New docker files.

Split the build up into multiple stages:

 1) Hugo
 2) Minfy
 3) Serve

This means nginx is serving instead of hugo, and there are
no random apps installed in the end container.

Dockerfile

@@ -1,2 +1,46 @@
-FROM publysher/hugo
+##
+## Step 1 - add content and build with Hugo
+##
 
+FROM debian:stretch as hugo
+RUN apt-get -qq update \
+	&& DEBIAN_FRONTEND=noninteractive apt-get -qq install -y --no-install-recommends python-pygments git ca-certificates asciidoc \
+	&& rm -rf /var/lib/apt/lists/*
+
+ENV HUGO_VERSION 0.22.1
+ENV HUGO_BINARY hugo_${HUGO_VERSION}_Linux-64bit.deb
+
+ADD https://github.com/spf13/hugo/releases/download/v${HUGO_VERSION}/${HUGO_BINARY} /tmp/hugo.deb
+RUN dpkg -i /tmp/hugo.deb \
+	&& rm /tmp/hugo.deb
+
+ARG baseurl=https://www.chameth.com/
+
+USER nobody:nogroup
+ADD site /tmp/site
+RUN hugo -b $baseurl -v -s /tmp/site -d /tmp/hugo && \
+	cp /tmp/hugo/index.xml /tmp/hugo/feed.xml
+
+##
+## Step 2 - compress, minify, etc
+##
+
+FROM debian:stretch as minify
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get -qq install -y --no-install-recommends yui-compressor tidy \
+	&& rm -rf /var/lib/apt/lists/*
+
+COPY --from=hugo /tmp/hugo /tmp/site
+ADD minify.sh /tmp/minify.sh
+
+RUN chown -R nobody:nogroup /tmp/site && chmod +x /tmp/minify.sh
+USER nobody:nogroup
+RUN /tmp/minify.sh
+
+##
+## Step 3 - host!
+##
+
+FROM nginx:mainline-alpine AS nginx
+COPY --from=minify /tmp/site /usr/share/nginx/html
+ADD nginx.conf /etc/nginx/conf.d/site.conf

docker-compose.dev.yml

@@ -4,17 +4,11 @@ version: '2'
 
 services:
   hugo:
-    build: .
+    build:
+      context: .
+      args:
+        baseurl: https://dev.chameth.com/
     restart: always
     labels:
       com.chameth.vhost: 'dev.chameth.com'
       com.chameth.proxy: '1313'
-    command:
-      - hugo
-      - server
-      - --bind=0.0.0.0
-      - --port=1313
-      - --baseURL=https://dev.chameth.com/
-      - --appendPort=false
-      - --disableLiveReload
-      - --log

docker-compose.yml

@@ -9,12 +9,3 @@ services:
     labels:
       com.chameth.vhost: 'chameth.com,www.chameth.com'
       com.chameth.proxy: '1313'
-    command:
-      - hugo
-      - server
-      - --bind=0.0.0.0
-      - --port=1313
-      - --baseURL=https://www.chameth.com/
-      - --appendPort=false
-      - --disableLiveReload
-      - --log

minify.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+set -uxeo pipefail
+
+# Compress all the CSS files together
+cat /tmp/site/res/css/*.css > "/tmp/css-concatted.css"
+yui-compressor "/tmp/css-concatted.css" > "/tmp/css-combined.css"
+
+# Generate a small hash to bust caches if the file changes
+HASH=`sha256sum /tmp/css-combined.css | cut -c -10`
+
+# Replace the old CSS with the new
+mv "/tmp/css-combined.css" "/tmp/site/res/stylesheet-$HASH.css"
+rm -rf "/tmp/site/res/css"
+
+# Replace the references in the HTML, then run tidy over it
+for file in $(find /tmp/site/ -name '*.html'); do
+	sed -i "s#\"/res/css/style.css\"#\"/res/stylesheet-$HASH.css\"#g" "$file"
+	sed -i '\#"/res/css/.*.css"#d' "$file"
+
+	# Tidy exits if there are warnings, which there probably will be...
+	tidy -q -i -w 120 -m --vertical-space yes --drop-empty-elements no "$file" || true
+done

nginx.conf

@@ -0,0 +1,10 @@
+server_tokens off;
+
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+add_header Content-Security-Policy "default-src 'none'; script-src 'none'; img-src 'self' https://photos.chameth.com; style-src 'self'; font-src 'self';";
+add_header X-Frame-Options "SAMEORIGIN";
+add_header X-Content-Type-Options "nosniff";
+add_header X-XSS-Protection "1; mode=block";
+add_header Expect-CT "enforce; max-age=3600";
+
+gzip on;

site/static/res/css/lightbox.min.css

@@ -1 +1 @@
-.lb-loader,.lightbox{text-align:center;line-height:0}body:after{content:url(../images/close.png) url(../images/loading.gif) url(../images/prev.png) url(../images/next.png);display:none}.lb-dataContainer:after,.lb-outerContainer:after{content:"";clear:both}body.lb-disable-scrolling{overflow:hidden}.lightboxOverlay{position:absolute;top:0;left:0;z-index:9999;background-color:#000;filter:alpha(Opacity=80);opacity:.8;display:none}.lightbox{position:absolute;left:0;width:100%;z-index:10000;font-weight:400}.lightbox .lb-image{display:block;height:auto;max-width:inherit;border-radius:3px}.lightbox a img{border:none}.lb-outerContainer{position:relative;background-color:#fff;width:250px;height:250px;margin:0 auto;border-radius:4px}.lb-loader,.lb-nav{position:absolute;left:0}.lb-outerContainer:after{display:table}.lb-container{padding:4px}.lb-loader{top:43%;height:25%;width:100%}.lb-cancel{display:block;width:32px;height:32px;margin:0 auto;background:url(../images/loading.gif) no-repeat}.lb-nav{top:0;height:100%;width:100%;z-index:10}.lb-container>.nav{left:0}.lb-nav a{outline:0;background-image:url(data:image/gif;base64,R0lGODlhAQABAPAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)}.lb-next,.lb-prev{height:100%;cursor:pointer;display:block}.lb-nav a.lb-prev{width:34%;left:0;float:left;background:url(../images/prev.png) left 48% no-repeat;filter:alpha(Opacity=0);opacity:0;-webkit-transition:opacity .6s;-moz-transition:opacity .6s;-o-transition:opacity .6s;transition:opacity .6s}.lb-nav a.lb-prev:hover{filter:alpha(Opacity=100);opacity:1}.lb-nav a.lb-next{width:64%;right:0;float:right;background:url(../images/next.png) right 48% no-repeat;filter:alpha(Opacity=0);opacity:0;-webkit-transition:opacity .6s;-moz-transition:opacity .6s;-o-transition:opacity .6s;transition:opacity .6s}.lb-nav a.lb-next:hover{filter:alpha(Opacity=100);opacity:1}.lb-dataContainer{margin:0 auto;padding-top:5px;width:100%;-moz-border-radius-bottomleft:4px;-webkit-border-bottom-left-radius:4px;border-bottom-left-radius:4px;-moz-border-radius-bottomright:4px;-webkit-border-bottom-right-radius:4px;border-bottom-right-radius:4px}.lb-dataContainer:after{display:table}.lb-data{padding:0 4px;color:#ccc}.lb-data .lb-details{width:85%;float:left;text-align:left;line-height:1.1em}.lb-data .lb-caption{font-size:13px;font-weight:700;line-height:1em}.lb-data .lb-number{display:block;clear:left;padding-bottom:1em;font-size:12px;color:#999}.lb-data .lb-close{display:block;float:right;width:30px;height:30px;background:url(../images/close.png) top right no-repeat;text-align:right;outline:0;filter:alpha(Opacity=70);opacity:.7;-webkit-transition:opacity .2s;-moz-transition:opacity .2s;-o-transition:opacity .2s;transition:opacity .2s}.lb-data .lb-close:hover{cursor:pointer;filter:alpha(Opacity=100);opacity:1}
+.lb-loader,.lightbox{text-align:center;line-height:0}body:after{content:url(/res/images/close.png) url(/res/images/loading.gif) url(/res/images/prev.png) url(/res/images/next.png);display:none}.lb-dataContainer:after,.lb-outerContainer:after{content:"";clear:both}body.lb-disable-scrolling{overflow:hidden}.lightboxOverlay{position:absolute;top:0;left:0;z-index:9999;background-color:#000;filter:alpha(Opacity=80);opacity:.8;display:none}.lightbox{position:absolute;left:0;width:100%;z-index:10000;font-weight:400}.lightbox .lb-image{display:block;height:auto;max-width:inherit;border-radius:3px}.lightbox a img{border:none}.lb-outerContainer{position:relative;background-color:#fff;width:250px;height:250px;margin:0 auto;border-radius:4px}.lb-loader,.lb-nav{position:absolute;left:0}.lb-outerContainer:after{display:table}.lb-container{padding:4px}.lb-loader{top:43%;height:25%;width:100%}.lb-cancel{display:block;width:32px;height:32px;margin:0 auto;background:url(/res/images/loading.gif) no-repeat}.lb-nav{top:0;height:100%;width:100%;z-index:10}.lb-container>.nav{left:0}.lb-nav a{outline:0;background-image:url(data:image/gif;base64,R0lGODlhAQABAPAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)}.lb-next,.lb-prev{height:100%;cursor:pointer;display:block}.lb-nav a.lb-prev{width:34%;left:0;float:left;background:url(/res/images/prev.png) left 48% no-repeat;filter:alpha(Opacity=0);opacity:0;-webkit-transition:opacity .6s;-moz-transition:opacity .6s;-o-transition:opacity .6s;transition:opacity .6s}.lb-nav a.lb-prev:hover{filter:alpha(Opacity=100);opacity:1}.lb-nav a.lb-next{width:64%;right:0;float:right;background:url(/res/images/next.png) right 48% no-repeat;filter:alpha(Opacity=0);opacity:0;-webkit-transition:opacity .6s;-moz-transition:opacity .6s;-o-transition:opacity .6s;transition:opacity .6s}.lb-nav a.lb-next:hover{filter:alpha(Opacity=100);opacity:1}.lb-dataContainer{margin:0 auto;padding-top:5px;width:100%;-moz-border-radius-bottomleft:4px;-webkit-border-bottom-left-radius:4px;border-bottom-left-radius:4px;-moz-border-radius-bottomright:4px;-webkit-border-bottom-right-radius:4px;border-bottom-right-radius:4px}.lb-dataContainer:after{display:table}.lb-data{padding:0 4px;color:#ccc}.lb-data .lb-details{width:85%;float:left;text-align:left;line-height:1.1em}.lb-data .lb-caption{font-size:13px;font-weight:700;line-height:1em}.lb-data .lb-number{display:block;clear:left;padding-bottom:1em;font-size:12px;color:#999}.lb-data .lb-close{display:block;float:right;width:30px;height:30px;background:url(/res/images/close.png) top right no-repeat;text-align:right;outline:0;filter:alpha(Opacity=70);opacity:.7;-webkit-transition:opacity .2s;-moz-transition:opacity .2s;-o-transition:opacity .2s;transition:opacity .2s}.lb-data .lb-close:hover{cursor:pointer;filter:alpha(Opacity=100);opacity:1}

site/static/res/css/style.css

@@ -1,9 +1,7 @@
-@import url("font-awesome.min.css");
-
 @font-face {
     font-family: 'Aileron Regular';
-    src: url('../fonts/aileron-regular-webfont.woff2') format('woff2'),
-         url('../fonts/aileron-regular-webfont.woff') format('woff');
+    src: url('/res/fonts/aileron-regular-webfont.woff2') format('woff2'),
+         url('/res/fonts/aileron-regular-webfont.woff') format('woff');
     font-weight: normal;
     font-style: normal;
 
@@ -11,12 +9,12 @@
 
 @font-face {
     font-family: 'League Spartan';
-    src: url('../fonts/leaguespartan-bold.eot');
-    src: url('../fonts/leaguespartan-bold.eot?#iefix') format('embedded-opentype'),
-         url('../fonts/leaguespartan-bold.woff2') format('woff2'),
-         url('../fonts/leaguespartan-bold.woff') format('woff'),
-         url('../fonts/leaguespartan-bold.ttf') format('truetype'),
-         url('../fonts/leaguespartan-bold.svg#league_spartanbold') format('svg');
+    src: url('/res/fonts/leaguespartan-bold.eot');
+    src: url('/res/fonts/leaguespartan-bold.eot?#iefix') format('embedded-opentype'),
+         url('/res/fonts/leaguespartan-bold.woff2') format('woff2'),
+         url('/res/fonts/leaguespartan-bold.woff') format('woff'),
+         url('/res/fonts/leaguespartan-bold.ttf') format('truetype'),
+         url('/res/fonts/leaguespartan-bold.svg#league_spartanbold') format('svg');
     font-weight: bold;
     font-style: normal;
 }
@@ -2079,7 +2077,7 @@ article img {
       -webkit-transition: opacity 0.2s ease-in-out;
       -ms-transition: opacity 0.2s ease-in-out;
       transition: opacity 0.2s ease-in-out;
-      background: url("../images/overlay.png");
+      background: url("/res/images/overlay.png");
       border-radius: 0.35em;
       content: '';
       display: block;
@@ -2124,7 +2122,7 @@ article img {
       }
 
       .image.thumb:hover:before {
-        background: url("../images/overlay.png"), url("../images/overlay.png");
+        background: url("/res/images/overlay.png"), url("/res/images/overlay.png");
         opacity: 1.0;
       }
 
@@ -2566,7 +2564,7 @@ article img {
     justify-content: space-between;
     background-color: #1f1815;
     background-attachment: scroll,                fixed;
-    background-image: url("../images/overlay.png"), url("../images/background.jpg");
+    background-image: url("/res/images/overlay.png"), url("/res/images/background.jpg");
     background-position: top left,              top left;
     background-repeat: repeat,                no-repeat;
     background-size: auto,                auto 100%;
@@ -3066,7 +3064,7 @@ article img {
       #footer {
         background-attachment: scroll;
         background-color: #1f1815;
-        background-image: url("../images/overlay.png"), url("../images/background.jpg");
+        background-image: url("/res/images/overlay.png"), url("/res/images/background.jpg");
         background-position: top left,            bottom center;
         background-repeat: repeat,              no-repeat;
         background-size: auto,              cover;