tajniak81andClaude Opus 5.5
0ea562a80a
PocketBase reaches the gateway over the compose network (or inside the AIO container), so publishing 8333 on the host only made a second SeaweedFS stack fail with "port is already allocated". Drop the binding and SEAWEED_S3_BIND/SEAWEED_S3_PORT. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
127 lines
6.5 KiB
Bash
127 lines
6.5 KiB
Bash
# Copy to .env and fill in. Used by docker-compose.seaweedfs.split.yml — the
|
|
# same stack as .env.seaweedfs.example, with SeaweedFS running as separate
|
|
# master / volume / filer / S3 containers plus the SeaweedFS admin UI.
|
|
|
|
# --- PocketBase superuser (also used by the API Server to authenticate) ------
|
|
PB_ADMIN_EMAIL=admin@example.com
|
|
PB_ADMIN_PASSWORD=change-me-long-password
|
|
|
|
# --- DriverVault super-admin (app login) -------------------------------------
|
|
# The first application user, created by the API Server on boot with role
|
|
# "superadmin" if no user with this email exists yet. Leave these blank and the
|
|
# schema is still created but no user is, leaving a stack you cannot log into.
|
|
DRIVERVAULT_SUPERADMIN_EMAIL=owner@example.com
|
|
DRIVERVAULT_SUPERADMIN_PASSWORD=change-me-long-password
|
|
DRIVERVAULT_SUPERADMIN_NAME=Administrator
|
|
|
|
# Schema creation/reconcile on boot. Leave this true: a release can add
|
|
# collections or fields the server needs, and a stack that skips the bootstrap
|
|
# never gets them. (The API Server creates app_settings, which holds the plugin
|
|
# settings, on demand — but only that one.) Set false only for a database you
|
|
# know already matches the release.
|
|
PB_BOOTSTRAP=true
|
|
|
|
# --- API Server -------------------------------------------------------------
|
|
# Allowed CORS origin(s) for the web app (match WEB_PORT / your public URL).
|
|
# Native mobile apps are not subject to CORS.
|
|
CORS_ALLOW_ORIGINS=http://localhost:8090
|
|
AUTH_USERS_COLLECTION=users
|
|
|
|
# --- EV charging control (Anker Solix, OCPP) ---------------------------------
|
|
# Only relevant when a charger is set to own/proxy control mode. The charger
|
|
# dials in to /ocpp/{serial} on the API Server port, carrying its control token
|
|
# in an OCPP Basic-auth header — which a plaintext ws:// would expose, so
|
|
# non-TLS connections are rejected by default. This dev stack serves plain
|
|
# HTTP: either terminate TLS in front of it and set OCPP_PUBLIC_URL to the
|
|
# public wss:// base, or set OCPP_REQUIRE_TLS=false on a trusted network.
|
|
OCPP_REQUIRE_TLS=true
|
|
OCPP_PUBLIC_URL=
|
|
|
|
# Diagnostic only. Set to 1 to log every frame the charger publishes over Anker's
|
|
# cloud broker — the ones DriverVault decodes and the ones it cannot, with their
|
|
# bytes. It is how an unnamed frame gets named: hold a control read open, do the
|
|
# thing in the Anker app, then read the frames back out of the container log.
|
|
# Leave blank on a normal stack; a triggered charger writes a line every few
|
|
# seconds.
|
|
ANKER_MQTT_FRAME_LOG=
|
|
|
|
# The charger can dial either door: the API Server port directly, or the Web
|
|
# App port, whose BFF now proxies /ocpp/ through to it. The endpoint the panel
|
|
# shows is the API Server port only when OCPP_PUBLIC_URL says so — left blank it
|
|
# is whichever host the panel itself was reached on, which is the Web App.
|
|
# TRUST_FORWARDED_PROTO lets the BFF pass an inbound X-Forwarded-Proto to the
|
|
# API Server: needed when TLS ends at a proxy in front of the stack and
|
|
# OCPP_REQUIRE_TLS stays on, and unsafe otherwise, since the header is then
|
|
# whatever the client said it was.
|
|
TRUST_FORWARDED_PROTO=false
|
|
|
|
# --- Host port mappings (optional; defaults shown) --------------------------
|
|
PB_PORT=8070
|
|
API_PORT=8080
|
|
WEB_PORT=8090
|
|
|
|
# --- Web App build -----------------------------------------------------------
|
|
# Leave empty so the browser uses same-origin /api (proxied by the BFF).
|
|
VITE_API_BASE=
|
|
|
|
# --- Settings the API Server panel can also change ---------------------------
|
|
# The panel's Settings screens apply these immediately, but only for the life of
|
|
# the container — the values below are re-applied on every restart and win. Set
|
|
# them here to make a change permanent.
|
|
# POCKETBASE_URL where the API Server looks for the database. Defaults to
|
|
# the bundled pocketbase service; set it to reach one
|
|
# outside this stack.
|
|
# WEBAPP_URL the Web App address the panel status page probes. It is
|
|
# a container-to-container call, so it must be reachable
|
|
# from the API Server, not from your browser.
|
|
# CORS_ALLOW_ORIGINS browser origins allowed to call the API Server directly.
|
|
# POCKETBASE_URL=http://pocketbase:8070
|
|
# WEBAPP_URL=http://web-app:8090
|
|
|
|
# --- File storage: SeaweedFS -------------------------------------------------
|
|
# PocketBase keeps its record files — document scans, service and refill
|
|
# receipts, workshop invoices, part photos — in the bucket below instead of on
|
|
# pb_data. The database and PocketBase's own backups stay where they are.
|
|
#
|
|
# The credentials do double duty: seaweedfs-init writes them into the filer's
|
|
# IAM store as the identity named "drivervault" *and* they are what PocketBase
|
|
# authenticates with. There are no safe defaults, and the stack refuses to start
|
|
# without them. Change them here and restart to rotate: the seed updates the
|
|
# identity in place rather than adding a second one.
|
|
PB_S3_ACCESS_KEY=
|
|
PB_S3_SECRET=
|
|
# The bucket. Created on first boot by the seaweedfs-init container.
|
|
PB_S3_BUCKET=drivervault
|
|
# SeaweedFS ignores the region; PocketBase insists on having one.
|
|
PB_S3_REGION=us-east-1
|
|
# The SeaweedFS image, pinned so a rebuild months from now brings up the same
|
|
# one. All five SeaweedFS containers run it.
|
|
# SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
|
|
|
|
# --- SeaweedFS admin UI ------------------------------------------------------
|
|
# http://localhost:23646 — cluster topology, volumes, buckets, and
|
|
# Object Store → Users, where further S3 identities are created and revoked.
|
|
# They land in the filer's IAM store, the same one seeded above, and the gateway
|
|
# picks them up without a restart.
|
|
#
|
|
# REQUIRED: weed disables authentication entirely when the password is empty,
|
|
# and this panel can mint credentials for the bucket.
|
|
SEAWEED_ADMIN_USER=admin
|
|
SEAWEED_ADMIN_PASSWORD=
|
|
# SEAWEED_ADMIN_PORT=23646
|
|
|
|
# --- SeaweedFS host ports (optional; defaults shown) -------------------------
|
|
# Published for aws-cli, `weed shell` and poking around while developing. The
|
|
# stack itself reaches every one of these over the compose network, and the S3
|
|
# gateway too, which is not published so a second stack cannot clash on it.
|
|
# Note SEAWEED_VOLUME_PORT: the volume server serves file content by id with NO
|
|
# authentication, so do not carry this mapping over to a shared machine. It
|
|
# lands on 8081 because API_PORT already has 8080.
|
|
# SEAWEED_MASTER_PORT=9333
|
|
# SEAWEED_VOLUME_PORT=8081
|
|
# SEAWEED_FILER_PORT=8888
|
|
|
|
# Existing uploads are NOT migrated when this is switched on: PocketBase copies
|
|
# nothing, so attachments made before the switch stop resolving. Read the file
|
|
# storage section of README.md first.
|