Docker: persist API Server state, wire up OCPP, drop legacy env names
Audited every Dockerfile, compose file and .env.example against the code
they deploy. Four things had drifted:
Persistence. The API Server writes plugins.json and rewrites .env (the
panel's retarget-PocketBase flow) relative to its working directory,
which was a root-owned /app while the process runs as the app user - so
both writes failed, and no volume was declared to keep them anyway. The
binary moves to /usr/local/bin and the working directory becomes a /data
volume owned by app. The AIO image gets the same via directory=/data on
its supervisord program.
OCPP. Charger control was undeployable: OCPP_REQUIRE_TLS defaults to true
and appeared in no Docker file, so a charger dialling the plain-HTTP
/ocpp/{serial} was rejected with nothing explaining why. Both OCPP vars
are now threaded through the compose files and env examples, with the
reasoning (the per-charger control token rides in a Basic-auth header).
CORS. API Server/docker-compose.yml defaulted to localhost:5173, the Vite
dev port, where every other file uses 8090.
Env names. .env.example has called PB_URL/PB_ADMIN_*/PORT legacy for a
while, but the Docker layer still used them. Container-side names are now
POCKETBASE_*/API_ADDR; the .env keys operators set stay PB_ADMIN_* so
existing .env files keep working.
Left alone deliberately: alpine:latest stays unpinned (cannot verify
current tags or test the build from here), and the golang/node bases
already match go.mod and Vite 8's floor.
Validated as YAML only - there is no Docker CLI on this machine, so no
image was built and the /data ownership fix follows standard volume
semantics rather than an observed run.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
tajniak81
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
101df8d210
commit
01d82ebda9
@@ -18,6 +18,16 @@ PB_BOOTSTRAP=true
|
||||
# Allowed CORS origin(s) — match your web origin / WEB_PORT.
|
||||
CORS_ALLOW_ORIGINS=http://localhost:8090
|
||||
|
||||
# --- EV charging control (Anker Solix, OCPP) ---------------------------------
|
||||
# Only relevant when a charger is set to own/proxy control mode. The charger
|
||||
# dials in to /ocpp/{serial} on the API Server port, carrying its control token
|
||||
# in an OCPP Basic-auth header — which a plaintext ws:// would expose, so
|
||||
# non-TLS connections are rejected by default. This image serves plain HTTP:
|
||||
# either terminate TLS in front of it and set OCPP_PUBLIC_URL to the public
|
||||
# wss:// base, or set OCPP_REQUIRE_TLS=false on a trusted network.
|
||||
OCPP_REQUIRE_TLS=true
|
||||
OCPP_PUBLIC_URL=
|
||||
|
||||
# --- Host port mappings (optional; defaults shown) --------------------------
|
||||
WEB_PORT=8090
|
||||
PB_PORT=8070
|
||||
|
||||
@@ -24,12 +24,27 @@ PB_BOOTSTRAP=true
|
||||
# Allowed CORS origin(s) — match your public web URL / WEB_PORT.
|
||||
CORS_ALLOW_ORIGINS=http://localhost:8090
|
||||
|
||||
# --- EV charging control (Anker Solix, OCPP) ---------------------------------
|
||||
# Only relevant when a charger is set to own/proxy control mode. The charger
|
||||
# dials in to /ocpp/{serial} on the API Server port, carrying its control token
|
||||
# in an OCPP Basic-auth header — which a plaintext ws:// would expose, so
|
||||
# non-TLS connections are rejected by default. This image serves plain HTTP, so
|
||||
# terminate TLS in a reverse proxy in front of it and set OCPP_PUBLIC_URL to the
|
||||
# public wss:// base the charger should be pointed at. Turning the check off is
|
||||
# for trusted networks only.
|
||||
OCPP_REQUIRE_TLS=true
|
||||
OCPP_PUBLIC_URL=
|
||||
|
||||
# --- Host port mappings (optional; defaults shown) --------------------------
|
||||
WEB_PORT=8090
|
||||
PB_PORT=8070
|
||||
API_PORT=8080
|
||||
|
||||
# --- Storage -----------------------------------------------------------------
|
||||
# Default is a Docker-managed named volume ("pb_data"). Set PB_DATA to an
|
||||
# absolute host path for a bind mount, e.g. PB_DATA=/srv/drivervault/pb_data
|
||||
# Defaults are Docker-managed named volumes. Set either to an absolute host path
|
||||
# for a bind mount, e.g. PB_DATA=/srv/drivervault/pb_data.
|
||||
# PB_DATA — the PocketBase database and uploads.
|
||||
# API_DATA — the API Server's plugins.json and the .env the panel writes back
|
||||
# when a superadmin retargets the PocketBase connection.
|
||||
PB_DATA=pb_data
|
||||
API_DATA=api_data
|
||||
|
||||
+19
-5
@@ -15,6 +15,7 @@
|
||||
# -e DRIVERVAULT_SUPERADMIN_EMAIL=owner@example.com \
|
||||
# -e DRIVERVAULT_SUPERADMIN_PASSWORD=change-me \
|
||||
# -v drivervault_pb:/pb/pb_data \
|
||||
# -v drivervault_api:/data \
|
||||
# drivervault-aio
|
||||
#
|
||||
# Then: web app on http://host/ and PocketBase admin on http://host:8070/_/
|
||||
@@ -127,8 +128,11 @@ stdout_logfile_maxbytes=0
|
||||
stderr_logfile=/dev/stderr
|
||||
stderr_logfile_maxbytes=0
|
||||
|
||||
; API Server: wait for PocketBase to be healthy, then start.
|
||||
; API Server: wait for PocketBase to be healthy, then start. It runs from /data
|
||||
; because it writes plugins.json and the panel's .env relative to its working
|
||||
; directory, and /data is the volume that keeps them across container recreates.
|
||||
[program:api-server]
|
||||
directory=/data
|
||||
command=/bin/sh -c 'until wget -qO- http://127.0.0.1:8070/api/health >/dev/null 2>&1; do echo "waiting for pocketbase..."; sleep 1; done; exec /usr/local/bin/api-server'
|
||||
priority=20
|
||||
autostart=true
|
||||
@@ -150,18 +154,28 @@ stderr_logfile_maxbytes=0
|
||||
SUPERVISOR
|
||||
|
||||
# API Server config: everything is local to this container.
|
||||
ENV PORT=8080 \
|
||||
PB_URL=http://127.0.0.1:8070 \
|
||||
ENV API_ADDR=:8080 \
|
||||
POCKETBASE_URL=http://127.0.0.1:8070 \
|
||||
CORS_ALLOW_ORIGINS=http://localhost:8090 \
|
||||
AUTH_USERS_COLLECTION=users
|
||||
AUTH_USERS_COLLECTION=users \
|
||||
PLUGINS_FILE=/data/plugins.json
|
||||
|
||||
# Required at runtime (no safe defaults): PB_ADMIN_EMAIL, PB_ADMIN_PASSWORD.
|
||||
# Optional: DRIVERVAULT_SUPERADMIN_EMAIL / DRIVERVAULT_SUPERADMIN_PASSWORD create
|
||||
# the first app super-admin on boot; PB_BOOTSTRAP=false skips schema setup.
|
||||
# For Anker Solix charger control, OCPP_REQUIRE_TLS (default true) rejects
|
||||
# chargers that did not arrive over TLS — this image serves plain HTTP, so put a
|
||||
# TLS-terminating proxy in front and set OCPP_PUBLIC_URL to the public wss://
|
||||
# base, or set OCPP_REQUIRE_TLS=false on a trusted network.
|
||||
# Pass them with `docker run -e ...`.
|
||||
|
||||
RUN mkdir -p /data
|
||||
# pb_data holds the database; /data holds the API Server's plugins.json and the
|
||||
# .env the panel rewrites when a superadmin retargets PocketBase.
|
||||
VOLUME /pb/pb_data
|
||||
# 80 = Web App, 8070 = PocketBase admin, 8080 = API Server + embedded API panel.
|
||||
VOLUME /data
|
||||
# 80 = Web App, 8070 = PocketBase admin, 8080 = API Server + embedded API panel
|
||||
# (also the /ocpp/{serial} endpoint chargers dial into).
|
||||
EXPOSE 80 8070 8080
|
||||
|
||||
CMD ["supervisord", "-c", "/etc/supervisord.conf"]
|
||||
|
||||
@@ -29,13 +29,23 @@ services:
|
||||
DRIVERVAULT_SUPERADMIN_EMAIL: "${DRIVERVAULT_SUPERADMIN_EMAIL:-}"
|
||||
DRIVERVAULT_SUPERADMIN_PASSWORD: "${DRIVERVAULT_SUPERADMIN_PASSWORD:-}"
|
||||
DRIVERVAULT_SUPERADMIN_NAME: "${DRIVERVAULT_SUPERADMIN_NAME:-Administrator}"
|
||||
# OCPP charger control (Anker Solix). This image serves plain HTTP, so a
|
||||
# charger can only connect when TLS is terminated in front of it (set
|
||||
# OCPP_PUBLIC_URL to the public wss:// base) — or, on a trusted network,
|
||||
# with OCPP_REQUIRE_TLS=false.
|
||||
OCPP_REQUIRE_TLS: "${OCPP_REQUIRE_TLS:-true}"
|
||||
OCPP_PUBLIC_URL: "${OCPP_PUBLIC_URL:-}"
|
||||
ports:
|
||||
- "${WEB_PORT:-8090}:80" # Web App
|
||||
- "${PB_PORT:-8070}:8070" # PocketBase admin UI / API
|
||||
- "${API_PORT:-8080}:8080" # API Server + embedded API web panel (root /)
|
||||
- "${API_PORT:-8080}:8080" # API Server + panel (root /) + /ocpp/{serial}
|
||||
volumes:
|
||||
# Named volume by default; set PB_DATA to a host path in .env for a bind mount.
|
||||
# Named volumes by default; set PB_DATA / API_DATA to host paths in .env
|
||||
# for bind mounts.
|
||||
- "${PB_DATA:-pb_data}:/pb/pb_data"
|
||||
# plugins.json + the .env the panel writes back.
|
||||
- "${API_DATA:-api_data}:/data"
|
||||
|
||||
volumes:
|
||||
pb_data:
|
||||
api_data:
|
||||
|
||||
@@ -30,12 +30,21 @@ services:
|
||||
DRIVERVAULT_SUPERADMIN_EMAIL: "${DRIVERVAULT_SUPERADMIN_EMAIL:-}"
|
||||
DRIVERVAULT_SUPERADMIN_PASSWORD: "${DRIVERVAULT_SUPERADMIN_PASSWORD:-}"
|
||||
DRIVERVAULT_SUPERADMIN_NAME: "${DRIVERVAULT_SUPERADMIN_NAME:-Administrator}"
|
||||
# OCPP charger control (Anker Solix). This image serves plain HTTP, so a
|
||||
# charger can only connect when TLS is terminated in front of it (set
|
||||
# OCPP_PUBLIC_URL to the public wss:// base) — or, on a trusted network,
|
||||
# with OCPP_REQUIRE_TLS=false.
|
||||
OCPP_REQUIRE_TLS: "${OCPP_REQUIRE_TLS:-true}"
|
||||
OCPP_PUBLIC_URL: "${OCPP_PUBLIC_URL:-}"
|
||||
ports:
|
||||
- "${WEB_PORT:-8090}:80" # Web App
|
||||
- "${PB_PORT:-8070}:8070" # PocketBase admin UI / API
|
||||
- "${API_PORT:-8080}:8080" # API Server + embedded API web panel (root /)
|
||||
- "${API_PORT:-8080}:8080" # API Server + panel (root /) + /ocpp/{serial}
|
||||
volumes:
|
||||
- pb_data:/pb/pb_data
|
||||
# plugins.json + the .env the panel writes back.
|
||||
- api_data:/data
|
||||
|
||||
volumes:
|
||||
pb_data:
|
||||
api_data:
|
||||
|
||||
Reference in New Issue
Block a user