driver-vault/DriverVault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Docker: persist API Server state, wire up OCPP, drop legacy env names

Browse Source 
Audited every Dockerfile, compose file and .env.example against the code
they deploy. Four things had drifted:

Persistence. The API Server writes plugins.json and rewrites .env (the
panel's retarget-PocketBase flow) relative to its working directory,
which was a root-owned /app while the process runs as the app user - so
both writes failed, and no volume was declared to keep them anyway. The
binary moves to /usr/local/bin and the working directory becomes a /data
volume owned by app. The AIO image gets the same via directory=/data on
its supervisord program.

OCPP. Charger control was undeployable: OCPP_REQUIRE_TLS defaults to true
and appeared in no Docker file, so a charger dialling the plain-HTTP
/ocpp/{serial} was rejected with nothing explaining why. Both OCPP vars
are now threaded through the compose files and env examples, with the
reasoning (the per-charger control token rides in a Basic-auth header).

CORS. API Server/docker-compose.yml defaulted to localhost:5173, the Vite
dev port, where every other file uses 8090.

Env names. .env.example has called PB_URL/PB_ADMIN_*/PORT legacy for a
while, but the Docker layer still used them. Container-side names are now
POCKETBASE_*/API_ADDR; the .env keys operators set stay PB_ADMIN_* so
existing .env files keep working.

Left alone deliberately: alpine:latest stays unpinned (cannot verify
current tags or test the build from here), and the golang/node bases
already match go.mod and Vite 8's floor.

Validated as YAML only - there is no Docker CLI on this machine, so no
image was built and the /data ownership fix follows standard volume
semantics rather than an observed run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
tajniak81
2026-07-21 22:46:01 +02:00
co-authored by Claude Opus 4.8
parent 101df8d210
commit 01d82ebda9
12 changed files with 180 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Docker/.env.example
+10
View File
@@ -10,6 +10,16 @@ PB_ADMIN_PASSWORD=change-me-long-password
CORS_ALLOW_ORIGINS=http://localhost:8090
AUTH_USERS_COLLECTION=users
# --- EV charging control (Anker Solix, OCPP) ---------------------------------
# Only relevant when a charger is set to own/proxy control mode. The charger
# dials in to /ocpp/{serial} on the API Server port, carrying its control token
# in an OCPP Basic-auth header — which a plaintext ws:// would expose, so
# non-TLS connections are rejected by default. This dev stack serves plain
# HTTP: either terminate TLS in front of it and set OCPP_PUBLIC_URL to the
# public wss:// base, or set OCPP_REQUIRE_TLS=false on a trusted network.
OCPP_REQUIRE_TLS=true
OCPP_PUBLIC_URL=
# --- Host port mappings (optional; defaults shown) --------------------------
PB_PORT=8070
API_PORT=8080
Docker/.env.prod.example
+18 -3
View File
@@ -32,6 +32,18 @@ PB_BOOTSTRAP=true
CORS_ALLOW_ORIGINS=http://localhost:8090
AUTH_USERS_COLLECTION=users
# --- EV charging control (Anker Solix, OCPP) ---------------------------------
# Only relevant when a charger is set to own/proxy control mode. The charger
# dials in to /ocpp/{serial} on the API Server port, carrying its control token
# in an OCPP Basic-auth header — which a plaintext ws:// would expose, so
# non-TLS connections are rejected by default. Keep the default and terminate
# TLS in a reverse proxy in front of this stack, setting OCPP_PUBLIC_URL to the
# public wss:// base the charger should be pointed at (deriving it from request
# headers is unreliable behind a proxy). Turning the check off is for trusted
# networks only.
OCPP_REQUIRE_TLS=true
OCPP_PUBLIC_URL=
# --- Ports -------------------------------------------------------------------
# WEB_PORT is the public front door (bound on all interfaces).
WEB_PORT=8090
@@ -43,7 +55,10 @@ API_PORT=8080
API_BIND=127.0.0.1
# --- Storage -----------------------------------------------------------------
# Default is a Docker-managed named volume ("pb_data"). To store the database on
# a host path instead, set PB_DATA to an absolute path, e.g.:
# PB_DATA=/srv/drivervault/pb_data
# Defaults are Docker-managed named volumes. To store either on a host path
# instead, set it to an absolute path, e.g. PB_DATA=/srv/drivervault/pb_data.
# PB_DATA — the PocketBase database and uploads.
# API_DATA — the API Server's plugins.json and the .env the panel writes back
# when a superadmin retargets the PocketBase connection.
PB_DATA=pb_data
API_DATA=api_data
Docker/docker-compose.prod.yml
+17 -5
View File
@@ -48,11 +48,11 @@ services:
pocketbase:
condition: service_healthy
environment:
PORT: "8080"
API_ADDR: ":8080"
# Reach PocketBase by its service name on the internal network.
PB_URL: "http://pocketbase:8070"
PB_ADMIN_EMAIL: "${PB_ADMIN_EMAIL}"
PB_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD}"
POCKETBASE_URL: "http://pocketbase:8070"
POCKETBASE_ADMIN_EMAIL: "${PB_ADMIN_EMAIL}"
POCKETBASE_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD}"
CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
AUTH_USERS_COLLECTION: "${AUTH_USERS_COLLECTION:-users}"
# Schema + super-admin bootstrap (idempotent). Set PB_BOOTSTRAP=false to
@@ -61,10 +61,21 @@ services:
DRIVERVAULT_SUPERADMIN_EMAIL: "${DRIVERVAULT_SUPERADMIN_EMAIL:-}"
DRIVERVAULT_SUPERADMIN_PASSWORD: "${DRIVERVAULT_SUPERADMIN_PASSWORD:-}"
DRIVERVAULT_SUPERADMIN_NAME: "${DRIVERVAULT_SUPERADMIN_NAME:-Administrator}"
# OCPP charger control (Anker Solix). Chargers are rejected unless they
# reach the server over TLS. Behind a TLS-terminating reverse proxy, set
# OCPP_PUBLIC_URL to the public wss:// base and API_BIND so the proxy can
# reach this port; only drop OCPP_REQUIRE_TLS on a trusted network.
OCPP_REQUIRE_TLS: "${OCPP_REQUIRE_TLS:-true}"
OCPP_PUBLIC_URL: "${OCPP_PUBLIC_URL:-}"
ports:
# Localhost-only by default (the Web App reaches it over the internal
# network). Set API_BIND=0.0.0.0 to expose the API panel on the network.
# network). Set API_BIND=0.0.0.0 to expose the API panel — and the
# /ocpp/{serial} endpoint chargers dial into — on the network.
- "${API_BIND:-127.0.0.1}:${API_PORT:-8080}:8080"
volumes:
# plugins.json + the .env the panel writes back — see the API Server
# Dockerfile. Without this, plugin state is lost on container recreate.
- "${API_DATA:-api_data}:/data"
web-app:
image: "${WEB_IMAGE:-10.2.1.10:5500/admin/drivervault-web-app:latest}"
@@ -81,3 +92,4 @@ services:
volumes:
pb_data:
api_data:
Docker/docker-compose.yml
+17 -5
View File
@@ -37,19 +37,30 @@ services:
pocketbase:
condition: service_healthy
environment:
PORT: "8080"
API_ADDR: ":8080"
# Reach PocketBase by its service name on the internal network.
PB_URL: "http://pocketbase:8070"
PB_ADMIN_EMAIL: "${PB_ADMIN_EMAIL}"
PB_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD}"
POCKETBASE_URL: "http://pocketbase:8070"
POCKETBASE_ADMIN_EMAIL: "${PB_ADMIN_EMAIL}"
POCKETBASE_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD}"
# Same-origin requests go through the Web App BFF, so CORS is only needed
# if the browser ever calls the API Server directly. Default to the web origin.
CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
AUTH_USERS_COLLECTION: "${AUTH_USERS_COLLECTION:-users}"
# OCPP charger control (Anker Solix). Chargers are rejected unless they
# connect over TLS; set OCPP_REQUIRE_TLS=false in .env only when TLS is
# terminated in front of this stack or for local dev on a trusted network.
OCPP_REQUIRE_TLS: "${OCPP_REQUIRE_TLS:-true}"
OCPP_PUBLIC_URL: "${OCPP_PUBLIC_URL:-}"
ports:
# Optional direct access to the API Server (and its panel at /); the Web
# App reaches it over the internal network, not this host port.
# App reaches it over the internal network, not this host port. Chargers
# dialling /ocpp/{serial} also arrive here.
- "${API_PORT:-8080}:8080"
volumes:
# plugins.json + the .env the panel writes back — see the API Server
# Dockerfile. Without this, plugin state is lost when the container is
# recreated.
- api_data:/data
web-app:
build:
@@ -70,3 +81,4 @@ services:
volumes:
pb_data:
api_data: