removing sast - updated dockerfile for best practies

Reviewed-on: #3

.gitea/workflows/docker-build.yaml

@@ -0,0 +1,86 @@
+name: Build and Push Docker Image
+
+on:
+  push:
+    branches:
+      - "**"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    # permissions:  
+    #   contents: read          # Required to checkout and read repo files
+    #   security-events: write  # Required to upload SARIF files to Security tab
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # - name: Run Trivy vulnerability scanner in repo mode
+      #   uses: aquasecurity/trivy-action@v0.36.0
+      #   with:
+      #     scan-type: 'fs'
+      #     ignore-unfixed: true
+      #     format: 'sarif'
+      #     output: 'trivy-results.sarif'
+      #     severity: 'CRITICAL,HIGH'
+
+      # - name: Upload Trivy scan results to GitHub Security tab
+      #   uses: github/codeql-action/upload-sarif@v4
+      #   with:
+      #     sarif_file: 'trivy-results.sarif'
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Compute image tag
+        id: tag
+        run: |
+          BRANCH="${{ gitea.ref_name }}"
+
+          if [ "$BRANCH" = "main" ]; then
+            TAG="latest"
+          elif [[ "$BRANCH" == v* ]]; then
+            TAG="$BRANCH"
+          else
+            TAG="test"
+          fi
+
+          echo "tag=$TAG" >> $GITHUB_OUTPUT
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: blinkfink182/qbt-gluetun-portmgr:${{ steps.tag.outputs.tag }}
+
+      - name: Notify Apprise (success)
+        if: success()
+        run: |
+          curl -X POST \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"tags\": \"all\",
+              \"title\": \"Gitea Build Succeeded\",
+              \"body\": \"Repo: ${{ gitea.repository }}\\nBranch: ${{ gitea.ref_name }}\\nImage tag built successfully\"
+            }" \
+            http://10.47.0.213:4444/notify/926263506803e21d72e382edd0caf3fb510a9629d860601dfb79506b5758c133
+
+      - name: Notify Apprise (failure)
+        if: failure()
+        run: |
+          curl -X POST \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"tags\": \"all\",
+              \"title\": \"Gitea Build Failed\",
+              \"body\": \"Repo: ${{ gitea.repository }}\\nBranch: ${{ gitea.ref_name }}\\nCheck logs in Gitea\"
+            }" \
+            http://10.47.0.213:4444/notify/926263506803e21d72e382edd0caf3fb510a9629d860601dfb79506b5758c133

Dockerfile

@@ -1,11 +1,13 @@
 FROM mcr.microsoft.com/powershell
 
+USER 1000:1000
+
 ENV SCHEDULE=60 
 ENV GLUETUNFORWARDEDPORTFILE="/tmp/forwarded_port"
 
 VOLUME /tmp
 
 WORKDIR /data
-ADD ["Start-QBTGluetunPortMgr.ps1", "/data/"]
+COPY ["Start-QBTGluetunPortMgr.ps1", "/data/"]
 
 ENTRYPOINT ["pwsh", "-Command", "/data/Start-QBTGluetunPortMgr.ps1"]

Start-QBTGluetunPortMgr.ps1

@@ -5,6 +5,58 @@
 [string] $qbtUser = $ENV:QBTUSER
 [string] $qbtPassword = $ENV:QBTPASSWORD
 [string] $notificationWebhookURL = $ENV:NOTIFICATIONWEBHOOKURL
+[string] $discordWebhookURL = $ENV:DISCORDWEBHOOKURL
+[string] $appriseWebhookURL = $ENV:APPRISEWEBHOOKURL
+[string] $appriseWebhookTag = $ENV:APPRISEWEBHOOKTAG
+
+
+function Send-Notification
+{
+    param(
+        # Content of the notification
+        [Parameter(Mandatory=$true)]
+        [string]
+        $content
+    )
+
+    if ($notificationWebhookURL -or $discordWebhookURL)
+    {
+        if ($discordWebhookURL) { $notificationWebhookURL = $discordWebhookURL }
+        $headers = @{
+            "Content-Type"="application/json"
+        }
+        $body = @{
+            content=$content
+            # content="QBitTorrent Listening Port updated to $gluetunForwardedPort"
+        }
+        $json = $body | ConvertTo-Json
+        try {
+            Invoke-WebRequest -URI $notificationWebhookURL -Method post -Body $json -Headers $headers
+        }
+        catch {
+            Write-Host "Notification Error Encountered: $($global:Error[0])"
+        }
+    }
+    elseif ($appriseWebhookURL)
+    {
+        $headers = @{
+            "Content-Type"="application/json"
+        }
+        $body = @{
+            title="QBitTorrent Port Manager"
+            body=$content
+            # body="QBitTorrent Listening Port updated to $gluetunForwardedPort"
+            tags="$appriseWebhookTag"
+        }
+        $json = $body | ConvertTo-Json
+        try {
+            Invoke-WebRequest -URI $appriseWebhookURL -Method post -Body $json -Headers $headers
+        }
+        catch {
+            Write-Host "Notification Error Encountered: $($global:Error[0])"
+        }
+    }
+}
 
 while ($true)
 {
@@ -18,9 +70,9 @@ while ($true)
         username = $qbtUser
         password = $qbtPassword
     }
+    try {
         $qbtSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
         $qbtResponse = Invoke-WebRequest -Uri "http://$($qbtHost):$($qbtPort)/api/v2/auth/login" -WebSession $qbtSession -Method POST -Headers $qbtHeaders -Body $qbtBody
-    
         $qbtQueryResponse = Invoke-WebRequest -Uri "http://$($qbtHost):$($qbtPort)/api/v2/app/preferences" -WebSession $qbtSession -Method GET
         $qbtListenPort = (ConvertFrom-Json $qbtQueryResponse.Content).listen_port
         Write-Host "Current QBT Listening port: $qbtListenPort"
@@ -33,17 +85,12 @@ while ($true)
         {
             $qbtPortChangeBody = 'json={"listen_port":' + $gluetunForwardedPort + '}'
             $qbtPortChangeResponse = Invoke-WebRequest -Uri "http://$($qbtHost):$($qbtPort)/api/v2/app/setPreferences" -WebSession $qbtSession -Method POST -Headers $qbtHeaders -Body $qbtPortChangeBody
-        if ($notificationWebhookURL)
+            Send-Notification -content "QBitTorrent Listening Port updated to $gluetunForwardedPort"
-        {
-            $headers = @{
-                "Content-Type"="application/json"
         }
-            $body = @{
-                content="QBitTorrent Listening Port updated to $gluetunForwardedPort"
-            }
-            $json = $body | ConvertTo-Json
-            Invoke-WebRequest -URI $notificationWebhookURL -Method post -Body $json -Headers $headers
     }
+    catch {
+        Write-Host "Error encountered: $($global:Error[0])"
+        Send-Notification -content "Error encountered: $($global:Error[0])"
     }
     Write-Host "Sleeping for $schedule minutes..."
     Start-Sleep ($schedule * 60)

docker-compose.yaml

@@ -10,6 +10,9 @@ services:
       - QBTPORT=8787 # qbittorrent port
       - QBTUSER=admin # qbittorrent webUI username
       - QBTPASSWORD=adminpass # qbittorrent webUI password
-      - NOTIFICATIONWEBHOOKURL=https://discord.com/api/webhooks/<webhookURL> # discord notification wehook URL
+      #- NOTIFICATIONWEBHOOKURL=https://discord.com/api/webhooks/<webhookURL> # DEPRECATED discord notification wehook URL
+      #- DISCORDWEBHOOKURL=https://discord.com/api/webhooks/<webhookURL> # discord notification wehook URL
+      #- APPRISEWEBHOOKURL=https://apprisehost/notify/config # apprise notification url
+      #- APPRISEWEBHOOKTAG=all # apprise notification tag
     volumes:
       - C:/Docker/qbittorrent/gluetun/tmp:/tmp # REQUIRED: Path to where the 'forwarded_port' file from gluetun is stored