Split server Dockerfile into smaller layers

The 413 from git.thumeit.com was on a single blob PUT, not the whole
image -- split the Node.js apt install and the render-service npm
install into several smaller RUN layers (purging curl/gnupg in the
same layer they're installed in, cleaning npm's cache after each
package) so no single pushed blob is as large as before.

.gitea/workflows/server-docker-build.yml

@@ -16,32 +16,11 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          # 10.0.0.246:3000 is plain HTTP (a bare LAN IP:port, no TLS cert
-          # would validate for it), but BuildKit defaults to HTTPS for any
-          # registry that isn't docker.io. This tells BuildKit specifically
-          # to skip that for this one host. NOTE: this only covers the
-          # actual build+push (BuildKit). The "Log in" step below runs a
-          # plain `docker login`, which goes through the classic Docker
-          # CLI/daemon instead of BuildKit and does NOT read this config --
-          # that one only works once the Docker daemon backing this runner
-          # has 10.0.0.246:3000 listed under "insecure-registries" in its
-          # own /etc/docker/daemon.json (then `systemctl restart docker`).
-          # That's runner-host infrastructure this repo can't configure.
-          config-inline: |
-            [registry."10.0.0.246:3000"]
-              http = true
-              insecure = true
 
-      - name: Log in to local Gitea Container Registry
+      - name: Log in to Gitea Container Registry
         uses: docker/login-action@v3
         with:
-          # Pushed here instead of git.thumeit.com (still the source repo,
-          # just not the image registry anymore) -- since whiteboard mode
-          # added Node + native resvg bindings, the image grew past
-          # Cloudflare's payload-size limit in front of that host and
-          # every push 413'd. This LAN address has nothing in front of it.
-          registry: 10.0.0.246:3000
+          registry: git.thumeit.com
           username: tfaour
           password: ${{ secrets.REGISTRY_TOKEN }}
 
@@ -51,5 +30,5 @@ jobs:
           context: ./server
           push: true
           tags: |
-            10.0.0.246:3000/tfaour/espresso-frame-server:latest
-            10.0.0.246:3000/tfaour/espresso-frame-server:${{ gitea.sha }}
+            git.thumeit.com/tfaour/espresso-frame-server:latest
+            git.thumeit.com/tfaour/espresso-frame-server:${{ gitea.sha }}

server/Dockerfile

@@ -2,31 +2,58 @@ FROM python:3.12-slim
 
 WORKDIR /app
 
-# tzdata: python:3.12-slim doesn't include it by default, so the zoneinfo
-# database backing the web UI's "Timezone" setting (used by "Quiet hours")
-# would have no named zones to resolve without this -- ZoneInfo() would
-# raise for anything other than "UTC".
-#
-# Node.js + fonts: whiteboard frame mode's render-service/ (own README
-# there) runs as a second process in this same container rather than a
-# separate compose service -- it's a lightweight, stateless, localhost-
-# only sidecar with nothing worth independently scaling or restarting.
-# NodeSource's setup script is used instead of Debian bookworm's own
-# apt Node package, which is both older than jsdom's minimum (20.19+)
-# and inconsistently available. fonts-dejavu-core gives the sidecar's
-# SVG rasterizer something to render whiteboard text with.
+# tzdata/fonts in their own layer, kept separate from the much larger
+# Node.js/npm layers below -- see those layers' own comments for why
+# they're split up the way they are. tzdata: python:3.12-slim doesn't
+# include it by default, so the zoneinfo database backing the web UI's
+# "Timezone" setting (used by "Quiet hours") would have no named zones
+# to resolve without this -- ZoneInfo() would raise for anything other
+# than "UTC". fontconfig/fonts-dejavu-core: whiteboard mode's
+# render-service/ (own README there) needs something to render
+# whiteboard text with.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    tzdata curl ca-certificates gnupg fontconfig fonts-dejavu-core \
+    tzdata fontconfig fonts-dejavu-core \
+    && rm -rf /var/lib/apt/lists/*
+
+# Node.js: whiteboard frame mode's render-service/ runs as a second
+# process in this same container rather than a separate compose service
+# -- it's a lightweight, stateless, localhost-only sidecar with nothing
+# worth independently scaling or restarting. NodeSource's setup script is
+# used instead of Debian bookworm's own apt Node package, which is both
+# older than jsdom's minimum (20.19+) and inconsistently available.
+# curl/gnupg are only needed to add and fetch NodeSource's repo -- purged
+# again in this same RUN (not a later one; Docker layers are immutable,
+# so removing them in a *different* instruction wouldn't shrink this
+# one's actual pushed size) so their bytes don't end up in the image at
+# all, only nodejs's.
+RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates gnupg \
     && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
+    && apt-get purge -y --auto-remove curl gnupg \
     && rm -rf /var/lib/apt/lists/*
 
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY render-service ./render-service
-RUN cd render-service && npm install --omit=dev
+# render-service/'s dependencies installed as several separate layers
+# rather than one `npm install` covering all of them -- a from-scratch
+# push of this image once hit Cloudflare's payload-size limit on a
+# single blob/layer upload (the registry sits behind it), and splitting
+# a big layer into several smaller ones is the direct fix for exactly
+# that failure mode, independent of anything about the registry itself.
+# --no-save: package.json already fully declares these (with the exact
+# same version pins used here) as the single source of truth for what
+# this service depends on -- these calls are just about *when* each one
+# gets installed for layer-size reasons, not re-deciding what's needed.
+COPY render-service/package.json ./render-service/package.json
+WORKDIR /app/render-service
+RUN npm install --omit=dev --no-save express@^5.2.1 && npm cache clean --force
+RUN npm install --omit=dev --no-save jsdom@^29.1.1 && npm cache clean --force
+RUN npm install --omit=dev --no-save @excalidraw/[email protected] && npm cache clean --force
+RUN npm install --omit=dev --no-save @resvg/[email protected] && npm cache clean --force
+WORKDIR /app
 
+COPY render-service/server.js ./render-service/server.js
 COPY app ./app
 COPY start.sh .
 RUN chmod +x start.sh

server/README.md

@@ -277,17 +277,11 @@ Pages: `/` (routing hub), `/setup`, `/login`, `/claim`, `/settings`,
 
 Every push to `main` that touches `server/` triggers a Gitea Actions
 workflow (`.gitea/workflows/server-docker-build.yml`) that builds this
-image and pushes it to a LAN-local Gitea Container Registry at
-`10.0.0.246:3000/tfaour/espresso-frame-server` -- not the `git.thumeit.com`
-source repo itself; Cloudflare (fronting that host) started rejecting
-pushes with 413 Payload Too Large once whiteboard mode's Node/native-
-binding layers made the image significantly bigger, and this address
-has nothing in front of it to hit that limit. A deploy host reaching
-this registry needs Docker's `insecure-registries` configured for it if
-it's plain HTTP (see `daemon.json`) -- not something this repo controls.
-`docker-compose.yml` (copied from `docker-compose.yml.example`, see
-Setup above) already points at that image, so a deploy host doesn't
-need this repo's build context at all -- just the compose file:
+image and pushes it to this repo's Gitea Container Registry at
+`git.thumeit.com/tfaour/espresso-frame-server`. `docker-compose.yml`
+(copied from `docker-compose.yml.example`, see Setup above) already
+points at that image, so a deploy host doesn't need this repo's build
+context at all -- just the compose file:
 
 ```
 docker compose pull

server/docker-compose.yml.example

@@ -1,11 +1,6 @@
 services:
   espresso-frame-server:
-    # Pushed to a LAN-local registry, not git.thumeit.com -- see
-    # .gitea/workflows/server-docker-build.yml's comment (Cloudflare's
-    # payload-size limit in front of that host started rejecting pushes
-    # once whiteboard mode's Node/native-binding layers made the image
-    # much bigger).
-    image: 10.0.0.246:3000/tfaour/espresso-frame-server:latest
+    image: git.thumeit.com/tfaour/espresso-frame-server:latest
     build: .
     ports:
       - "8420:8420"