ pipeline {
                     passwordVariable: 'REGISTRY_PASSWORD'
                 )]) {
                     sh """
+                        if ! docker buildx inspect jenkins-builder >/dev/null 2>&1; then
+                          docker buildx create --name jenkins-builder --use
+                        else
+                          docker buildx use jenkins-builder
+                        fi
+                        docker buildx inspect --bootstrap
+
                         echo "${REGISTRY_PASSWORD}" | docker login ${REGISTRY_HOST} \
                             --username "${REGISTRY_USER}" --password-stdin
-                        docker push ${IMAGE_REF}
+
+                        docker buildx build \
+                          --platform linux/amd64 \
+                          --file Dockerfile \
+                          --tag ${IMAGE_REF} \
+                          --push \
+                          .
+
                         docker logout ${REGISTRY_HOST}
                     """
                 }
diff --git a/entrypoint.sh b/entrypoint.sh
index f66eed3..1648147 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -3,8 +3,36 @@
 set -euo pipefail
 
 USER_ID="${USERID:-}"
+GROUP_ID="${GROUPID:-}"
+
+if [[ -n "${GROUP_ID}" ]]; then
+  CURRENT_GID="$(getent group kirbygroup | cut -d: -f3 || true)"
+  if [[ "${GROUP_ID}" != "${CURRENT_GID}" ]]; then
+    groupmod --gid "${GROUP_ID}" kirbygroup
+  fi
+fi
+
 if [[ -n "${USER_ID}" && "${USER_ID}" != "$(id -u www-data)" ]]; then
   usermod --uid "${USER_ID}" www-data
 fi
 
+if [[ -n "${GROUP_ID}" ]]; then
+  usermod --gid "${GROUP_ID}" www-data
+fi
+
+WRITABLE_DIRS=(
+  "/var/www/html/content"
+  "/var/www/html/media"
+  "/var/www/html/site/accounts"
+  "/var/www/html/site/cache"
+  "/var/www/html/site/logs"
+  "/var/www/html/storage"
+)
+
+for dir in "${WRITABLE_DIRS[@]}"; do
+  mkdir -p "${dir}"
+  chown -R www-data:kirbygroup "${dir}"
+  chmod -R g+rwX "${dir}"
+done
+
 exec "$@"
diff --git a/id.env b/id.env
index 840b83a..311bc2d 100644
--- a/id.env
+++ b/id.env
@@ -1,2 +1,3 @@
-# Match the container's www-data user to your local user ID
-USERID=1111
+# Match the container's www-data user/group to your local IDs
+USERID=1004
+GROUPID=1003
\ No newline at end of file
diff --git a/scripts/publish-image.sh b/scripts/publish-image.sh
index 28ddd8b..945130f 100755
--- a/scripts/publish-image.sh
+++ b/scripts/publish-image.sh
@@ -21,20 +21,23 @@ if ! command -v docker >/dev/null 2>&1; then
     exit 1
 fi
 
+if ! docker buildx version >/dev/null 2>&1; then
+    echo "Docker Buildx is required but not available. Please install/enable it in Docker Desktop or via the CLI plugin." >&2
+    exit 1
+fi
+
 read -rp "Image tag [${DEFAULT_TAG}]: " INPUT_TAG
 IMAGE_TAG="${INPUT_TAG:-$DEFAULT_TAG}"
 IMAGE_REF="${REGISTRY_HOST}/${IMAGE_NAME}:${IMAGE_TAG}"
 
+DEFAULT_PLATFORMS="linux/amd64"
+read -rp "Target platforms [${DEFAULT_PLATFORMS}]: " INPUT_PLATFORMS
+TARGET_PLATFORMS="${INPUT_PLATFORMS:-$DEFAULT_PLATFORMS}"
+
 read -rp "Registry username: " REGISTRY_USER
 read -rsp "Registry password or token: " REGISTRY_PASSWORD
 echo
 
-echo "Building image ${IMAGE_REF} ..."
-docker build \
-    --file "${DOCKERFILE_PATH}" \
-    --tag "${IMAGE_REF}" \
-    "${DOCKER_CONTEXT}"
-
 echo "Logging into ${REGISTRY_HOST} ..."
 echo "${REGISTRY_PASSWORD}" | docker login "${REGISTRY_HOST}" \
     --username "${REGISTRY_USER}" \
@@ -45,7 +48,15 @@ cleanup() {
 }
 trap cleanup EXIT
 
-echo "Pushing ${IMAGE_REF} ..."
-docker push "${IMAGE_REF}"
+echo "Bootstrapping buildx builder ..."
+docker buildx inspect --bootstrap >/dev/null
+
+echo "Building and pushing ${IMAGE_REF} for ${TARGET_PLATFORMS} ..."
+docker buildx build \
+    --platform "${TARGET_PLATFORMS}" \
+    --file "${DOCKERFILE_PATH}" \
+    --tag "${IMAGE_REF}" \
+    --push \
+    "${DOCKER_CONTEXT}"
 
 echo "Image pushed successfully."