Migrate CKAN DataPusher to s6 and add selfsigned cert injection

ckan-datapusher/Dockerfile

@@ -25,8 +25,9 @@ RUN \
  && find /srv/ckan-datapusher/src -name '.git*' -exec rm -rf {} + \
  && rm -rf /root/.cache
 
+COPY docker/ /
+
 VOLUME ["/etc/ckan-datapusher", "/srv/ckan-datapusher/data"]
 EXPOSE 8080
 
-USER ckandp
-CMD ["uwsgi", "--plugin", "python", "--http-socket", "0.0.0.0:8080", "--wsgi-file", "/etc/ckan-datapusher/datapusher.wsgi", "--enable-threads"]
+CMD ["s6-svscan", "/etc/services.d"]

ckan-datapusher/docker/bin/add-ca-cert

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+/bin/cat /etc/ssl/services.pem >>/usr/lib/python2.7/site-packages/requests/cacert.pem
+/bin/cat /etc/ssl/services.pem >>/usr/lib/python2.7/site-packages/certifi/cacert.pem

ckan-datapusher/docker/etc/services.d/.s6-svscan/finish

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+/bin/true

ckan-datapusher/docker/etc/services.d/ckan-datapusher/run

@@ -0,0 +1,6 @@
+#!/bin/execlineb -P
+
+fdmove -c 2 1
+foreground { /bin/add-ca-cert }
+s6-setuidgid 8004:8004
+/usr/sbin/uwsgi --plugin python --http-socket 0.0.0.0:8080 --wsgi-file /etc/ckan-datapusher/datapusher.wsgi --enable-threads

ckan-datapusher/etc/init.d/ckan-datapusher

@@ -10,6 +10,7 @@ start() {
 	/usr/bin/docker run -d --rm \
 	--name ckan-datapusher \
 	-h ckan-datapusher \
+	-v /etc/ssl/services.pem:/etc/ssl/services.pem \
 	-v /srv/ckan-datapusher/conf:/etc/ckan-datapusher \
 	-v /srv/ckan-datapusher/data:/srv/ckan-datapusher/data \
 	ckan-datapusher