[enh] container: custom certificates (#5238)

Let container instance administrators to add custom certificates:

  https://docs.searxng.org/admin/installation-docker.html#custom-certificates

Closes https://github.com/searxng/searxng/issues/5206

container/base-builder.yml

@@ -16,6 +16,7 @@ work-dir: /usr/local/searxng/
 
 environment:
   PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+  SSL_CERT_DIR: /etc/ssl/certs
   SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
   HISTFILE: /dev/null
 

container/base.yml

@@ -3,6 +3,7 @@ contents:
     - https://dl-cdn.alpinelinux.org/alpine/edge/main
   packages:
     - alpine-baselayout
+    - ca-certificates
     - ca-certificates-bundle
     - musl-locales
     - musl-locales-lang
@@ -27,6 +28,7 @@ accounts:
 
 environment:
   PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+  SSL_CERT_DIR: /etc/ssl/certs
   SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
   HISTFILE: /dev/null
   CONFIG_PATH: /etc/searxng

container/dist.dockerfile

@@ -1,10 +1,11 @@
-FROM ghcr.io/searxng/base:searxng AS dist
-
 ARG CONTAINER_IMAGE_ORGANIZATION="searxng"
 ARG CONTAINER_IMAGE_NAME="searxng"
 
-COPY --chown=searxng:searxng --from=localhost/$CONTAINER_IMAGE_ORGANIZATION/$CONTAINER_IMAGE_NAME:builder /usr/local/searxng/.venv/ ./.venv/
+FROM localhost/$CONTAINER_IMAGE_ORGANIZATION/$CONTAINER_IMAGE_NAME:builder AS builder
-COPY --chown=searxng:searxng --from=localhost/$CONTAINER_IMAGE_ORGANIZATION/$CONTAINER_IMAGE_NAME:builder /usr/local/searxng/searx/ ./searx/
+FROM ghcr.io/searxng/base:searxng AS dist
+
+COPY --chown=searxng:searxng --from=builder /usr/local/searxng/.venv/ ./.venv/
+COPY --chown=searxng:searxng --from=builder /usr/local/searxng/searx/ ./searx/
 COPY --chown=searxng:searxng ./container/ ./
 #COPY --chown=searxng:searxng ./searx/version_frozen.py ./searx/
 

container/entrypoint.sh

@@ -127,4 +127,6 @@ volume_handler "$DATA_PATH"
 # Check for files
 config_handler "$SEARXNG_SETTINGS_PATH" "/usr/local/searxng/searx/settings.yml"
 
+update-ca-certificates
+
 exec /usr/local/searxng/.venv/bin/granian searx.webapp:app

docs/admin/installation-docker.rst

@@ -165,6 +165,17 @@ Container internal paths (don't modify unless you know what you're doing):
 - ``$SEARXNG_SETTINGS_PATH``: Path to the SearXNG settings file (default: ``$CONFIG_PATH/settings.yml``)
 - ``$DATA_PATH``: Path to the SearXNG data directory (default: ``/var/cache/searxng``)
 
+.. _Container custom certificates:
+
+Custom certificates
+===================
+
+You can mount ``/usr/local/share/ca-certificates/`` folder to add/remove
+additional certificates as needed.
+
+They will be available on container (re)start or when running
+``update-ca-certificates`` in the container shell.
+
 .. _Container custom images:
 
 Custom images

utils/lib_sxng_container.sh

@@ -62,6 +62,10 @@ container.build() {
     esac
     info_msg "Selected platform: $platform"
 
+    if [ "$container_engine" = "docker" ] && ! docker buildx version &>/dev/null; then
+        die 42 "docker buildx is not installed: https://docs.docker.com/go/buildx/"
+    fi
+
     pyenv.install
 
     (