install: use packages from OS rather than pip

Several reasons:

1. I am tired to of GitHub's notifications, that some package is
vulnerable, please bump version. Last days I don't have much time
to find out, that exactly problem is and should I consider to bump.

For example GitHub suggested me to bump starlette to 0.36.2,
The "patch" only forces to use non-vulnerable 'python-multipart'
package [1].

In any case I did not have to bump starlette, since I don't use
any `request.form()` method in QLLR.

2. Let's imagine, that yet another vulnerability affects QLLR.
I bump some depency. So server admin, that installed QLLR on
his VPS should also bump that dependency. But before that admin
needs to know about it. At the moment of writing I don't have
any newsletter to notify "PLEASE UPDATE ASAP". Also, if I had
that newsletter, admin is free not to subscribe.

3. Some pip packages may require to upgrade OS package or OS itself.
For example python3 -m pip install urllib3 won't work on debian stretch.
For details in [2].

4. After the incident, when some scumbag intentionally embeded malware
code in his package [3] and other politic-related events in
and around Russia and Belarus, there is trend in Russia to
use dependencies or applications with Russian vendors.

TODO:

[1] encode/starlette@13e5c26
[2] urllib3/urllib3#2168
[3] GHSA-97m3-w2cp-4xx6

This version
The mean reason, on previous
For instance there is a vulnerability in pythondependecy
TODO
1. GitHub watches requerements
TODO
2. Scumbags adding malicious code in pip packages
TODO
3. urllib3 suddenly stops working
TODO

.github/workflows/docker.yml

@@ -0,0 +1,34 @@
+name: Docker
+
+on:
+  push:
+    branches: [ master, develop ]
+  pull_request:
+    branches: [ master, develop ]
+
+jobs:
+  test:
+    strategy:
+      matrix:
+        dockerfile-suffix: [
+        "alt10", "sisyphus",
+        "buster", "bullseye", "bookworm", "trixie",
+        "focal", "jammy", "noble"
+        ]
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile.develop.${{ matrix.dockerfile-suffix }}
+          push: false
+          load: true
+          tags: test:latest
+      - name: Test
+        run: docker run --rm test:latest

Dockerfile.develop.alt10

@@ -0,0 +1,34 @@
+FROM alt:p10
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    python3-module-async-timeout \
+    python3-module-cachetools \
+    python3-module-jinja2 \
+    python3-module-pip \
+    python3-module-psycopg2 \
+    python3-module-requests \
+    python3-module-starlette \
+    python3-module-uvicorn \
+    && find /var/lib/apt/lists/ -type f -delete
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    git \
+    postgresql15-server \
+    python3-modules-sqlite3 \
+    && find /var/lib/apt/lists/ -type f -delete
+
+ENV PATH="/usr/lib/postgresql/15/bin:${PATH}"
+# take out coverage report from source directory
+ENV COVERAGE_FILE="/tmp/qllr.coverage"
+
+COPY --chown=apache . /opt/qllr
+
+WORKDIR /opt/qllr
+
+RUN python3 -m pip install --no-deps -r requirements.txt
+RUN python3 -m pip install -r requirements_dev.txt
+
+USER apache
+
+CMD ["./scripts/test"]

Dockerfile.develop.bookworm

@@ -0,0 +1,34 @@
+FROM debian:bookworm
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    python3-asyncpg \
+    python3-cachetools \
+    python3-jinja2 \
+    python3-pip \
+    python3-psycopg2 \
+    python3-requests \
+    python3-starlette \
+    python3-uvicorn \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    git \
+    postgresql-15 \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV PATH="/usr/lib/postgresql/15/bin:${PATH}"
+# take out coverage report from source directory
+ENV COVERAGE_FILE="/tmp/qllr.coverage"
+ENV PIP_BREAK_SYSTEM_PACKAGES=1
+
+COPY --chown=www-data . /opt/qllr
+
+WORKDIR /opt/qllr
+
+RUN python3 -m pip install -r requirements.txt
+RUN python3 -m pip install -r requirements_dev.txt
+
+USER www-data
+
+CMD ["./scripts/test"]

Dockerfile.develop.bullseye

@@ -0,0 +1,33 @@
+FROM debian:bullseye
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    python3-asyncpg \
+    python3-cachetools \
+    python3-jinja2 \
+    python3-pip \
+    python3-psycopg2 \
+    python3-requests \
+    python3-starlette \
+    python3-uvicorn \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    git \
+    postgresql-13 \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV PATH="/usr/lib/postgresql/13/bin:${PATH}"
+# take out coverage report from source directory
+ENV COVERAGE_FILE="/tmp/qllr.coverage"
+
+COPY --chown=www-data . /opt/qllr
+
+WORKDIR /opt/qllr
+
+RUN python3 -m pip install -r requirements.txt
+RUN python3 -m pip install -r requirements_dev.txt
+
+USER www-data
+
+CMD ["./scripts/test"]

Dockerfile.develop.buster

@@ -0,0 +1,36 @@
+FROM debian:buster
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    python3-asgiref \
+    python3-click \
+    python3-cachetools \
+    python3-h11 \
+    python3-idna \
+    python3-jinja2 \
+    python3-pip \
+    python3-psycopg2 \
+    python3-requests \
+    python3-sniffio \
+    python3-typing-extensions \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    git \
+    postgresql-11 \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV PATH="/usr/lib/postgresql/11/bin:${PATH}"
+# take out coverage report from source directory
+ENV COVERAGE_FILE="/tmp/qllr.coverage"
+
+COPY --chown=www-data . /opt/qllr
+
+WORKDIR /opt/qllr
+
+RUN python3 -m pip install -r requirements.txt
+RUN python3 -m pip install -r requirements_dev.txt
+
+USER www-data
+
+CMD ["./scripts/test"]

Dockerfile.develop.focal

@@ -0,0 +1,35 @@
+FROM ubuntu:focal
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    python3-asyncpg \
+    python3-cachetools \
+    python3-idna \
+    python3-jinja2 \
+    python3-pip \
+    python3-psycopg2 \
+    python3-requests \
+    python3-sniffio \
+    python3-typing-extensions \
+    python3-uvicorn \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    git \
+    postgresql-12 \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV PATH="/usr/lib/postgresql/12/bin:${PATH}"
+# take out coverage report from source directory
+ENV COVERAGE_FILE="/tmp/qllr.coverage"
+
+COPY --chown=www-data . /opt/qllr
+
+WORKDIR /opt/qllr
+
+RUN python3 -m pip install -r requirements.txt
+RUN python3 -m pip install -r requirements_dev.txt
+
+USER www-data
+
+CMD ["./scripts/test"]

Dockerfile.develop.jammy

@@ -0,0 +1,33 @@
+FROM ubuntu:jammy
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    python3-asyncpg \
+    python3-cachetools \
+    python3-jinja2 \
+    python3-pip \
+    python3-psycopg2 \
+    python3-requests \
+    python3-starlette \
+    python3-uvicorn \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    git \
+    postgresql-14 \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV PATH="/usr/lib/postgresql/14/bin:${PATH}"
+# take out coverage report from source directory
+ENV COVERAGE_FILE="/tmp/qllr.coverage"
+
+COPY --chown=www-data . /opt/qllr
+
+WORKDIR /opt/qllr
+
+RUN python3 -m pip install -r requirements.txt
+RUN python3 -m pip install -r requirements_dev.txt
+
+USER www-data
+
+CMD ["./scripts/test"]

Dockerfile.develop.noble

@@ -0,0 +1,34 @@
+FROM ubuntu:noble
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    python3-asyncpg \
+    python3-cachetools \
+    python3-jinja2 \
+    python3-pip \
+    python3-psycopg2 \
+    python3-requests \
+    python3-starlette \
+    python3-uvicorn \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    git \
+    postgresql-16 \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV PATH="/usr/lib/postgresql/16/bin:${PATH}"
+# take out coverage report from source directory
+ENV COVERAGE_FILE="/tmp/qllr.coverage"
+ENV PIP_BREAK_SYSTEM_PACKAGES=1
+
+COPY --chown=www-data . /opt/qllr
+
+WORKDIR /opt/qllr
+
+RUN python3 -m pip install -r requirements.txt
+RUN python3 -m pip install -r requirements_dev.txt
+
+USER www-data
+
+CMD ["./scripts/test"]

Dockerfile.develop.sisyphus

@@ -0,0 +1,34 @@
+FROM alt:sisyphus
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    python3-module-asyncpg \
+    python3-module-cachetools \
+    python3-module-jinja2 \
+    python3-module-pip \
+    python3-module-psycopg2 \
+    python3-module-requests \
+    python3-module-starlette \
+    python3-module-uvicorn \
+    && find /var/lib/apt/lists/ -type f -delete
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    git \
+    postgresql15-server \
+    python3-modules-sqlite3 \
+    && find /var/lib/apt/lists/ -type f -delete
+
+ENV PATH="/usr/lib/postgresql/15/bin:${PATH}"
+# take out coverage report from source directory
+ENV COVERAGE_FILE="/tmp/qllr.coverage"
+
+COPY --chown=apache . /opt/qllr
+
+WORKDIR /opt/qllr
+
+RUN python3 -m pip install -r requirements.txt
+RUN python3 -m pip install -r requirements_dev.txt
+
+USER apache
+
+CMD ["./scripts/test"]

Dockerfile.develop.trixie

@@ -0,0 +1,34 @@
+FROM debian:trixie
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    python3-asyncpg \
+    python3-cachetools \
+    python3-jinja2 \
+    python3-pip \
+    python3-psycopg2 \
+    python3-requests \
+    python3-starlette \
+    python3-uvicorn \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    git \
+    postgresql-16 \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV PATH="/usr/lib/postgresql/16/bin:${PATH}"
+# take out coverage report from source directory
+ENV COVERAGE_FILE="/tmp/qllr.coverage"
+ENV PIP_BREAK_SYSTEM_PACKAGES=1
+
+COPY --chown=www-data . /opt/qllr
+
+WORKDIR /opt/qllr
+
+RUN python3 -m pip install -r requirements.txt
+RUN python3 -m pip install -r requirements_dev.txt
+
+USER www-data
+
+CMD ["./scripts/test"]

Dockerfile.production

@@ -1,4 +1,18 @@
-FROM python:3.7-stretch
+FROM debian:buster
+
+RUN apt-get update && apt-get install -y \
+    python3-asgiref \
+    python3-click \
+    python3-cachetools \
+    python3-h11 \
+    python3-jinja2 \
+    python3-idna \
+    python3-pip \
+    python3-psycopg2 \
+    python3-requests \
+    python3-sniffio \
+    python3-typing-extensions \
+    && rm -rf /var/lib/apt/lists/*
 
 COPY --chown=www-data . /opt/qllr