bitdeals
1824e741bb
Build docker image and push to registry.bitdeals.org / main-build-job (push) Successful in 30s
ea8d5e0pinned `FROM bitnami/haproxy` by digest after the base broke the public door twice in three days. That is not the trade this project wants: there are no version tags to pin to, only `latest`, so a pin means a digest raised by hand for every security update of the base. What actually catches a bad base is the testnet stand. Watchtower there picks up each rebuild within seconds, which is precisely how both incidents surfaced — loudly, on a stand, and not in production. Production runs no Watchtower and is updated by hand, so a base that breaks the door is seen here first and never reaches it unattended. The `ENV OPENSSL_FIPS=no` removal fromea8d5e0stays. Restoring it would restore this morning's outage: on the current base "no" is what stops HAProxy loading an ECDSA certificate. The comment above FROM keeps both measurements, because the right value depends on the base and the next base may want the other one — that is the first thing to check the next time this image will not start. Verified on testnet2 with the image built from this file: config check clean against the project config and the live certificate, curl 200, TLSv1.3.