Skip to content

Commit 28d0088

Browse files
fed1337fed1337
committed
updated readme, stripped docker image
1 parent 4dc91d6 commit 28d0088

File tree

6 files changed

+274
-299
lines changed

6 files changed

+274
-299
lines changed

‎.dockerignore‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,18 @@
11
**/__pycache__
22
.git
3+
.github
34
.idea
45
.mypy_cache
56
.pytest_cache
67
.ruff_cache
78
.venv
9+
.tmp
10+
dist
11+
docs
12+
htmlcov
13+
lemur.egg-info
814
lemur/static/dist
915
node_modules
1016
bower_components
11-
.tmp
17+
*.md
18+
*.rst

‎Dockerfile‎

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,34 +2,42 @@ FROM python:3.10-alpine3.22 AS builder
22

33
COPY --from=ghcr.io/astral-sh/uv:0.9 /uv /uvx /bin/
44

5+
ENV PATH="/root/.local/bin/:$PATH" \
6+
CFLAGS="-Os -fomit-frame-pointer" \
7+
LDFLAGS="-Wl,--strip-all"
8+
9+
WORKDIR /opt/lemur
10+
COPY . .
11+
512
RUN apk add --update --no-cache --virtual build-dependencies \
613
curl \
714
bash \
815
git \
916
tar \
1017
musl-dev \
1118
gcc \
12-
openssl-dev \
13-
libffi-dev \
14-
cyrus-sasl-dev \
1519
openldap-dev \
16-
npm
17-
18-
# Ensure the installed uv binary is on the `PATH`
19-
ENV PATH="/root/.local/bin/:$PATH"
20-
21-
WORKDIR /opt/lemur
22-
COPY . .
23-
24-
RUN uv sync --frozen --compile-bytecode
20+
binutils \
21+
npm \
22+
&& uv sync --no-dev --frozen --compile-bytecode
2523

2624
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
27-
RUN curl -sSL https://github.com/caddyserver/caddy/releases/download/v2.10.2/caddy_2.10.2_linux_amd64.tar.gz | tar xz -C /usr/bin
2825

29-
RUN npm install \
30-
&& npm run build_static \
26+
RUN curl -sSL https://github.com/caddyserver/caddy/releases/download/v2.10.2/caddy_2.10.2_linux_amd64.tar.gz | tar xz -C /usr/bin \
27+
&& npm config set cache /tmp/npm-cache \
28+
&& npm install \
29+
&& node_modules/.bin/gulp build \
3130
&& node_modules/.bin/gulp package --urlContextPath="" \
32-
&& rm -rf node_modules bower_components .tmp \
31+
&& rm -rf node_modules bower_components .tmp /tmp/npm-cache \
32+
/usr/lib/python3.10/ensurepip \
33+
/usr/lib/python3.10/idlelib \
34+
/usr/lib/python3.10/test \
35+
/usr/lib/python3.10/lib2to3 \
36+
/usr/lib/python3.10/pydoc_data \
37+
/usr/lib/python3.10/tkinter \
38+
&& strip /usr/bin/caddy \
39+
&& strip /opt/lemur/.venv/lib/python*/site-packages/**/*.so || true \
40+
&& find /opt/lemur/.venv -name "*.so" -exec strip --strip-unneeded {} + || true \
3341
&& apk del build-dependencies
3442

3543

@@ -41,13 +49,13 @@ ENV user=lemur
4149
ENV group=lemur
4250

4351
ENV PATH="/opt/lemur/.venv/bin:${PATH}" \
44-
PYTHONUNBUFFERED=1
52+
PYTHONUNBUFFERED=1 \
53+
PYTHONDONTWRITEBYTECODE=1
4554

46-
RUN apk add --update --no-cache curl libldap bash openssl
55+
RUN apk add --no-cache curl libldap bash openssl
4756

4857
RUN addgroup -S ${group} -g ${gid} \
49-
&& adduser -D -S ${user} -G ${group} -u ${uid} \
50-
&& apk add --no-cache --update curl
58+
&& adduser -D -S ${user} -G ${group} -u ${uid}
5159

5260
COPY --from=builder --chown=${uid}:${gid} /opt/lemur /opt/lemur
5361
COPY --from=builder --chown=${uid}:${gid} /usr/bin/caddy /usr/bin/caddy

‎README.md‎

Lines changed: 138 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,142 @@
11
# Lemur
22

33
Lemur manages TLS certificate creation. While not able to issue certificates itself, Lemur acts as a broker between CAs
4-
and environments providing a central portal for developers to issue TLS certificates with 'sane' defaults.
4+
and environments, providing a central portal for developers to issue TLS certificates with 'sane' defaults.
55

6-
Lemur aims to support the 3 most recent python releases which have been released for at least a year. For example, if python3.13 released last month, we'd aim to support versions 3.10, 3.11, and 3.12.
6+
Lemur aims to support three of the most recent python releases which have been released for at least a year. For
7+
example, if python 3.13 released last month, we'd aim to support versions 3.10, 3.11, and 3.12.
8+
9+
# Build & run
10+
11+
## Local
12+
13+
### Frontend
14+
15+
Build
16+
17+
```bash
18+
npm install # Install dependencies
19+
gulp build # Compiles frontend
20+
gulp package --urlContextPath="" # Sets correct base path to API endpoints
21+
```
22+
23+
Run
24+
25+
```
26+
gulp serve
27+
```
28+
29+
### Backend
30+
31+
1. Supposed you have uv installed
32+
2. Activate virtual environment: `source .venv/bin/activate`
33+
3. Install python dependencies: `uv sync`
34+
4. Review initial config in `lemur.conf.py` and adjust it to your needs
35+
5. Make sure you are inside lemur package (with the migrations folder): `cd lemur/`
36+
6. Create admin user with login `lemur` and password `password`:
37+
`uv run lemur -c /path/to/lemur.conf.py init -p password`
38+
7. Run app: `uv run lemur -c /path/to/lemur.conf.py start`
39+
8. Access via browser: http://localhost:8000
40+
41+
### Tests
42+
43+
```bash
44+
# Install test dependencies
45+
uv sync --group tests
46+
47+
# Run tests
48+
pytest
49+
50+
# With coverage
51+
pytest --cov=lemur
52+
```
53+
54+
### Docs
55+
56+
57+
## Docker
58+
59+
### Build
60+
61+
### Docker-compose
62+
63+
```bash
64+
docker compose up -d postgres # run postgres in background
65+
docker compose run --rm lemur init # initialize database (one time)
66+
docker compose up -d lemur # start the app
67+
```
68+
69+
### Running tests
70+
71+
### Docker Development
72+
73+
```bash
74+
# Start services
75+
docker-compose -f docker-compose.dev.yml up
76+
77+
# Start in background
78+
docker-compose -f docker-compose.dev.yml up -d
79+
80+
# View logs
81+
docker-compose -f docker-compose.dev.yml logs -f lemur
82+
83+
# Stop services
84+
docker-compose -f docker-compose.dev.yml down
85+
86+
# Rebuild after code changes
87+
docker-compose -f docker-compose.dev.yml up --build
88+
89+
# Run database migrations
90+
docker-compose -f docker-compose.dev.yml exec lemur lemur db upgrade
91+
92+
# Access Python shell
93+
docker-compose -f docker-compose.dev.yml exec lemur lemur shell
94+
```
95+
96+
### Hot Reload
97+
98+
The development docker-compose includes `--reload` flag for gunicorn, so Python changes are automatically detected.
99+
100+
101+
## Production environment overview
102+
103+
```
104+
┌─────────────────────────────────────────────────────┐
105+
│ Browser/Client │
106+
└─────────────────────┬───────────────────────────────┘
107+
│
108+
↓
109+
┌─────────────────────────────────────────────────────┐
110+
│ Caddy/your favorite web server (port 80/433) │
111+
│ • Serves static files (CSS, JS, images) │
112+
│ • Proxies /api/* to Flask backend │
113+
│ • SPA routing (all routes → index.html) │
114+
└─────────────────────┬───────────────────────────────┘
115+
│
116+
↓
117+
┌─────────────────────────────────────────────────────┐
118+
│ Flask + Gunicorn (port 8000) │
119+
│ • REST API endpoints (/api/1/*) │
120+
│ • Serves index.html for root route │
121+
│ • SQLAlchemy ORM │
122+
└─────────┬───────────────────────────┬───────────────┘
123+
│ │
124+
↓ ↓
125+
┌──────────────────┐ ┌──────────────────┐
126+
│ PostgreSQL │ │ Redis │
127+
│ (port 5432) │ │ (port 6379) │
128+
│ • Main database │ │ • Cache/Queue │
129+
│ • pg_trgm ext │ │ • Celery broker │
130+
└──────────────────┘ └──────────────────┘
131+
│
132+
↓
133+
┌──────────────────┐
134+
│ Celery Worker │
135+
│ • Background │
136+
│ tasks │
137+
└──────────────────┘
138+
```
139+
140+
---
141+
142+
**Happy certificate management! 🎉**

0 commit comments

Comments
 (0)