tajniak81andClaude Opus 4.8
01d82ebda9
Audited every Dockerfile, compose file and .env.example against the code
they deploy. Four things had drifted:
Persistence. The API Server writes plugins.json and rewrites .env (the
panel's retarget-PocketBase flow) relative to its working directory,
which was a root-owned /app while the process runs as the app user - so
both writes failed, and no volume was declared to keep them anyway. The
binary moves to /usr/local/bin and the working directory becomes a /data
volume owned by app. The AIO image gets the same via directory=/data on
its supervisord program.
OCPP. Charger control was undeployable: OCPP_REQUIRE_TLS defaults to true
and appeared in no Docker file, so a charger dialling the plain-HTTP
/ocpp/{serial} was rejected with nothing explaining why. Both OCPP vars
are now threaded through the compose files and env examples, with the
reasoning (the per-charger control token rides in a Basic-auth header).
CORS. API Server/docker-compose.yml defaulted to localhost:5173, the Vite
dev port, where every other file uses 8090.
Env names. .env.example has called PB_URL/PB_ADMIN_*/PORT legacy for a
while, but the Docker layer still used them. Container-side names are now
POCKETBASE_*/API_ADDR; the .env keys operators set stay PB_ADMIN_* so
existing .env files keep working.
Left alone deliberately: alpine:latest stays unpinned (cannot verify
current tags or test the build from here), and the golang/node bases
already match go.mod and Vite 8's floor.
Validated as YAML only - there is no Docker CLI on this machine, so no
image was built and the /data ownership fix follows standard volume
semantics rather than an observed run.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
52 lines
2.4 KiB
YAML
52 lines
2.4 KiB
YAML
name: drivervault-aio
|
|
|
|
# Production all-in-one — pulls the prebuilt image from the registry instead of
|
|
# building. One container runs PocketBase + API Server + Web App (nginx).
|
|
# Everything an operator needs to set lives in .env.
|
|
#
|
|
# 1. cp .env.prod.example .env (then edit it)
|
|
# 2. docker compose -f docker-compose.prod.yml pull
|
|
# 3. docker compose -f docker-compose.prod.yml up -d
|
|
#
|
|
# On first boot PocketBase upserts the superuser from PB_ADMIN_*, and the API
|
|
# Server creates any missing collections and the DriverVault super-admin from
|
|
# DRIVERVAULT_SUPERADMIN_*. Both steps are idempotent.
|
|
|
|
services:
|
|
drivervault:
|
|
image: "${AIO_IMAGE:-10.2.1.10:5500/admin/drivervault-aio:latest}"
|
|
container_name: drivervault-aio
|
|
restart: unless-stopped
|
|
environment:
|
|
# Superuser (also used by the API Server to authenticate to PocketBase).
|
|
PB_ADMIN_EMAIL: "${PB_ADMIN_EMAIL:?set PB_ADMIN_EMAIL in .env}"
|
|
PB_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD:?set PB_ADMIN_PASSWORD in .env}"
|
|
# Match CORS to the web origin (only used if a browser calls the API directly).
|
|
CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
|
|
# Schema + super-admin bootstrap on boot (idempotent). Set PB_BOOTSTRAP=false
|
|
# to skip once the database is established.
|
|
PB_BOOTSTRAP: "${PB_BOOTSTRAP:-true}"
|
|
DRIVERVAULT_SUPERADMIN_EMAIL: "${DRIVERVAULT_SUPERADMIN_EMAIL:-}"
|
|
DRIVERVAULT_SUPERADMIN_PASSWORD: "${DRIVERVAULT_SUPERADMIN_PASSWORD:-}"
|
|
DRIVERVAULT_SUPERADMIN_NAME: "${DRIVERVAULT_SUPERADMIN_NAME:-Administrator}"
|
|
# OCPP charger control (Anker Solix). This image serves plain HTTP, so a
|
|
# charger can only connect when TLS is terminated in front of it (set
|
|
# OCPP_PUBLIC_URL to the public wss:// base) — or, on a trusted network,
|
|
# with OCPP_REQUIRE_TLS=false.
|
|
OCPP_REQUIRE_TLS: "${OCPP_REQUIRE_TLS:-true}"
|
|
OCPP_PUBLIC_URL: "${OCPP_PUBLIC_URL:-}"
|
|
ports:
|
|
- "${WEB_PORT:-8090}:80" # Web App
|
|
- "${PB_PORT:-8070}:8070" # PocketBase admin UI / API
|
|
- "${API_PORT:-8080}:8080" # API Server + panel (root /) + /ocpp/{serial}
|
|
volumes:
|
|
# Named volumes by default; set PB_DATA / API_DATA to host paths in .env
|
|
# for bind mounts.
|
|
- "${PB_DATA:-pb_data}:/pb/pb_data"
|
|
# plugins.json + the .env the panel writes back.
|
|
- "${API_DATA:-api_data}:/data"
|
|
|
|
volumes:
|
|
pb_data:
|
|
api_data:
|