Docker: persist API Server state, wire up OCPP, drop legacy env names

Audited every Dockerfile, compose file and .env.example against the code
they deploy. Four things had drifted:

Persistence. The API Server writes plugins.json and rewrites .env (the
panel's retarget-PocketBase flow) relative to its working directory,
which was a root-owned /app while the process runs as the app user - so
both writes failed, and no volume was declared to keep them anyway. The
binary moves to /usr/local/bin and the working directory becomes a /data
volume owned by app. The AIO image gets the same via directory=/data on
its supervisord program.

OCPP. Charger control was undeployable: OCPP_REQUIRE_TLS defaults to true
and appeared in no Docker file, so a charger dialling the plain-HTTP
/ocpp/{serial} was rejected with nothing explaining why. Both OCPP vars
are now threaded through the compose files and env examples, with the
reasoning (the per-charger control token rides in a Basic-auth header).

CORS. API Server/docker-compose.yml defaulted to localhost:5173, the Vite
dev port, where every other file uses 8090.

Env names. .env.example has called PB_URL/PB_ADMIN_*/PORT legacy for a
while, but the Docker layer still used them. Container-side names are now
POCKETBASE_*/API_ADDR; the .env keys operators set stay PB_ADMIN_* so
existing .env files keep working.

Left alone deliberately: alpine:latest stays unpinned (cannot verify
current tags or test the build from here), and the golang/node bases
already match go.mod and Vite 8's floor.

Validated as YAML only - there is no Docker CLI on this machine, so no
image was built and the /data ownership fix follows standard volume
semantics rather than an observed run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

API Server/.env.example

@@ -31,8 +31,23 @@ WEBAPP_URL=http://localhost:8090
 AUTH_USERS_COLLECTION=users
 
 # Local JSON store for plugin enable-state + config (default: plugins.json).
+# Relative paths resolve against the working directory, so in Docker this points
+# at the mounted volume (see the Dockerfile) rather than the image layer.
 PLUGINS_FILE=plugins.json
 
+# --- EV charging control (Anker Solix, OCPP) ---------------------------------
+# Only relevant when a charger is set to own/proxy control mode. The charger
+# dials in to /ocpp/{serial} on this server, authenticating with OCPP Basic auth
+# (serial + per-charger control token). A plaintext ws:// would carry that token
+# in the clear, so connections that did not arrive over TLS are rejected —
+# disable only for local dev on a trusted network.
+OCPP_REQUIRE_TLS=true
+
+# The canonical ws(s):// base an operator points the charger at. Set this when
+# the server sits behind a reverse proxy, where deriving the URL from request
+# headers is unreliable. Empty = derive it.
+OCPP_PUBLIC_URL=
+
 # --- Legacy names -----------------------------------------------------------
 # PB_URL, PB_ADMIN_EMAIL, PB_ADMIN_PASSWORD, PORT and CORS_ORIGINS are still
 # honoured for older deployments; the POCKETBASE_*/API_ADDR names above win when

API Server/Dockerfile

@@ -28,13 +28,23 @@ RUN apk add --no-cache ca-certificates tzdata
 # Run as an unprivileged user.
 RUN addgroup -S app && adduser -S -G app app
 
-WORKDIR /app
-COPY --from=build /out/api-server /app/api-server
+COPY --from=build /out/api-server /usr/local/bin/api-server
+
+# The server writes two files relative to its working directory: plugins.json
+# (plugin enable-state + config) and .env, which the panel rewrites when a
+# superadmin retargets the PocketBase connection. Both must therefore live on a
+# writable, persistent path — hence /data, owned by the unprivileged user and
+# declared as a volume. A named volume mounted here inherits this ownership.
+RUN mkdir -p /data && chown app:app /data
+WORKDIR /data
+VOLUME /data
 
 # Config comes entirely from environment variables (see .env.example).
-# PB_ADMIN_EMAIL and PB_ADMIN_PASSWORD are required at startup.
-ENV PORT=8080
+# POCKETBASE_ADMIN_EMAIL / _PASSWORD are optional at startup: without them the
+# server still runs and a superadmin can configure the connection from the panel.
+ENV API_ADDR=:8080 \
+    PLUGINS_FILE=/data/plugins.json
 EXPOSE 8080
 
 USER app
-ENTRYPOINT ["/app/api-server"]
+ENTRYPOINT ["/usr/local/bin/api-server"]

API Server/docker-compose.yml

@@ -7,16 +7,29 @@ services:
     container_name: drivervault-api
     restart: unless-stopped
     ports:
-      - "${PORT:-8080}:8080"
+      - "${API_PORT:-8080}:8080"
     environment:
       # Container always listens on 8080; map the host port above.
-      PORT: "8080"
+      API_ADDR: ":8080"
       # External PocketBase instance (all DB access goes through this server).
-      PB_URL: "${PB_URL:-http://10.2.1.10:8027}"
+      POCKETBASE_URL: "${PB_URL:-http://10.2.1.10:8027}"
       # Superuser service account. Leave unset and the server still starts — a
       # superadmin can configure it from the panel; management endpoints 503 until then.
-      PB_ADMIN_EMAIL: "${PB_ADMIN_EMAIL}"
-      PB_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD}"
-      # Browser origins allowed by CORS (native apps are exempt).
-      CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:5173}"
+      POCKETBASE_ADMIN_EMAIL: "${PB_ADMIN_EMAIL}"
+      POCKETBASE_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD}"
+      # Browser origins allowed by CORS (native apps are exempt). Point this at
+      # the Web App origin; add http://localhost:5173 when running Vite in dev.
+      CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
       AUTH_USERS_COLLECTION: "${AUTH_USERS_COLLECTION:-users}"
+      # OCPP charger control (Anker Solix). Chargers are rejected unless they
+      # connect over TLS; set false only when terminating TLS elsewhere or for
+      # local dev on a trusted network. OCPP_PUBLIC_URL overrides the ws(s)://
+      # base derived from request headers (set it when behind a reverse proxy).
+      OCPP_REQUIRE_TLS: "${OCPP_REQUIRE_TLS:-true}"
+      OCPP_PUBLIC_URL: "${OCPP_PUBLIC_URL:-}"
+    volumes:
+      # Holds plugins.json and the .env the panel writes back — see Dockerfile.
+      - api_data:/data
+
+volumes:
+  api_data: