John O'Keefe
ab4bddc784
The db service mounted ./uploads:/app/uploads, which Postgres has never used and nothing in the repo relies on: no SQL COPY TO/pg_dump path, no doc/test reference to an uploads path inside the db container (the only /app/uploads mentions in TEST_DATA.md are the app/test containers), and the backup scan is app-side. Forensics: the mount was introduced by accident in6ebe9749("Simplify docker-compose healthcheck configuration"), which incidentally REPLACED the db service's volumes with the app service's uploads mount. The follow-up91456d11("restore essential database configuration") restored postgres_data and the schema-init mount but nobody noticed the stray uploads mount riding along, and it has survived every compose refactor since. The tests service in docker-compose.dev.yml keeps its own ./uploads mount — that is the app-like test runner (TEST_UPLOAD_PATH=/app/uploads) and is legitimate. The dev db inherits its volumes from the base file, so it is fixed automatically.
116 lines
4.0 KiB
YAML
116 lines
4.0 KiB
YAML
services:
|
|
# PostgreSQL Database
|
|
db:
|
|
image: postgres:15-alpine
|
|
container_name: bookhoard_db
|
|
environment:
|
|
POSTGRES_DB: bookhoard
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: ${DBPASS}
|
|
# PGPORT makes Postgres listen on DB_PORT (kept in sync with the host mapping + app's DATABASE_PORT)
|
|
PGPORT: ${DB_PORT:-5432}
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
- ./database/schema:/docker-entrypoint-initdb.d
|
|
ports:
|
|
- "127.0.0.1:${DB_PORT:-5432}:${DB_PORT:-5432}"
|
|
- "[::1]:${DB_PORT:-5432}:${DB_PORT:-5432}"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
env_file:
|
|
- .env
|
|
|
|
# One-shot bootstrap: creates the bookhoard_srv runtime role and
|
|
# transfers object ownership to it (RLS prerequisite). Idempotent —
|
|
# safe on every startup; the app waits for its success. Passwords
|
|
# accept inline values or .env, like the rest of this file.
|
|
db-init:
|
|
image: postgres:15-alpine
|
|
container_name: bookhoard_db_init
|
|
environment:
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_DB: bookhoard
|
|
PGHOST: db
|
|
DBPASS: ${DBPASS}
|
|
DBSRVPASS: ${DBSRVPASS}
|
|
volumes:
|
|
- ./database/schema/z_rls_role.sh:/z_rls_role.sh:ro
|
|
command: bash /z_rls_role.sh
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
restart: "no"
|
|
|
|
# Bookhoard Application
|
|
# In production this image is pulled from the Gitea container registry.
|
|
# Override IMAGE_TAG in .env to pin or rollback a specific version (defaults to "latest").
|
|
app:
|
|
image: git.linuxhg.com/bookhoard/bookhoard:${IMAGE_TAG:-latest}
|
|
container_name: bookhoard
|
|
restart: unless-stopped
|
|
environment:
|
|
# Database Configuration
|
|
# Runtime role = bookhoard_srv (non-superuser OWNER, subject to RLS
|
|
# via FORCE). POSTGRES_USER above is the bootstrap account ONLY —
|
|
# the app must NEVER connect as it (superusers bypass RLS).
|
|
DATABASE_HOST: db
|
|
DATABASE_PORT: ${DB_PORT:-5432}
|
|
DATABASE_USER: bookhoard_srv
|
|
DATABASE_PASSWORD: ${DBSRVPASS}
|
|
DATABASE_NAME: bookhoard
|
|
|
|
# Application Configuration
|
|
JWT_SECRET: ${JWT_SECRET}
|
|
SERVER_PORT: ${SERVER_PORT:-8765}
|
|
# IMPORTANT: Device sync requires full URL with protocol
|
|
# Local: http://localhost:8765
|
|
# Local network: http://192.168.1.X:8765
|
|
# Domain: https://bookhoard.example.com
|
|
BASE_URL: ${BASE_URL:-http://localhost:8765}
|
|
# Mark session cookies Secure; set true behind a TLS-terminating reverse proxy (Caddy/nginx/traefik)
|
|
COOKIE_SECURE: ${COOKIE_SECURE:-false}
|
|
|
|
# Rate Limiting Configuration
|
|
TEST_MODE: ${TEST_MODE:-false}
|
|
RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-true}
|
|
REQUESTS_PER_MINUTE: ${REQUESTS_PER_MINUTE:-10}
|
|
|
|
# Conversion Service Configuration
|
|
BOOKHOARD_CONVERSION_CACHE_DIR: ${BOOKHOARD_CONVERSION_CACHE_DIR:-/app/cache/kepub}
|
|
BOOKHOARD_CONVERSION_TOOL: ${BOOKHOARD_CONVERSION_TOOL:-/usr/bin/kepubify}
|
|
BOOKHOARD_CONVERSION_CACHE_TTL: ${BOOKHOARD_CONVERSION_CACHE_TTL:-24h}
|
|
|
|
# Library Maintenance
|
|
# Days an archived item (file missing from disk for 2+ scans) is kept,
|
|
# with its reading history, before library scans purge it for good.
|
|
# Set 0 to keep archived items until purged manually on the library admin page.
|
|
ARCHIVE_RETENTION_DAYS: ${ARCHIVE_RETENTION_DAYS:-90}
|
|
|
|
# System timezone (fallback for server-side time operations)
|
|
TZ: ${TZ:-UTC}
|
|
ports:
|
|
- "${SERVER_PORT:-8765}:${SERVER_PORT:-8765}"
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
db-init:
|
|
condition: service_completed_successfully
|
|
volumes:
|
|
- ./uploads:/app/uploads
|
|
- bookhoard_conversion_cache:/app/cache/kepub
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -f http://localhost:${SERVER_PORT:-8765}/health || exit 1"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
# Named Volumes
|
|
volumes:
|
|
postgres_data:
|
|
bookhoard_conversion_cache:
|