From d898bb7cb237f0c782839a9115db15755d53cc4e Mon Sep 17 00:00:00 2001
From: Mustafa Abdul-Kader <mustafa@muszr.me>
Date: Tue, 13 Oct 2026 09:44:35 -0400
Subject: [PATCH] ci: geoauth has its own Dockerfile and pipeline (tag
 geoauth-vX.Y.Z); remove the old Listdrop apko/abuild path

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KUijbArLRyCRTa8TZm4qsG
---
 APKBUILD          | 26 --------------------------
 Dockerfile        | 35 +++++++++++++++++++++++++++++++++++
 geoauth.apko.yaml | 21 ---------------------
 3 files changed, 35 insertions(+), 47 deletions(-)
 delete mode 100644 APKBUILD
 create mode 100644 Dockerfile
 delete mode 100644 geoauth.apko.yaml

diff --git a/APKBUILD b/APKBUILD
deleted file mode 100644
index ce8ff79..0000000
--- a/APKBUILD
+++ /dev/null
@@ -1,26 +0,0 @@
-# Maintainer: srv <mustafa@muszr.me>
-# geoauth: Traefik forward-auth by country from the RIR allocation files (see main.go). Static Go binary, no dependencies.
-pkgname=geoauth
-pkgver=0.1.0
-pkgrel=0
-pkgdesc="Forward-auth that admits clients by country"
-url="https://listdrop.muszr.me"
-arch="x86_64"
-license="MIT"
-makedepends="go"
-options="net"
-source="main.go main_test.go go.mod"
-builddir="$srcdir"
-
-build() {
-	CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o geoauth .
-}
-
-check() {
-	CGO_ENABLED=0 go test ./...
-}
-
-package() {
-	install -Dm755 geoauth "$pkgdir"/usr/bin/geoauth
-}
-sha512sums=""
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..44f5d27
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1
+#
+# geoauth: the country forward-auth for the public ingress. Built by the Tekton pipeline `geoauth` (k8s/clusters/dev/ci/pipeline-geoauth.yaml)
+# when a tag geoauth-vX.Y.Z is pushed to srv; the image is registry.home.muszr.me/geoauth:vX.Y.Z.
+#
+#   checks   go vet and go test (fails the build)
+#   geoauth  the runtime image: a static binary and the CA bundle in scratch, no shell, no package manager, uid/gid 65532
+#
+#   docker build --target geoauth -t geoauth images/geoauth        (any target works locally too)
+
+ARG ALPINE=alpine:edge
+
+FROM ${ALPINE} AS build
+RUN apk add --no-cache go >/dev/null
+WORKDIR /src
+COPY go.mod main.go main_test.go ./
+ENV CGO_ENABLED=0 GOFLAGS=-trimpath
+
+FROM build AS checks
+RUN go vet ./... && go test ./...
+
+FROM build AS compile
+RUN go build -ldflags "-s -w" -o /out/geoauth .
+
+FROM ${ALPINE} AS rootfs
+RUN apk add --root /rootfs --initdb --no-cache --no-scripts --keys-dir /etc/apk/keys --repositories-file /etc/apk/repositories ca-certificates-bundle >/dev/null \
+ && rm -rf /rootfs/lib/apk /rootfs/var/cache /rootfs/etc/apk /rootfs/sbin/apk \
+ && echo "geoauth:x:65532:65532::/:/sbin/nologin" > /rootfs/etc/passwd \
+ && echo "geoauth:x:65532:" > /rootfs/etc/group
+
+FROM scratch AS geoauth
+COPY --from=rootfs /rootfs/ /
+COPY --from=compile /out/geoauth /usr/bin/geoauth
+USER 65532:65532
+ENTRYPOINT ["/usr/bin/geoauth"]
diff --git a/geoauth.apko.yaml b/geoauth.apko.yaml
deleted file mode 100644
index 9de9d13..0000000
--- a/geoauth.apko.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-# geoauth: static Go binary; CA bundle for the HTTPS fetches. No shell, no package manager.
-contents:
-  repositories:
-    - https://dl-cdn.alpinelinux.org/alpine/edge/main
-    - https://dl-cdn.alpinelinux.org/alpine/edge/community
-  keyring:
-    - https://alpinelinux.org/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub
-    - https://alpinelinux.org/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub
-  packages:
-    - ca-certificates-bundle
-    - musl                       # abuild's Go build is dynamically linked (no libc otherwise in a distroless image)
-    - geoauth                    # ours (images/geoauth/APKBUILD)
-accounts:
-  groups:
-    - {groupname: geoauth, gid: 65532}
-  users:
-    - {username: geoauth, uid: 65532, gid: 65532}
-  run-as: 65532
-entrypoint:
-  command: /usr/bin/geoauth
-archs: [x86_64]
-- 
2.56.0